ACT DD 254 Continuation Page.DOCX

DD Form 254 – Item 13 Continuation Sheet Contract Number: W900KK-21-R-0049

ITEM 13 SECURITY GUIDANCE:

The following items apply to this contract.

GENERAL GUIDANCE:

1. The contractor and subcontractor(s) shall comply with the Security Agreement (DD Form 441) and following Security Regulations (DoDM 5200.01 Volumes 1 thru 4), DoD Information Security Program, (DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM), AR 25-2 Information Assurance, AR 380-5 Information Security, AR 380-49 Industrial Security, AR 380-10 current versions and affiliated regulations.

2. The contractor and subcontractor employees requiring access to DoD government or DoD contractor's facilities where proof of a security clearance is required, shall meet the security access requirements specified by the host and/or owner of those facilities.

3. The Prime contractor and subcontractor companies that are Foreign company and or USA Foreign Owned, Controlled or Influenced (FOCI) will not be allowed access to Classified or Controlled Unclassified Information (CUI) which includes International Trafficking in Arms Regulations (ITAR) or the Export Administration Regulations (EAR) defense articles. The Foreign company and or USA FOCI company must meet the mitigation requirements of DoD 5220.22M w/change 2 National Industrial Security Program Operating Manual (NISPOM) and AR 380-49 Chapter 2 Section I and II, see reference Item 11M below.

4. The contractor is not authorized to disclose or release collateral Classified Military Information (CMI) information to the public. Disclosure or release is not authorized to other DoD organizations or agencies without review and written approval from the Requiring Activity KO, COR, Cognizant Security Office.

a. The contractor is not authorized to disclose or release Controlled Unclassified Information (CUI) Technical Data and Critical Program Information (CPI) pertaining to this contract to the public without prior review and approval from the government Public Affairs Officer, Contracting Officer Representative (COR), and Requiring Activity Cognizant Security Office. Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 12.

b. The contractor is not authorized to disclose or release any program Classified Military Information (CMI) Controlled Unclassified Information (CUI) Technical Data or Critical Program Information (CPI) Export Controlled Information pertaining to this contract to any Foreign Nationals or Foreign Representatives without prior review and approval from the government Contracting Officer (KO), Contracting Officers Representative (COR) and Requiring Activity Cognizant Security Office, Foreign Disclosure Officer (FDO). Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 16.

5. The Contractor shall only issue security clearances to employees requiring access to classified information with a Need-to-Know.

a. For collateral security clearances and access the contractor shall follow the Security guidelines established in DoD 5220.22M and the Defense Security Services (DSS) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php

b. Contractors who do not require a security clearance but require a government Common Access Card (CAC) must have a Tier 2S security investigation and follow the credentialing requirements of this contract!

6. The contractor and subcontractors shall ensure that all Classified information, Controlled Unclassified Information (CUI), Controlled Technical Information (CTI) documents, data and or export controlled information; is marked, handled and safeguarded with the appropriate security classification, distribution statement(s) and export control warning statement in accordance with DoDD 5230.24, DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM and DoDM 5200.01 Vol 1, 2, 3 and 4.

7. The Prime contractor is responsible for issuing all subcontractor DD Form 254 for any classified work or material that the subcontractor will have access to during this contract per chapter 7 of current version of DoD 5220.22M and AR 380-49.

a. The prime contractor FSO will sign DD Form 254, block 17h (NEW DD254, 16 OLD DD254) and ensure that program, and/or Army activity points of contact information are included on DD Form 254, block 13.

b. The prime contractor FSO will provide the KO and/or COR with a copy of all subcontract DD Form 254s to be attached to the prime contract. The KO and/or COR will provide a copy of all subcontract DD Form 254s to the ISS and DSS.

8. No security classification guide exists which is directly applicable to this effort. If, during this effort, it becomes necessary to create a Security Classification Reference (SCR) the contractor shall notify the contract officer representative who will seek the assistance and appropriate guidance from the local government ISSM, PM and Requiring Activity Cognizant Security Office.

9. Contractors who work in a DoD or Contractor cleared facility on DA installations and or government leased facilities and who are embedded or integrated within a DA program or activity, shall report all adverse information, suspicious contacts, and other reportable incidents to the local security office.

10. The contractor and their subcontractors shall immediately report any loss, compromise, suspected compromise of classified information or any security violations which occur on this contract per DoD 5220.22–M with current changes, to their Facility Security Manager (FSO) and local DSS office. The contractor shall also inform the KO, COR, and the ISS.

11. The contractor shall ensure that all contract employees with security clearances meet the prescribed security training required by chapter 3 of DoD 5220.22M, paragraph 1-14 of AR 381-12 and the Defense Security Services (DSS) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php. New contractor personnel assigned duties related to the contractor shall receive training within 30 days on their assignment.

12. The contractor and their subcontractors will designate in writing a U.S. citizen as the Insider Threat program official per paragraph 1-202 of DoD 5220.22M w/change 2. All contractors with security clearances shall comply with Insider Threat Training requirements per paragraph 3-103 of DoD 5220.22M w/change 2. Additionally the contractor shall report threat-related incidents, behavioral indicators to the Requiring Activity Cognizant Security Office. Insider Threat training information can be found at the following DSS site https://www.cdse.edu/

13. The contractor and subcontractors shall ensure that all contract employees with security clearances meet the prescribed security training required by chapter 3 of DoD 5220.22M, paragraph 1-14. New contractor personnel assigned duties related to the contractor shall receive training within 30 days on their assignment.

ITEM 10:

Ref Item 10.j: CONTROLLED UNCLASSIFIED INFORMATION (CUI) - For Controlled Unclassified Information (CUI) which includes Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoD 5200.01-V04.

ITEM 11:

Ref Item 11.a: HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY - The contractor performance is restricted to the government activity listed below. Government agency or activity will provide security classification guidance for performance of this contract. Submit visit request to the KO and/or Security Management Office for need-to-know verification.

Fort Sill, OK Fort Lee, VA Fort Leonard Wood, MO Fort Bliss, TX Fort Bragg, NC Vilseck, GE Camp Casey, ROK

Ref Item 11.j: OPERATIONS SECURITY (OPSEC) REQUIREMENTS - The contractor shall develop, implement, and maintain a facility level OPSEC program to protect classified and/or sensitive unclassified information used at the contractor, government and other contractor facilities during the performance of this contract. The OPSEC requirements may be included in the Contractor’s Standard Practice Procedures (SPP) or Technology Control Plan (TCP), whichever is more applicable.

Ref Item 11.l: RECEIVE, STORE OR GENERATE CONTROLLED UNCLASSIFIED INFORMATION (CUI) – The contractor and all subcontractors personnel must protect CUI material and information in accordance with DoDM 5200.01 vol 4.

Ref Item 11.M: OTHER - Only U.S. Citizens are authorized to work on this contract.