36C24520Q0363-001.pdf

Security Requirements.

Operational and Physical Security (OPSEC) Items Prohibited Within Army Facilities. Dangerous weapons, instruments or devices. This includes, but is not limited to, the following:

Rifles, automatic rifles, machine guns, sub-machine guns, pistols, machine pistols flare pistols, starter pistols, compressed gas, air or spring fired pellet or "BB" guns, sling shots, blow guns, or any other device which uses gun powder, compressed gas or air, or spring tension to forcefully eject a projectile or other device which may injure someone;

Daggers, switch blades, bow and arrows, spear guns, Hawaiian slings, powerheads, fishing knives, scuba knives, or any knife with a blade longer that 2 1/2 inches (Knives used for authorized construction and or repair efforts are excluded from this prohibition);

Martial arts devices (throwing stars, nun chucks), stun guns, Tasers, brass knuckles, Billy clubs, night sticks, pipe, bars, or mallets, or other similar devices capable of being used as a weapon;

"Explosives" designed to, or having the capability to, cause death, serious bodily injury, or substantial material damage;

"Other lethal devices" designed to or that have the capability to, cause death, serious bodily injury, or substantial damage to property through the release, dissemination, or impact of toxic chemicals, biological agents, or toxins or radiation or radioactive material;

Any other item that may be used to inflict serious injury or death to another person or temporarily blind or disable an individual and which have not been specifically authorized by proper authority;

Explosive article or compound. This includes but is not limited to: ammunition for any of the small arms weapons mentioned as a dangerous weapon, including "blank" ammunition, gunpowder, Molotov cocktails, pipe bombs, grenades, pyrotechnics, fireworks or any other compound or article which might violently react and cause injury not specifically authorized by proper authority.

Physical Security/Access Controls Procedures.

The Contractor will comply with all emergency rules and procedures established for Army facilities.

All personnel assigned to or visiting Army facilities are subject to random inspections of their vehicles, personal items in their possession, and of their persons. Consent to these inspections is considered granted when access is given for Army facilities and visitor badges have been given to Contractors visiting. The Contractor shall adhere to the escort policy within a given agency.

Contractor personnel not physically located/assigned to a given Army agency but who require frequent access to Army facilities in the performance of their contract may be eligible for a Facility Support Badge.

The badge may be obtained through the Security Office of that agency.

The Army Security Office may, at their discretion, authorize the issuance of Army badges for a period not to exceed the length of the basic contract or option period. The Army badges must be worn above the waist in plain sight at all times within Army facilities. Lost or misplaced badges must be immediately reported to Security Office (within one working day). Additionally, the Facility Security Officer (FSO) and the person to whom the badge is issued shall promptly report a name change, clearance level change, or transfer within Army offices to the Army Security Office. The Contractor shall establish a system to assure that the Army Security Office is promptly notified of such changes or when a person issued an ARMY badge is terminating employment with the company or is transferring within the company and will no longer need access to Army facilities. The need for transferring personnel to retain an Army badge shall be determined by the Director, Security Office. The Contractor shall be responsible for assuring that the badges for such personnel are turned in to the Army Security Office prior to their departure.

Personnel who are issued Army Badges and granted access to Army computer systems will have a valid security clearance which is accessible using the Joint Personnel Adjudication System (JPAS). The Contractor shall establish a system to immediately notify the Director, Intelligence and Security, when a Contractor employee's clearance is withdrawn or administratively downgraded for any reason

Information System (IS) Security.

Contractors using Army information systems, networks or computer resources will comply with the provisions of applicable DoD and Army Directives and Instructions governing their use.

Access to Army information systems is limited to Government Staff and approved Contractor employees who have been issued the requisite system privileges, as well as meeting security clearance and Need-To- Know requirements for access to Army network systems. Under no circumstance shall a visiting or assigned Contractor employee and/or representative obtain access to, connect to, or otherwise interface with any Army information system (classified or unclassified) without prior written approval from the Army Information System Security Officer. This includes the attaching of unapproved laptops and other hardware peripherals to the Army Management Support System (DMLSS) and stand-alone systems.

