Attachment 05 Standard Security Measures.pdf

CONTROLLED UNCLASSIFIED INFORMATION

ATP 10-245 November 2021

(U) APPENDIX 1 TO ANNEX E TO AAFB ANTITERRORISM PLAN

(U) STANDARD SECURITY MEASURES

1. (U) Contracts or other requirements documents will contain the following standardized security measures. The contractor shall be required to comply with all security directives and other security requirements identified in the respective contracts. These requirements apply to all contractors on Arnold AFB in the performance of their contracts.

1.1 (U) Department of Defense (DoD) Credentials: The contractor shall ensure base access and circulation control credentials required for contract performance are obtained for all employees. The contractor shall retrieve all identification media upon completion or termination of the contract and from employees who depart for any reason before the contract expires, e.g., the employee quits, is terminated, retires, etc.

1.1.1. The contactor shall immediately notify the issuing office for an appropriate update in the information system of record when a contractor employee refuses to return issued access media. If a local access credential is not returned, the Installation Commander may consider debarring the individual. All contractor personnel must immediately report a lost or stolen access credential to the local issuing office so the card can be updated as lost/stolen in the system of record.

1.2. (U) The contractor shall comply with all installation access requirements as directed in DoDM-5200.08_Volume 3_AFMAN 31-101_Volume 3, Installation Perimeter Access Control, as supplemented, and AAFB 31-101, Integrated Defense Plan. The Arnold Engineering Development Complex Commander (AEDC/CC) reserves the right to refuse entry and/or re-entry of any person to Arnold AFB for just cause to protect personnel, facilities, and property under his/her control when such actions are deemed necessary.

1.2.1. (U) All persons performing on the contract will be required to provide documents to positively prove their identity prior to being vetting for base entry. Identification must be compliant with the REAL ID Act of 2005. Individuals who do not possess a driver’s license or identification card compliant with the REAL ID Act and do not possess an acceptable alternate identification credential, must be escorted or denied access.

1.3. (U) Freedom of Information Act (FOIA): The contractor shall comply with Freedom of Information Act (FOIA) requirements in accordance with (IAW) DoDM 5400.07, DoD Freedom of Information Act (FOIA) Program. Requests for information received by the contractor and covered by FOIA shall be forwarded to the AEDC FOIA office for processing.

1.4. (CUI) Controlled Unclassified Information (CUI) shall be safeguarded as specified in DoDI 5200.48: Controlled Unclassified Information (CUI). This may include information with legacy For Official Use Only (FOUO) markings, previously protected under DoDM 5200.01-V4, DoD Information Security Program: Controlled Unclassified Information.

Sensitive information is information that if lost, misused, compromised or accessed by unauthorized personnel could adversely affect U.S. national interest, the conduct of DoD

ATP 10-245 November 2021 programs, or the privacy of DoD personnel. It comes in many forms; personal data under the Privacy Act, personnel records, privileged data (chaplain and judge advocate records), investigative data, scientific and technical information (STINFO), export controlled data (critical technologies), proprietary data, or other CUI data. For general CUI guidance, contact AEDC/ IP at (931) 454-3290.

1.4.1. (U) If access to CUI / Export Control / STINFO information is required, the contractor shall be required to be registered as a certified Government contractor through the Joint Certification Office, Defense Logistics Information Service (DLIS). To request DLIS Certification, submit a DD Form 2345, Militarily Critical Technical Data Agreement, to the DLIS, Battle Creek, MI address indicated at the top of the DD Form 2345 along with a copy of the company's state business license, incorporation certificate, sales tax identification form, or other documentation, which verifies the legitimacy of the company. A copy of the contractor’s DD2345, Militarily Critical Technical Data Agreement, must be provided when issued. Except as allowed by DFARS 252.225-7048, Export-Controlled Items, foreign nationals shall not have access to export controlled information without an export license. All export control laws as stipulated in both Export Administration Regulation and International Traffic in Arms Regulation must be followed without exception. For guidance in applying appropriate export control markings, contact AEDC/XPT at (931) 454-5681.

1.4.2. (U) The contractor must obtain Foreign Disclosure Office (FDO) approval through the Contracting Officer prior to allowing any non-US or un-validated US Lawful Permanent Resident person’s access to CUI or export-controlled information. (Also, see

DFARS 252.225-7048).

