Attachment 0012 AT OPSEC Form 255.pdf

CCDC ARMAMENTS CENTER

CONTRACT SECURITY REVIEW COVER SHEET

FCDDAC FORM 255 2016

Section I.

1. Purpose of Combat Capabilities Development Command (CCDC) Armament Center Form 255 Review: To document the review of the requirements package to include Performance Work Statement (PWS)/ Statement of Work (SOW), Quality Assurance Surveillance Plan (QASP) Post Award, and any applicable source selection evaluation criteria related to security areas.

2. Army policy requirement: Inclusion of this signed security review cover sheet is required in all requirements packages that fall within scope (see 3 below). A completed copy of this form will be maintained by the requiring activity and with the contracting requirements package. The Contracting Officer (KO) shall not solicit until the completed CCDC Armaments Center Form 255 has been received from the CCDC Armaments Center Security Contract Review Board (CRB) and specified language is accordingly incorporated, or the KO shall document the contract file that the CCDC Armaments Center Form 255 is not applicable to the procurement action.

3. Scope:

a. A review is required if the SOW/PWS is for either a traditional contract (Federal Acquisition Regulation (FAR)/Defense

Federal Acquisition Supplement (DFARS) based), Other Transaction Agreement (OTA), Small Business Innovative Research (SBIR), Small Business Technology Transfer (STTR), or Cooperative Research and Development Agreement (CRADA) that:

(1) Either:

(a) Has an CCDC Armaments Center employee as either Contract Officer Representative (COR), Agreement Officer Representative (AOR), or Principal Investigator (PI), or

(b) Has funding provided by CCDC Armaments Center, or

(c) is a project, initiative or task under an CCDC Armaments Center managed transaction (FAR/DFARS, OTA, SBIR, STTR, CRADA),

(2) And contains requirements such as:

(a) Any contract that involves transfer or electronic transmission of sensitive government information, Controlled Unclassified Information (CUI) or Classified information.

(b) Contracts that require contractor access to government IT systems, and equipment.

(c) Contracts that require contractor personnel to access Department of Defense DoD controlled installation(s).

(d) Contracts that require Foreign National / Third Country National support in performance of the contract.

(e) Contracts requiring Communications Security (COMSEC).

(f) Contracts that require issuance of Common Access Card (CAC).

(g) Contracts involving storage or shipment of Hazardous Materials (HAZMAT) or Arms, Ammunition and explosives

(AA&E).

b. A review is not required if the PWS/SOW meets any of the following criteria or examples unless it also meets the requirements in 3.a.(2):

(1) Supply contracts under the Simplified Acquisition Threshold ($150,000) and where it is clear that security measures are not factors in contract delivery (e.g., commercial delivery), that do not require access to sensitive government information, IT processes, network, equipment or materials, or government hardware (e.g. computer, blackberry, phone, etc.).

(2) Field ordering officer actions.

(3) Purchases utilizing the Government Purchase Card.

I a. Review Exemption Signature (AT/OPSEC): I have reviewed the requirements of the contract and scope of work/performance work statement and determined there are no AT/IA/INFOSEC/OPSEC or security related concerns.

No additional signatures are required.

Exemption Signature (AT/OPSEC): ______________________________________________________________

UNCLASSIFIED//FOR OFFICIAL USE ONLY (WHEN COMPLETED)

Effort Title:

FCDDAC FORM 255, 23 Aug 2016

FCDDAC Form 255, 23 Aug 2016 2

Section II. If the proposed contract is expected to involve the actions or access to complete the contract check a “YES”. If this type of action or access is not required to fulfill the contractor requirements check “NO.”

In order to perform this effort:

YES NO

9 (IA) Does the contract require use of government hardware (e.g. computer, mobile device, phone, CAC, etc.)?

YES NO

11 (OPSEC) Does the contract require contractor place of performance at an CCDC Armaments Center facility?

YES NO 3 (OPSEC) Does the contract require contractor to perform at their contractor facility?

YES NO

14 (AT) Does the contract require employees to travel or work outside the continental United States?