The use of wireless computer technology (Bluetooth, 802.11X,RF, etc.) within the Army enclave is prohibited without explicit written permission from the Army Designated Approval Authority (DAA). This includes both Contractor and Army provided radio-frequency wireless devices and networks.

Contractors will use DoD information systems only for authorized purposes and never for personal business or prohibited uses. Prohibited uses include placing, downloading, or storing material onto computers or conducting Internet searches or otherwise accessing or using sites containing, or using government equipment and time to print, produce, or store material that society would consider to be pornographic, hate crime or gambling.

Personnel Administration/Training

DoD Information Assurance Awareness. Applicable to all Contractor and subcontractor employees who require access to Government Information Systems. All Contractor employees with access to a Government information system must successfully complete the DoD Information Assurance Awareness training prior to access to the information system and then annually thereafter. The course can be accessed on-line at https://ia.signal.Army.mil and takes approximately one (1) hour to complete.

Operations Security Training (OPSEC). Per AR 530-1, Operations Security, all Contractor and subcontractor employees must complete Level I OPSEC Awareness training. This non-residential training is required every 365 days. The course takes approximately 30 minutes to complete. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

Information Assurance (IA) and Information Technology (IT) Training. All contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, and AR 25-2 within six months of appointment to IA/IT functions.

Army-Wide Network Security Focus Training. Contractor and subcontractor employees shall complete the required non-residential training courses to include Phishing, Personally Identifiable Information, Portable Electronic Devices and Removable Storage Media, Safe Home Computing, and Social Networking. The one-time is required for the establishment of a Government network account. The training takes approximately one (1) hour to complete.

Health Insurance Portability and Accountability Act (HIPAA) and Privacy Act Security Training. The Contractor and subcontractor employees shall complete this required non-residential initial core training course and annual birth month refresher training thereafter, available on-line at https://mhslearn.csd.disa.mil/ilearn/en/learner/mhs/portal/mhsstaff_login.jsp. The course takes approximately two (2) hours to complete.

Authorized use policy agreement. The Contractor shall ensure that the Acceptable Use Policy (AUP) Agreement, outlining the terms and conditions in utilization of Government computer and communication systems, is signed by all contractor personnel to, include, all subcontractors and consultants, or performing on this contract and adhere to the terms of the AUP. Assignment of contract personnel who have not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor. An acceptable AUP deliverable can be completed at https://ia.signal.Army.mil; contractor employee shall sign and contractor shall upload the signed AUP to contractor employee's ATCTS account.

Contractor Identification

When contractor personnel perform the services required in this contract on a Government installation, they are required to possess and wear an identification badge that displays his or her name and the name of the Company.

The contractor shall ensure that contractor personnel identify themselves as contractors when attending meetings, answering Government telephones, providing any type of written correspondence, or working in situations where their actions could be construed as official Government acts.

While performing in a contractor capacity, contractor personnel shall refrain from using their retired or reserve component military rank or title in all written or verbal communications.

Security and Safety The Contractor shall protect all For Official Use Only (FOUO) and non-classified and “Secret Level” classified information.

Access and general protection/security policy and procedures. Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office corresponding to the location of performance. Contractor workforce must comply with all personal identity verification requirements (FAR Clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

Force Protection Condition (FPCON) impact on work levels. The Contractor employees must comply with all personal identity verification requirements as directed by DoD, and local policy. In addition to the changes otherwise authorized by the changes clauses of this CONTRACT, should the FPCON at any individual facility or installation change, the Government may require changes in Contractor security matters or process. IAW DoDI 2000.16, the FPCON is defined as follows:

FPCON ALPHA. This condition applies when there is a general threat of possible terrorist activity against personnel and facilities, the nature and extent of which are unpredictable, and circumstances do not justify full implementation of FPCON BRAVO measures. However, it may be necessary to implement certain measures from higher THREATCONS resulting from intelligence received or as a deterrent. The measures in this THREATCON must be capable of being maintained indefinitely.

