Attachment 1- IDIQ DD 254 Cont Sheets.pdf

Contract # _________________________ Solicitation # _______________________

NETCOM IMCS IV IDIQ

DD Form 254 (20190504) Block 13 - Continuation Sheet 1 of 11

3. Block 1a - All Contractors shall have a final facility clearance of Top Secret at time of IDIQ award. Prime contractors shall ensure all sub-contractors have the required level of facility clearance for the work to be performed.

4. Block 1b - There is no requirement of the Contractor to establish safeguarding capability for classified information at any contractor facility.

5. Blocks 8a and 8c - All access to classified information shall only be at Government work locations. There may be strictly unclassified work at a contractor office/facility.

6. Block 10a – There is no requirement for Contractor establishment of a Communications Security (COMSEC) account, however, some work performance will require access to classified COMSEC information, COMSEC key, and/or Controlled Cryptographic Items (CCI), at Government work locations only. There may be a requirement for a supporting Government COMSEC Account Manager (CAM) to hand-receipt COMSEC material to properly identified/trained Contractor personnel at specified Government work locations in order to perform the mission under the terms of the contract. Contractor access to classified COMSEC information requires U.S. citizenship, a final personnel security clearance at the requisite level, established need-to-know in accordance with this contract and installation task orders, and receipt of required briefings prior to being granted access to such information. All COMSEC information and CCI shall be controlled, protected, safeguarded, and accounted for in accordance with AR 380-40, TB 380-41, and other Army, DoD and National level policy, as directed by the Government requiring activity. Contractor personnel who require access to COMSEC information or CCI shall be familiar with what constitutes a reportable incident, shall be responsible for reporting any such incident to the responsible CAM and respective Contracting Officer’s Representative (COR), and shall also be familiar with the classification guidance for COMSEC information as reflected in AR 380-40, Appendix B.

6a. Block 10a - Contractor personnel shall be subject to the Department of the Army Cryptographic Access Program (DACAP) prior to being granted access to any Secret or Top Secret cryptographic information that meets the criteria established in AR 380-40, Chapter 7.

Enrollment in DACAP consists of receipt of a DACAP briefing administered by the supporting Government requiring activity security office, acknowledgement of possible non-lifestyle, counterintelligence scope polygraph examination administered in accordance with applicable directives and law, and execution of Part I, SD 572 (Cryptographic Access Certification and Termination Statement). When such access is no longer required, contractor personnel will be debriefed and shall execute Part II of the SD 572.

6b. Block 10a - The requirement for access to COMSEC, CCI and enrollment in the DACAP is site specific and will be reflected in installation task orders (DD Form 254/PWS). Access to COMSEC information requires a final facility clearance (see Block 13) and written approval of the Contracting Officer (KO) prior to sub-contracting any work effort that requires access to COMSEC information.

NETCOM IMCS IV IDIQ

DD Form 254 (20190504) Block 13 - Continuation Sheet 2 of 11

7. Block 10e(1) – Some contractor personnel may be required to work in areas where access to Top Secret/ Sensitive Compartmented Information (TS/SCI) is required or where TS/SCI is processed and access cannot be precluded. These personnel will require a final Top Secret security clearance based on a current Tier 5 Investigation (T5) or Tier 5-Periodic Reinvestigation (T5R) with ICD 704 eligibility and SCI indoctrination at the specified level. The requirement for access to TS/SCI is site specific and will be reflected in installation task orders (DD Form 254/SCI Addendum/PWS). Access to TS/SCI requires a final facility clearance (see Block 13), final personnel security clearance, and prior written approval of the KO is required before a subcontract involving access to Intelligence Information can be issued.

7a. Block 10e (1): Contractor personnel who are SCI indoctrinated shall report all close and continuous relationships with foreign nationals, report any unusual/suspicious contact with foreign nationals and all foreign travel (both official and personal) to the supporting Government Special Security Office (SSO). Such travel shall be reported at least 10 business days prior to actual departure date.

7b. Block 10e (2) – ICD 703, Protection of Classified National Intelligence, Including SCI, provides policy on control, access, and dissemination of intelligence information. This policy is available from the Government requiring activity. Written approval of the Contracting Officer is required prior to subcontracting any work effort that requires access to intelligence information.