YES NO

15 (AT/OPSEC) Does the contract require employees to accompany deployed U.S. Armed Forces?

YES NO

13 (AT) Does the contract involve storing or shipment of Hazardous Materials (HAZMAT) (per FED-STD-313)? YES NO

YES NO

1 (ITPO) Will the contract require classified work to be performed?

YES NO

2 (ITPO/IA) Does the contract require contractor handling/access of classified networking and/or information (systems classified PCs, servers, switches etc.)?

YES NO 7 (IA) Does the contract require issuance of CAC for government network access? (email, data servers) YES NO 8 (IA) Does the contract require elevated/privileged access to government information systems such as a System administrator or Network administrator?

YES NO

6 (IA) Does the contract require the electronic transmission of sensitive information outside of a government networked system? (drawings, tech manuals, TDPs, PII)

YES NO

4 (OPSEC) Is the government information being provided to the contractor sensitive in nature (but still unclassified) that you would NOT want it publicly released or provided to an adversary or competitor? (i.e. Test data, algorithms, formulations, capability/limitations, specifications, etc.)

12 (AT) Does the contract involve storing or shipment of weapons, ammunition (per Gun Control Act of 1968 as amended), YES NO

5 (OPSEC) Are the contractors operations (job functions) to be conducted sensitive in nature (but still unclassified) that you would NOT want it publically released or provided to an adversary or competitor? (i.e. emerging technologies, tactics, techniques, procedures, etc.)

YES NO

II a. Action required by COR, AOR, or PI: Prior to release to acquisition the following actions must be completed:

10 (AT) Does the contract require access (including visits) to a Department of Defense (DoD) facility or installation?

or energetic material (per AR 190-13)?

FCDDAC Form 255, 23 Aug 2016 3

Section III

III a. Antiterrorism Officer

AT level I training (general) YES NO 1

AT awareness training for contractor personnel traveling OCONUS YES NO 2

Access and general protection policy and procedures YES NO 3,6 iWATCH (See Something, Say Something) training YES NO 4

Contractors requiring CAC YES NO 5

Contractor Authorized to Accompany the Force clause YES NO 7

Contract requiring performance or delivery in a foreign country YES NO 8

Contracts involving HAZMAT YES NO 9

Contracts involving AA or E with SRC I‐V or Cat‐U YES NO 10

Contracts involving AA or E applicable to Domestic Violence Amendment to the Gun Control Act of 1968 YES NO 10a

TARP for all contractors with security clearances YES NO 11

III b. Information Assurance Manager (IAM)

Employees Who Require Access to Government Information Systems YES NO 12

IA/Information Technology (IT) Training YES NO 13

IA/Information Technology (IT) certification YES NO 14

Government Furnished Items YES NO 15

Information Management Army Information Technology /IA YES NO 16

Information Assurance Signature: _________________________________________________

III c. OPSEC Officer

Contract requires access or handling of CUI information YES NO 23-28 Contract requires Contractor development of an OPSEC Plan YES NO 20,23 Contract requires access to / compliance with CCDC Armaments Center OPSEC Plan YES NO 21,23 Contract requires OPSEC Training YES NO 22,23

Operations Security (OPSEC) Signature: ________________________________________________

III d. Intelligence & Technology Protection Office (ITPO)

Contracts That Require Handling or Access to Classified Information YES NO 11,17

Export Control Laws/International Traffic in Arms Regulation (Mandatory inclusion) YES NO 18

Contracts that require access to potential Critical Program Information (PCPI)/ Critical Program Information (CPI)

YES NO 19,24-28

ITPO Representative Signature: _________________________________________________

Antiterrorism Signature: ________________________________________________

FCDDAC Form 255, 23 Aug 2016 4

Section IV. Standard Contract Provision and Clause Text Applicability and/or additional PWS Language.