FPCON BRAVO. This condition applies when an increased and more predictable threat of terrorist activity exists. The measures in this THREATCON must be capable of being maintained for weeks without causing undue hardship, affecting operational capability, and aggravating relations with local authorities.

FPCON CHARLIE. This condition applies when an incident occurs or intelligence received indicating some form of terrorist action against personnel and facilities is imminent. Implementation of measures in this THREATCON for more than a short period probably will create hardship and affect the peacetime activities of the unit and its personnel.

FPCON DELTA. This condition applies in the immediate area where a terrorist attack has occurred or when intelligence has been received that terrorist action against a specific location or person is likely. Normally, this THREATCON is declared as a localized condition.

Access to DoD-controlled installations, facilities, and personnel badging. Applicable for all Contractor employees with an area of performance within a DoD- controlled installation, facility or area. The Contractor and all associated subcontractors’ employees shall comply with applicable installation, facility, and area commander installation and facility access and local security policies and procedures provided by the Government representative. For Contractor’s furnished facility, controlled access to the office space shall be provided to protect GFE and information.

Initial Security Orientation. The Contractor shall coordinate with the Army Security and Intelligence office to ensure that all contractor employees receive the initial security orientation and provide the COR-TO with proof of contractor employee participation.

Army Security Requirements. A preliminary check (National Crime Information Center and Credit Bureau Check) is required prior to the Contractor employee commencing work under this contract. Contractor shall ensure that all investigation(s) required to obtain an Army security badge will be completed prior to employees’ first day of work. Notwithstanding other submission requirements stated elsewhere in this contract, the Contractor shall submit the following information to the COR, ten (10) calendar days prior to commencement of work hereunder: certification that all required security review requests have been processed, and a list of Contractor employee names for which the required security information checks have been provided.

Contractor employee must have a favorable interim Secret determination based off of a National Agency Check with Local Agency Check and Credit Check (NACLC) investigation, or favorably adjudicated NACLC with Secret eligibility. The investigation must be initiated and interim or final security clearance granted no later than the commencement of work. The Government, at no cost to the Contractor, will conduct any additional required background investigations. These security requirements are in accordance with the DD Form 254 (DoD Contract Security Classification Specification). The Contractor shall initiate the necessary personnel background checks for successful processing through the USAMRICD Security and Intelligence Office (S2). The highest clearance required will be at the Secret level. This requirement includes subcontractors who will be working in an ARMY facility or who will have access to the ARMY equipment and non-public privileged, proprietary, or trade secret information. Overarching security requirements and Contractor access to classified information will be specified in the DD Form 254. The Contractor employee will return all issued U.S. Government Common Access Cards, installation badges, and access badges to the ARMY Intelligence Directorate when the contract is completed or expired, when the CAC expires and has not been scheduled for renewal, or when a Contractor employee no longer requires access to the installation and facility.

The Contactor and all associated subcontractors' employees shall comply with applicable installation, facility, and area commander installation local security policies and procedures (provided by the Government representative). The Contactor shall provide all information required for the completion of background checks to be accomplished by the Installation Provost Marshal Office, Director of Emergency Services, or the ARMY Intelligence Directorate. The Contractor and all associated subcontractors’ employees must comply with all personal identity verification requirements as directed by the DoD, HQDA, and/or local policy. Should the Force Protection Condition (FPCON) at the facility or installation change, the Government may require changes in Contactor’s security processes.

