Att 1_Vendor_Contractor Vetting Process.pdf

Distribution A – Authorized for Public Release

v. 20190624

PEO STRI

Vendor/Contractor Vetting Process for

Release of Protected Information

Agreements/contracts with PEO STRI may require a selected vendor/contractor to receive, produce and protect a wide variety of sensitive or classified documentation.

The different documentation associated with a particular agreement/contract may include material identified as Unclassified//For Official Use Only (FOUO), Top Secret (TS)/Sensitive Compartment Information (SCI), or any level in between the two categories.

In accordance with the Department of Defense (DoD) and Army Regulations (AR), all potential Government vendors/contractors must be vetted for eligibility and FOCI status to receive, produce and protect the documentation associated with a particular agreement/contract.

Purpose. The purpose of this document is to provide a summary of the different vetting processes that will be used to evaluate each vendor/contractor depending upon the category of documentation associated with the underlying effort.1 The following information is provided as a guide only.

STEP 1: Unclassified/FOUO

If an agreement/contract is anticipated to require an awardee to have access to Unclassified/FOUO Export Control information, at a minimum, the following will be required:

A. All vendors/contractors must be registered in the System for Award Management

(SAM).

B. All vendors/contractors (Primes and Subcontractors) must have a reputation for integrity and lawful conduct in its business dealings. The vendor and its Key Management Personnel (KMP) must not be barred from participation in Government contracts. Information related to previous contracts or government work may also be required.

1 This information is provided as a guide only and seeks to highlight key processes from applicable regulations. If there is any discrepancy between this document and applicable regulations, the regulations govern.

C. All Vendors/contractors requiring access to technical data packages that include information identified as “Unclassified//FOUO” must make the following certifications:

1) Vendor/contractor and/or subcontractor(s) are not Foreign Owned or USA Foreign Owned, Controlled or Influenced (USA FOCI) status.

2) Vendor/contractor is not in the process of a merger or other type of transition/ownership discussions with a Foreign Owned company or USA FOCI company.

The certification from each vendor/contractor should be provided on company letterhead and include the following:

a) Full company name;

b) Cage code; and

c) Country of Origin.

If a vendor/contractor cannot make the certifications, then the vendor may still compete for award of the agreement/contract by:

1) Registering with the U.S. State Department and providing a copy of the registration along with the appropriate Department of State Permanent Export License (DSP) or Technical Assistance Agreement (TAA) documents to the Agreements/Contracts Officer. Visit or contact the U.S. State Department at http://www.pmddtc.state.gov/ for more information on satisfying this requirement.

Although timelines will vary, this process takes 45-75 days to complete.

2) Canadian vendors/contractors must provide to the Agreement/Contracts

Officer, a copy of their DD2345 Military Critical Technical Data Agreement form signed by the United States/Canada Joint Certification Office in order to receive unclassified TDPs.

Failure or inability to satisfy the requirements of Step 1 will make a vendor ineligible to receive Unclassified//FOUO Export Control data / information.

STEP 2: Classified Information

If an agreement/contract is anticipated to require an awardee to have access to Classified information, at a minimum, the following will be required:

A. All Vendors/contractors must satisfy the requirements as described in Step 1 above.

B. All Vendors/contractors (Primes and Subcontractors) must be listed in the Defense Security Services (DSS) National Industrial Security System (NISS) which must reflect:

1. Valid Facility Clearance (FCL)

2. If a Foreign or USA FOCI Vendor, then a completed Special Security Agreement (SSA) approved by DSS is required before access to Special Access Program (SAP) or Communications Security (COMSEC) materials will be authorized.

C. If a Vendor/contractor does not have a FCL, the Vendor may apply for one.

Generally, the FCL application process will require:

1. An awarded Agreement/Contract and sponsorship by the Requiring Activity

(RA);

2. Coordination with the RA and contact with the DSS office to begin the clearance process. For more information, visit:

https://search.usa.gov/search?affiliate=dod_dss&query=SPONSORSHIP

3. Foreign or USA FOCI vendors will also be required to coordinate with DSS to mitigate any security concerns. For more information on this, visit:

https://search.usa.gov/search?affiliate=dod_dss&query=FOCI%20Mitigation

Although timelines will vary, the process for obtaining an FCL can take 45-60 days for Non-FOCI vendor/contractors and 12-17 months for FOCI vendor/contractors to complete. The vendor cannot charge the Government or RA for costs related to vendor/contractor vetting, sponsorship or Foreign or USA FOCI mitigation by DSS.

Point of Contact: For questions about the vetting process as it relates to issues associated with PEO STRI, those questions should be directed to PEO STRI, G2, Industrial Security Specialist at (407) 384-3540 or Stanley.M.Slupski.civ@mail.mil.

https://search.usa.gov/search?affiliate=dod_dss&query=SPONSORSHIP