1. AT Level I Training. Requires the addition of: “All contractor employees, including subcontractor employees, requiring access to

Department of Defense installations, facilities, or controlled access areas shall complete AT Level I awareness training within 45 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies and within 12 months prior to travel outside of the US, then annually thereafter. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR (or to the contracting officer, if a COR is not assigned) within 14 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at http://jkodirect.jten.mil/ ."

2. AT Awareness Training for Contractor Personnel Traveling Overseas. Requires the addition of: “This standard language requires U.S.-based contractor employees and associated subcontractor employees to make available and to receive Government-provided area of responsibility (AOR)–specific AT awareness training within 3 months prior to OCONUS travel as directed by AR 525-13.

Government provided awareness training specific to an AOR traveled is provided to contract personnel upon request by contacting the CCDC Armaments Center AT Officer at usarmy.pica.ccdc-ac.mbx.pica-ardec-at-training@mail.mil or 973-724-3005.”

3. Access and General Protection/Security Policy and Procedures. Requires the addition of: “All contractor employees, including subcontractor employees, shall comply with all installation and facility access and local security policies and procedures (provided by the Government representative), and security/emergency management exercises. The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services, or Security Office. Contractor workforce must comply with all personal identity verification requirements (CFR clause 52.204-9, Personal Identity Verification of Contract Personnel) as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes. During FPCONs Charlie and Delta, services/installation access may be discontinued/ postponed due to higher threat. Services will resume when FPCON level and or threat is reduced to an acceptable level as determined by the Installation Commander. Contractor personnel working on an installation are required to participate in the Installation Random Antiterrorism Measures Program as directed. Contractors may be subject to and must comply with vehicle searches, wearing of ID badges, etc. Failure to comply with policies and procedures could result in barred access onto the installation.”

4. iWATCH (See Something, Say Something) Training. Requires the addition of: “All contractor employees, including subcontractor employees, shall receive training and participate in the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 45 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies, and then annually thereafter. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR (or to the contracting officer, if a COR is not assigned) within 14 calendar days after completion of training by all employees and subcontractor personnel.” Slides available to COR at https://www.milsuite.mil/book/docs/DOC-284984

For contractors requiring CAC. Requires the addition of: “Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled National Awareness Check With Inquiries (NACI) at the Office of Personnel Management.”

For contractors that do not require CAC, but require access to a DoD facility or installation. Requires the addition of:

“Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive 2014-05/AR 190-13); applicable installation, facility and area commander installation and facility access and local security policies and procedures (provided by Government representative); or, at OCONUS locations, in accordance with status-of-forces agreements and other theater regulations.”

For Contractors Authorized to Accompany the Force. Requires the addition of: “DFARS Clause 252.225-7040, Contractor personnel supporting Armed Forces deployed outside the US applies to this contract.” Required compliance with laws and regulations, pre-deployment requirements, Combatant Command (COCOM) training, and personnel data.

5.

6.

7.

http://jkodirect.jten.mil/ http://www.acq.osd.mil/dpap/dars/dfars/html/current/252225.htm#252.225-7040

FCDDAC FORM 255, 06Aug 2016

FCDDAC Form 255, 23 Aug 2016 5

9. For contracts involving Hazardous Material. Requires the addition of: “FAR Clause 52.223-3, Hazardous Material Identification and Material Safety Data applies to this contract.”

10. For contracts involving SRC I-IV or CAT-U AA or E. Requires the addition of: “DFARS Clause 252.223-7007, Safeguarding Sensitive Conventional Arms, Ammunition, and Explosives applies to this effort.”

10.a For contracts involving AA or E applicable to Domestic Violence Amendment to the Gun Control Act of 1968. Requires the addition of: “Contractor must ensure compliance with the Domestic Violence Amendment to the Gun Control Act of 1968 Nothing in this clause shall relieve the Contractor of its responsibility for complying with other applicable Federal, state, and local laws, ordinances, codes, and regulations (including requirements for obtaining licenses and permits) in connection with the performance of this contract.”