Security and Identification (ID) Badges. The Government will provide an ARMY ID Building badge which will be worn/displayed per local policy. Upon notification, the Contractor employee who is cleared to commence work shall complete an in-processing checklist and submit the forms in person to the S2, before security/photo ID badges will be issued. Contractors must be escorted prior to completion of all in-processing requirements. The U.S. Office of Personnel Management (OPM) background investigation will take approximately one hundred and twenty (120) days. The ARMY Personnel Security Staff will work with the Contractor employee to resolve any issues associated with the form(s). Contractor employees who have been previously granted a Government security clearance will advise the ARMY Personnel Security Staff of the details of such clearances to determine if the previous clearance is suitable for the current position. At any time a Contractor employee for whom security forms have been submitted is terminated or otherwise ceases work under the contract, the Contractor shall immediately notify the ARMY Personnel Security Staff, in writing, with copies to the COR-TO and KO. In the event that a cleared individual is replaced, the Contractor shall notify the COR-TO and KO and comply with all requirements of this clause, as specified herein, prior to the commencement of work by the replacement individual.

Property Security. The Contractor employee is responsible for safeguarding all Government equipment, information, and property provided for their use. At the close of each work period and when the area is vacant of personnel, Government facilities, rooms, laboratories, equipment, and materials shall be secured.

At no time is Government equipment, information, or property to be taken out of the Army facilities without express written permission from the Commander.

Facility Security. Contractor employees are not authorized access to the Army buildings before 0600 and /or after 1800 pm ET, Monday through Friday. For access to the buildings during unauthorized hours, Contractor employee will submit a request for extended hours through the appropriate chain of command.

Contractor employees are not authorized in the Army facilities without a Government employee present. The Government employee is responsible for ensuring that the Contractor employee is appropriately supervised by a Government employee while in the Army facilities.

Unclassified Contract Security Requirements. Unless stated otherwise at the minimum, the Contractor shall ensure all personnel performing under this CONTRACT have a favorable National Agency Check with Written Inquires (NACI), which must be coordinated with the Local Security Office for the work site location via the COR for submission prior to performance start date. NACI must be fully adjudicated prior to personnel start date. The security requirements must be maintained for the life of the CONTRACT, and citizenship will be verified by presenting an original birth certificate or a US Passport or the original Naturalization Certificate to the Local Security Office at the time of in processing for all CONTRACT personnel assigned to the TASK ORDER. In order to maintain the security requirements any derogatory information, to include law enforcement issues, mental health issues, or alcohol/drug related issues must be reported to the COR-TO and Local Security Officer for the work site location.

Government Computer Access Requirements. Contractor personnel requiring access to Government computers shall successfully complete, a National Agency Check with Inquiries (NACI) request, before obtaining access to a Government computer. These investigations shall be performed by the Government at no additional cost to the Contractor. All Contractor employees affected by this requirement must have completed an acceptable submission that complies with all directions for completion of the investigation request through the Government security office within 30 calendar days of TASK ORDER Award. To begin this process, all affected Contractor employees must complete within 15 calendar days after Notice of Award Standard Form 85P worksheet that can be downloaded from http://www.opm.gov/forms/pdf_fill/SF85P.pdf.

The affected employee will then be scheduled by the Government for two or more appointments to complete the security package. If at any point after submission of the security worksheet, disqualifying information is discovered or developed, the Government reserves the right to deny computer access to the respective Contractor employee. That individual will no longer be allowed to perform duties requiring computer access. After submission, review, and approval of the complete security package through the security office and completion of an adjudicated NACI, Contractor employees may obtain their ―Common Access Card (CAC) for the duration of the TASK ORDER, unless disqualifying information is subsequently discovered.

In this instance access will be revoked. The NACI adjudication process normally takes two (2) to five

(5) months after submission of the package. Contractor shall comply with AFFARS Clause 5352.242-9001 Common Access Cards (CACs) for Contractor Personnel which is hereby incorporated by reference if not otherwise included. The Contractor shall comply with DoD 5200.08R Physical Security Program, (Chapter 3, Section C.3) requirements.

