Attachment 04 Draft F-35 JPO SAP Hardware Disposition Security Plan.docx

F-35 Reprogramming Laboratory Special Access Program (SAP) Vendor Security Requirements 5/11/2026

Vendors contracted to destroy classified equipment must adhere to stringent security protocols established by the Department of Defense (DoD) and the National Security Agency (NSA). The primary governing frameworks for these vendors are the National Industrial Security Program Operating Manual (NISPOM) / 32 CFR Part 117 and the NSA/CSS Policy Manual 9-12 Below is a breakdown of the core security requirements a vendor must meet:

1. Clearances and Personnel Security Facility Security Clearance (FCL): The vendor's destruction facility must hold an active FCL at or above the classification level of the materials they are contracted to destroy (e.g., Secret or Top Secret).

Personnel Security Clearance (PCL): Any vendor employee handling, transporting, or destroying the classified equipment must hold a valid PCL commensurate with the material's classification level Insider Threat Program: The vendor is required to implement and maintain an Insider Threat Program to detect, prevent, and mitigate potential risks posed by employees with authorized access to classified assets.

FOCI Mitigation: The vendor must be cleared of unmitigated Foreign Ownership, Control, or Influence (FOCI) to ensure foreign entities cannot access the classified information or equipment

2. Approved Destruction Methods & Equipment Vendors cannot use standard commercial shredders for classified material. They must exclusively use equipment that has been tested and approved by the NSA.

Evaluated Products List (EPL): All destruction equipment (shredders, disintegrators, degaussers) must be actively listed on the current NSA/CSS Evaluated Products List (EPL).

Hardware-Specific Protocols: Different types of equipment require distinct destruction methods:

Media/Equipment Type: Required NSA Destruction Protocol Magnetic Hard Disk Drives (HDD): Must be securely degaussed using an NSA EPL-approved degausser, followed by physical deformation (e.g., bent, punched, or crushed) so the platters cannot be spun or read.

Solid State Drives (SSD) & Flash: Must be disintegrated or shredded into specific microscopic particulate sizes using an NSA EPL-approved solid-state disintegrator.

Optical Media (CD/DVD): Must be ground, sanded, or shredded using an NSA EPL-approved optical destruction device.

Networking/Communications Gear: Must have all non-volatile memory and Controlled Cryptographic Items (CCI) removed and disintegrated; volatile memory must be properly purged.

3. Secure Handling and Chain of Custody Secure Transport: If the vendor transports the equipment off-site, they must use cleared personnel or DoD-approved secure commercial delivery methods. The material must be strictly tracked from the point of origin to the destruction facility.

Constant Surveillance: Classified material must remain under the continuous control and observation of cleared personnel or be stored in a GSA-approved security container or approved secure area until it is completely destroyed.

Auditability & Documentation: The vendor must operate under a specific Contract Security Classification Specification (DD Form 254).

After destruction: The vendor must provide a Certificate of Destruction that meticulously logs the serial numbers of the destroyed assets to prove compliance.

4. Physical Security Facility Intrusion and Access Controls: The vendor's facility must have approved physical security measures in place, such as closed restricted areas, Access Control Systems (ACS), and Intrusion Detection Systems (IDS) certified to standards like UL-2050.

Third-Party Certifications: While federal regulations dictate the legal baseline, government agencies often require vendors to hold additional industry certifications, such as NAID AAA Certification (National Association for Information Destruction), which mandates unannounced security audits and strict chain-of-custody tracking.

*The majority of equipment sanitization, preparation and shipping/transportation tasks will be accomplished by the US Government personal / F-35 Program. A complete list of equipment will be provided for proper vendor evaluation.

end