11. Threat Awareness Reporting Program. Requires the addition of: “Per AR 381-12, Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a counterintelligence (CI) agent or other trainer as specified in 2-4b. This training shall be completed within 12 months after contract start date or effective date of incorporation of this requirement into the contract, whichever applies, and then annually thereafter. The contractor shall submit documentation of completion for each affected contractor employee and subcontractor employee to the COR (or to the contracting officer, if a COR is not assigned) within 14 calendar days after completion of training by all employees and subcontractor personnel.”

Training can be executed by a local CI agent, online via the Army Learning Management System at https://www.lms.army.mil (and search for TARP), or by contacting the 308th Military Intelligence Battalion at usarmy.pica.902-mi-grp.list.308th-picatinny-fo@mail.mil and 973-724-5446.

INFORMATION ASSURANCE OFFICER CONSIDERATIONS:

12. Employees Who Require Access to Government Information Systems. Requires the addition of: “All contractor employees, including subcontractor employees, with access to a government information system must be registered in the Army

Training Certification Tracking System (ATCTS) at commencement of services and must successfully complete the DoD Cyber Awareness training prior to access to the information system and then annually thereafter.”

13. IA/Information Technology (IT) Training. Requires the addition of: “All contractor employees, including subcontractor employees, employees must complete the DoD Cyber awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, and AR 25-2 within six months of employment.”

14.

15. Government Furnished Items. Requires the addition of: "All contractor employees, including subcontractor employees, will return all issued U.S. Government owned equipment which includes travel laptops, mobile devices, Common Access Cards, installation badges, and/or access passes to the COR when the contract is completed or when a contractor employee no longer requires access to the installation or facility.”

16. Information Management Army Information Technology /IA. Requires the addition of: “The Contractor shall be capable of accessing, handling, receiving, and storing UNCLASSIFIED documents, equipment, hardware, and test items, using the applicable standards of FOUO information. Controlled Unclassified Information (documents designated as FOR OFFICIAL USE ONLY and/or LIMITED DISTRIBUTION) shall be submitted by a controlled means using USPS mail, Safe Access File Exchange (SAFE) website and/ or DoD Army approved encryption software as per AR 25-1.”

IA/Information Technology (IT) certification. Requires the addition of: “Per IA best business practices, DFARS 252.239-7001, Information Assurance Contractor Training and Certification and AR 25-2, All contractor employees, including subcontractor employees, supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.”

8. For Contract Requiring Performance in a Foreign Country. Requires the addition of: “DFARS Clause 252.225-7043, AT/Force Protection (FP) Policy for defense contractors outside of the US applies to this contract.” The key AT requirement is for contractor personnel to comply with theater clearance requirements and COCOM policies and directives.

http://www.acq.osd.mil/dpap/dars/dfars/html/current/252223.htm#252.223-7007 https://www.acquisition.gov/sites/default/files/current/far/html/FARTOCP52.html#wp372482 http://www.acq.osd.mil/dpap/dars/dfars/html/current/252239.htm#252.239-7001 https://www.lms.army.mil mailto:usarmy.pica.902-mi-grp.list.308th-picatinny-fo@mail.mil

FCDDAC Form 255, 23 Aug 2016 6

19. For contracts that require access to potential Critical Program Information (PCPI)/ Critical Program Information (CPI).

Requires the addition of: “All contractor employees, including subcontractor employees, shall comply with the applicable Interim Program Protection Plan (IPPP)/ Program Protection Plan (PPP)/ or Technology Protection Plan (TPP). The contractor shall comply with DOD, DA, and AMC technology protection requirements in DODI 5200.39, AR 70-1, DA PAM 70-3, and AMC- R-380-13.”

18. Export Control Laws/International Traffic in Arms Regulation. Requires the addition of: “DFARS Clause 252.225-7048, Export- Controlled Items applies to this effort. All documents determined to contain export controlled technical data will be marked with the following notice: WARNING: - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., App. 2401 et seq. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.”

INTELLIGENCE AND TECHNOLOGY PROTECTION OFFICE CONSIDERATIONS:

17. For Contracts That Require Handling or Access to Classified Information. Requires the addition of: “The contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with (1) the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M), and (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor.”