Reporting Requirements. The Contractor shall comply with AFI 71-101, Volume 1, Criminal Investigations and Volume-2, Protective Service Matters and AFI 31-401 (Chapter 8). Contractor shall report to Security Forces any information or circumstances which may pose a threat to DoD or Contractor personnel, resources, or DoD information.

Freedom of Information. The Contractor shall not respond to any Freedom of Information Act (FOIA) request or release any information in response to a Freedom of Information request. Any request for information received by the Contractor under the Freedom of Information Act will be referred immediately to the Contracting Officer.

Physical Security. The Contractor shall comply with Force Protection Condition (FPCON) procedures, Random Antiterrorism Measures (RAMS) and local search/ identification requirements. The Contractor shall safeguard all Government property, including controlled forms, provided for Contractor use. At the close of each work period, Government training equipment, ground and aerospace vehicles, facilities, support equipment, and other valuable materials shall be secured.

Key Control. The Contractor shall safeguard all keys issued by the Government and ensure they are used only by authorized Contractor personnel. The Contractor shall not duplicate issued keys and shall report lost keys to the contracting officer immediately. The Contractor will be charged for lost keys, re-keying, and lock replacement as applicable.

Additional Security Requirements. NACI’s will be IAW Homeland Security Presidential Directive 12 (HSPD-12). If this TASK ORDER requires access to classified materials the Contractor shall comply with DoD 5200.1-R, AFI 31-401, AFI 33-201, Volume 1, and Volume 2 (COMSEC) , AFSSI 7700 (Emission Security), AFSSI 8502, (Organizational Computer Security), and AFPD 16-14, (Information Protection), and Operations Security (OPSEC) Instructions.

Unescorted Entry to Restricted/Controlled Areas. If the TASK ORDER requires unescorted entry to controlled or restricted areas, the Contractor shall comply with DoD 5200.2-R, Appendix 1, and AFI 31-501, Personnel Security Program Management (Paragraph 3.24). If the performance of this TASK ORDER requires unescorted entry to a restricted/ controlled area, personnel must have a favorably adjudicated NACI investigation. All Contractor employees affected by this requirement must have completed an acceptable submission that complies with all directions for completion, of the investigation request through the Government security office within 30 calendar days of TASK ORDER Award or Notice of Award. To begin this process, all affected Contractor employees must complete within 15 calendar days after TASK ORDER Award or Notice of Award Standard Form 85P worksheet that can be downloaded from http://www.opm.gov/forms/pdf_fill/SF85P.pdf. The Contractor shall notify the Quality Assurance Evaluator or Government Inspector when the worksheet is complete. The affected employee will then be scheduled by the Government for two or more appointments to complete the security package. If at any point after submission of the security worksheet, disqualifying information is discovered or developed, the Government reserves the right to deny entry to restricted/controlled areas. In this instance the Contracting Officer will notify the Contractor of the denial. That individual will not be allowed to perform duties requiring access to restricted/ controlled areas. Upon receipt of a favorable investigation results and authorization by the appropriate commander, the Contractor member will receive appropriate entry credentials for access to restricted/controlled areas, unless disqualifying information is subsequently discovered. In this instance access will be revoked. The NACI adjudication process normally takes two (2) to five (5) months after submission of the package.

Credentials Turn-In. Upon completion of performance, termination of the TASK ORDER or termination of performance on this TASK ORDER T by any individual for any reason, the Contractor shall turn in all CAC Cards, Base Identification Passes, Restricted Area Badges, and any other documents issued by the Government to the Issuing office, Quality Assurance Evaluator, or Project Manager.

Weapons, Firearms, and Ammunition. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their Contractor-owned vehicle or privately-owned vehicle while on a DoD facility.

Proprietary Information Assurance and Security

The Contractor shall comply with OMB Circular A-130, “Management of Federal Information Resources,” which requires Certification and Accreditation (C&A) of all Federal information systems every three (3) years at a minimum or as changes that require re-accreditation occur. This C&A requirement ensures the effective safeguarding of sensitive but unclassified (SBU) data against unauthorized modification, disclosure, destruction, and denial of service, as directed by DoD.