1.5. (U) Reporting Requirements: Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware that may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information. Contractor employees shall be briefed of this requirement by their immediate supervisor upon initial on-base assignment.

1.6. (U) Physical Security: The contractor shall be responsible for safeguarding all Government property and controlled forms provided for contractor use. All Government facilities, equipment, and materials shall be secured when unoccupied or not in use.

1.7. (U) Computer Security (COMPUSEC)/Automated Information System Requirements: If access to unclassified computer systems is required, the following requirements apply: Users must be a US citizen or receive AEDC or Air Force Materiel Command (AFMC) FDO approval prior to access being granted; requestor must have a favorable National Agency Check with Inquiries (NACI) clearance or an approved Interim Automated Information Systems (AIS) request on file; and requestor must complete the Air Force (AF) Information Assurance (IA) Training. To request access to an unclassified computer system, users must complete a DD2875, System Authorization Access Request. Users bringing portable electronic devices (PEDs) on base and wanting to connect to AEDC computer systems / networks shall comply with AFPD 17-1, Cyberspace, and AFI 17-130 Cybersecurity Program Management, and CJCSI 6510.01, Information Assurance and Support to Computer

ATP 10-245 November 2021

Network Defense. Employees shall complete any additional computer security training requirements mandated by the host base. (e.g. Cyber Awareness Challenge)

1.8. (U) Information Security (INFOSEC): Information, regardless of media, shall be controlled and maintained IAW the National Industrial Security Program Operating Manual (NISPOM) and guidance provided by the Servicing Security Activity (SSA), AEDC/IP.

1.9. (U) Privacy Act: Comply with AFI 33-332, Privacy Act Program, when collecting and maintaining information protected by the Privacy Act of 1974, Title 5, U.S.C., Section 552a.

Remove or destroy official records only IAW AF Records Information Management System, (AFRIMS) located on the internet at:

https://www.my.af.mil/gcssaf61a/afrims/afrims/rds/rds_series.cfm.

1.10. (U) Operations Security (OPSEC): Comply with AFPD 10-7, Information Operations;

AFI 10-701, Operations Security; DoDM 5220.22, Volume 2, National Industrial Security Program: Industrial Security Procedures for Government Activities, Section 13; and local plans and publications.

1.11. (U) Antiterrorism (AT) Training: DoD contractors shall be provided AT information as required by DFARS Clause 252.225-7043, Antiterrorism / Force Protection for Defense Contractors Outside the United States. Level 1 AT Awareness Training shall be provided to all DoD contractor employees.

1.12. (U) Contractor Consent to Background Checks: The contractor shall not employ persons to perform under this contract if such employee is deemed or identified as a potential threat to the health, safety, security, general well-being, or operational mission of the installation and its population; nor shall the contractor or subcontractor employ persons under this contract who have an outstanding criminal warrant as determined through official Government records systems. Checks will be accomplished to verify if a person is wanted by local, state, or federal agencies. All contractor and subcontractor personnel must consent to background checks. Contractor and subcontractor personnel who do not consent to a check will be denied access to the installation. Information required to conduct a check includes:

full name, driver’s license number, and/or social security number, date of birth of the person entering the installation, and completion of a background check questionnaire. The contractor must have this information ready to provide to the Visitor Control Center, if requested.

1.12.1. (U) Contractors must ensure their employees and those of their subcontracts have the proper credentials allowing them to work in the U.S. Persons without proper credentials will be remanded to the appropriate authorities.

1.12.2. (U) The contractor shall not be entitled to any compensation for delays or expenses associated with complying with the provisions of this measure. Furthermore, nothing in this measure shall excuse the contractor from proceeding with the contract as required.

1082390649C Highlight

ATP 10-245 November 2021

1.13. (U) Access to Installation During Force Protection Conditions (FPCONs): Gaining access to the installation during FPCONs will be done IAW the requirements outlined in the local Antiterrorism / Integrated Defense Plan(s). Access may be eliminated or strictly controlled as the FPCON increases.

1.14. (U) Property Protection: Property protection for the facility where the contractor's primary work center is located will be the responsibility of the local facility manager and local security manager, or their duly authorized representative IAW AFI 31-101, Integrated Defense, and command / local directives to include AAFB Plan 31-101. The contractor must safeguard all Government-owned equipment and materials in its possession or use.

2. (U) Changes to these measures must be coordinated with AEDC/IP, AEDC/TSD-SF, and/or AEDC/XPT, as appropriate.