OPSEC CONSIDERATIONS:

20.

21.

For Contracts That Require Development of an OPSEC Standing Operating Procedure/Plan. Requires the addition of: “The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan, in accordance with DI-MGMT-80934C, within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. This SOP/Plan will specify the project’s critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator. The contractor will ensure that this individual becomes OPSEC Level II certified per AR 530-1. CCDC Armaments Center OPSEC POC e-mail: usarmy.pica.ccdc-ac.mbx.ardec-opsec@mail.mil .”

22.

For Contracts That Require a Government Provided OPSEC Standing Operating Procedure/Plan. Requires the addition of: “The contractor is subject to compliance with the CCDC Armaments Center Operations Security Plan, per AR 530-1 (or DoDM 5205.02- M),. This SOP/Plan will specify the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it.”

23.

For Contracts That Require OPSEC Training. Requires the addition of: “Per AR 530-1 (or DoDM 5205.02-M), new contractor employees, including subcontractor employees, must complete initial (Level I) OPSEC training within 30 calendar days of reporting for duty and must also complete annual OPSEC awareness training as provided by the appropriately designated OPSEC level II trained OPSEC Officer/Coordinator. The Contracting Officer Representative (COR) or Agreements Officer Representative (AOR) can request CCDC Armaments Center OPSEC training from CCDC Armaments Center OPSEC POC e-mail:

usarmy.pica.ccdc-ac.mbx.ardec-opsec@mail.mil.”

For Contracts that Involve the Public Release of Information. Requires the addition of: “Per AR 530-1 (or DoDM 5205.02-M), an OPSEC review is required prior to all public releases. All government information intended for public release by a contractor will undergo a government OPSEC review prior to release.”

Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). Requires the addition of: "System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews:

(a) Within thirty (30) days of contract award, unless otherwise notified by the Government, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the Contractor's facility. The SSP(s) shall describe how the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 security requirements are implemented as required by Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract, and identify all applicable Commercial and Government Entity Code codes affected. The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

(b) If the Government determines that the SSP(s) does not adequately describe how the NIST SP 800-171 security requirements are implemented, then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a Plan of Action and Milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

(c) Upon conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

(d) The Government may, in its sole discretion or in response to a cyber incident, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government may conduct reviews at any time upon thirty (30) days' notice to the Contractor."

Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). Requires the addition of: "Compliance to NIST

SP 800-171:

(a) The Contractor shall fully implement the Controlled Unclassified Information (CUI) Security Requirements (Requirements) in NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the Contracting Officer, or establish a SSP(s) and POAMs) that varies from NIST SP 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

(b) Notwithstanding the allowance for such variation, the Contractor shall identify in any SSP and POAM their plans to implement the following, at a minimum:

FCDDAC FORM 255, 23 Aug 2016

(1) Implement Requirement 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Requirement 3.1.5 (least privilege) and associated Requirements, and identify practices that the Contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Requirement 3.1.12 (monitoring and control remote access sessions)-Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods;

(4) Audit user privileges on at least an annual basis;

(5) Implement Requirement 3.13.11 (Federal Information Processing Standards (FIPS) 140-2 validated cryptology or implementation of National Security Agency- or NIST-approved algorithms (i.e., FIPS 140-2 Annex A: Advanced Encryption Standard (AES) Or Triple Data Encryption Standard (DES) or compensating controls as documented in a SSP and POAM));

(6) Implement Requirement 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which can be evaluated by the Government Program Manager for risk to the program;

(7) Implement Requirement 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program."

4. Army Counterintelligence (Cl) Outreach

The Contractor shall engage, whenever practicable, with Army Cl industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting Army programs and technologies; and make Contractor personnel available for threat briefings specific to foreign intelligence threats to Army programs and technologies.