The Contractor shall protect all data in the strictest confidence; prevent the unauthorized duplication, use and disclosure of information that is subject to the Privacy Act of 1974, Health Insurance Portability and Accountability Act (HIPAA) IAW applicable statutory, regulations, local policies and procedures.

All technical data created as a result of this TASK ORDER shall be handled in accordance with DFARS 252.227-7013, DFARS 252.227-7015 and any other data rights clauses applicable to the TASK ORDER.

The Contractor is prohibited from appropriation, disclosure, or unauthorized use of proprietary information that is acquired in the execution of this TASK ORDER.

All products including files, software, and other information, which are created, produced or developed during the period of performance is the property of the Government and shall be returned unless the Government grants the Contractor permission to retain the materials and products for continued development or publication.

Information Assurance

General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. At a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow:

Health Insurance Portability and Accountability Act (HIPAA). The Contractor shall comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (P.L. 104-191) requirements, specifically the administrative simplification provisions of the law and the associated rules and regulations published by the Secretary, Health and Human Services (HHS). This includes the Standards for Electronic Transactions and the Standards for Privacy of Individually Identifiable Health Information. It is expected that the Contractor shall comply with all HIPAA-related rules and regulations as they are published and as HCE requirements are defined (including security standards, identifiers for providers, employers, health plans, and individuals, and standards for claims attachment transactions). Whenever TASK ORDERS are awarded that will collect, use or store Protected Health Information (PHI), the Contractor shall ensure that data from any DoD AIS which contains PHI is continuously protected from unauthorized access, use, modification, or disclosure.

The Contractor shall comply with DoD Directive 8500.1, Information Assurance, Privacy Act Program Requirements (DoD 5400.11), DoD Health Information Privacy Regulation (DoD 6025.18-R) and Personnel Security Program Requirements (5200.2- R).

Personnel Security and Information Assurance

The Contractor shall comply with DoD Directive 8500.1, Information Assurance, DoD Instruction 8500.2, Privacy Act Program Requirements (DoD 5400.11), DoD Health Information Privacy Regulation (DoD 6025.18-R) and Personnel Security Program Requirements (5200.2-R) if applicable.

Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

Immediately report to the appointed COR-TO if any Contractor employee filling a sensitive position receives an unfavorable National Agency Check (NAC) adjudication, or if information that would result in an unfavorable NAC becomes available. Notify the USAMRAA Contracting Office within five (5) working days if, at any time, a Contractor employee has privileges revoked to a DoD data or system data because of security concerns.

Immediately deny access to any automated information system (AIS) or network, to the Contractor employee if, at any time, the individual receives an unfavorable NAC adjudication, or if directed to do so by the appropriate government representative for security reasons.

Ensure that all Contractor personnel receive information assurance (AI) training before being granted access to DoD AISs or networks.

Electronic Security. Department of Defense Information Assurance Certification and Accreditation Process (DIACAP). The Contractor shall acquire, develop and maintain the DIACAP documentation to ensure both initial and continued DIACAP for all Contractor systems and networks with a physical or logical connection to a DIACAP certified network. The Contractor shall also put in place processes that provide and ensure an acceptable level of security protection for any Contractor Owned, Contractor Operated – includes outsourced IT services networks that process DoD-owned Sensitive Information (ISs) and DoD-controlled ISs. These requirements are further defined in DoD Instruction (DoDI) 8510.01, DIACAP dated 28 November 2007 (http://www.dtic.mil/whs/directives/corres/pdf/851001p.pdf).

Public Key Infrastructure and Encryption: N/A

Information Systems (IS)/Networks Physical Security. The Contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, and to otherwise protect the confidentiality and ensure use conforms with DoD regulations.