5. Army Cl/Industry Monitoring

(a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Army Cl, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor, or vendor logs that show network activity, including any additional logs the Contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

(b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor will coordinate with Army Cl to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by the Army Cl, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an Army Cl network device shall be the subject of a separate agreement negotiated between Army Cl and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by Army Cl. Use of this alternative approach shall also be the subject of a separate agreement negotiated between Army Cl and the Contractor.

(c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

24.

25.

UNCLASSIFIED//FOR OFFICIAL USE ONLY (WHEN COMPLETED)

FCDDAC Form 255, 23 Aug 2016 7

Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). Requires the addition of: "Army Counterintelligence (CI) Outreach:

The Contractor shall engage, whenever practicable, with Army Cl industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting Army programs and technologies; and make Contractor personnel available for threat briefings specific to foreign intelligence threats to Army programs and technologies."

26.

Supervisor of COR/AOR or OTA Technical Manager Signature: I validate that all clauses required in Section IV of this form have been incorporated into the SOW/PWS.

Supervisor OTA Technical Manager

COR, AOR, or PI Signature: I have reviewed the requirements of the contract, identified the required access to sensitive, FOUO or classified information and AT and security issues, and I have incorporated the clauses identified in Section IV of this form into the PWS/SOW. I will ensure all identified clauses are monitored in the QASP.

Printed Name: _______________________________

Date: ___________________ Signature: ___________________________________________________

FCDDAC FORM 255, 23 Aug 2016

UNCLASSIFIED//FOR OFFICIAL USE ONLY (WHEN COMPLETED)

FCDDAC Form 255, 23 Aug 2016

Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). Requires the addition of: "Cyber Incident Response:

(a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period in DFARS clause 252.204-7012 ), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact. Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http:// www.acq.osd.mil/dpap/dars/pgi/docs/lnstructions_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

(b) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

27.

28.

Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). Requires the addition of: "Army CI/Industry Monitoring:

(a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Army Cl, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor, or vendor logs that show network activity, including any additional logs the Contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

(b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor will coordinate with Army Cl to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by the Army Cl, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an Army Cl network device shall be the subject of a separate agreement negotiated between Army Cl and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by Army Cl. Use of this alternative approach shall also be the subject of a separate agreement negotiated between Army Cl and the Contractor.

(c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

http://www.acq.osd.mil/dpap/dars/pgi/docs/lnstructions_for_Submitting_Media.docx

FCDDAC

FO

R M

, 23 Aug 2016

U N

C L

A S

S

IF

IE

D

//F O

R O

F F

IC

IA

L U

S E

O N

L Y

(W H

E N

C O

M P

L E

T E

D

FC

D

D

AC

F o rm

, 23 Aug 2016

Sectio n

V : Q

A

SP

Quality Assurance Surveillance Plan Antiterrorism/Operations/Security Elements

Specific PWS

Requirement

Method of Surveillance Frequency Performed by Whom? Requirement met? yes/no

AT Training iWATCH Training

Installation access & security policies/ procedures

Report from the contractor

45 days after contract award and annually thereafter

COR in coordination with the installation & organization operations office

No more than one incident per contractor per period of performance

TARP Training Report from the contractor

12 Months after contract award and annually thereafter

Received and tracked by COR

OPSEC Training Report from the contractor

30 days after contract award and annually thereafter

Received and tracked by COR

OPSEC Plan Submitted by the contractor

Within 90 calendar days of contract award

Received by the COR, evaluated by the supporting OPSEC Officer

Acceptable plan received within 90 days

Info Assurance Standard Clause

Within 30 calendar days of contract award

Received by the COR, evaluated by the supporting IA officer

100%

Incident reporting As received

Acceptable Quality Level

100%

100%Received and tracked by COR

100%

100%

Report from the contractor

45 days after contract award and annually thereafter

Received and tracked by COR

Submitted by the contractor

Within 30 days of contract award

Received by the COR, evaluated by the supporting Government Industrial Security Office

Acceptable Plan received within 30 Days

Cyber Procedures Received by the COR, evaluated by the DC3

No more than one incident per contractor per period of performance

Incident reporting Within 15 days of Incident

System Security Plan

Submitted by the contractor