8. Block 10g – Actual knowledge of, generation, or production of NATO information is not required for performance on this contract. However, in order to facilitate potential access to NATO classified information, DoD Manual 5200.01-V1 directs that all cleared Department of Defense (DoD) military, and civilian personnel briefed on their responsibilities for protecting U.S. classified information will be briefed simultaneously on the requirements for protecting NATO information. This requirement also applies to contractor personnel who will have access to classified information at Government requiring activity work locations. The Contractor Facility Security Officer (FSO) shall provide a NATO briefing to cleared contractor personnel performing work on this contract and shall maintain a written acknowledgement of the individual's receipt of the briefing along with statement of understanding of responsibilities for safeguarding NATO classified information. The Joint Personnel Adjudication System (JPAS) or successor system shall be used to annotate the date of the briefing. The Government will verify receipt of the NATO briefing prior to granting access to NATO classified information

9. Block 10j – Controlled Unclassified Information (CUI): For Official Use Only (FOUO) information or Personal Identifying Information (PII) received or generated under this contract or site specific task orders shall be controlled and protected, marked, and safeguarded as specified in AR 25-55, DA Freedom of Information Act Program, AR 380-5 (Chapter 5), DA Information Security Program, and DoD 5200.01-M, Volume 4. This includes PII, as defined in DoDD

5400.11 (DoD Privacy Program), Enclosure 2.

NETCOM IMCS IV IDIQ

DD Form 254 (20190504) Block 13 - Continuation Sheet 3 of 11

10. Block 10k – Some Contractor personnel will be performing functions that require access to SIPRNET, NIPRNET, and/or other information systems at various Government work locations.

Installation task orders (DD Form 254/PWS) will identify system access requirements for each work location. All access to classified systems shall only be at Government work locations.

11. Block 11a – Properly cleared contractor personnel, who have established need-to-know in accordance with this contract, are authorized access to classified documents, material, or information at Government facilities only, to include TDY sites in support of this contract.

Specific locations will be reflected in installation task orders (DD Form 254/PWS). The Contractor shall not remove any classified materials or information from the Government work site(s), nor shall the Contractor reproduce, generate, or store any classified materials relating to this contract or its task orders, at other than specified Government locations.

11a. Block 11a: Security In/out-processing. All contractor personnel integrated or embedded with NETCOM organizations shall in-process through the supporting NETCOM organizational G2/S2/Security Office at work performance start date. All contractor personnel integrated or embedded with NETCOM organizations shall out-process and clear through the supporting NETCOM organizational G2/S2/Security Office upon termination of employment on the contract or upon contract expiration/termination, whichever occurs first. Above requirements are applicable if there is a change in primary work performance location while employed on the contract. The prime contractor shall ensure above requirements are included in sub-contracts and lower tier contracts when personnel are integrated or embedded with NETCOM organizations.

Per AR 380-49, “embedded and/or integrated contractors are those who operate out of government-supplied on-base space.”

11b. Block 11a: The Contractor shall submit a Visit Authorization Requests (VAR) via JPAS which reflects all cleared contractor personnel who will be performing on this contract. VARs shall include the contract number in the additional information block and COR/Government Requiring Activity (RA) POC name and telephone number. All VARs shall be maintained current throughout the life of the contract and shall be updated as personnel or other relevant changes occur. All Contractor personnel must be reflected on a current VARs in order to perform on this contract. Prime contractor shall ensure all subcontractors comply with these requirements.

11c. Block 11a: Army Learning Management System (ALMS) Initial Security Orientation and Annual Refresher Training. Within 30 business days of work start date, contractor personnel shall complete the Department of the Army standardized computer web-based Initial Security Orientation training and annually thereafter, shall complete the Annual Security Refresher Training, both available via AKO at https://www.lms.army.mil. Certificates of successful completion, of initial and annual refresher training, shall be provided to the COR within three (3) business days of completion of training. This training is in addition to unit or installation specific security training

NETCOM IMCS IV IDIQ

DD Form 254 (20190504) Block 13 - Continuation Sheet 4 of 11

12. Block 11e - This is a services only contract (see Block 9). Most contractor personnel will require at least a Secret security clearance in order to perform work at the various Government work locations. Site specific security requirements, to include required security access/clearance levels, special access requirements, and background eligibility and suitability investigation requirements, will be specified in installation task orders (DD Form 254/PWS). Submission of suitability investigations will be addressed in installation task orders (DD Forms 254). The contractor shall ensure that personnel are able to acquire and maintain required security clearances based on current (in scope) personnel security investigations, as specified in installation task order DD Form 254/PWS.

12a. Block 11e – Classified information generated or received during work performance on this contract shall be controlled, marked, protected, transmitted, and safeguarded in accordance with AR 380-5 and current Army and DoD policy and shall only be at specified Government requiring activity work locations.

12b. Block 11e - The process of extracting, summarizing, incorporating, paraphrasing, restating or generating, in new form, information already classified and marking the newly developed material consistent with the classification markings that apply to the source information, is derivative classification. Derivative classification also includes the classification of information based on instructions from a security classification guide/guidance. The duplication or reproduction of existing classified information is not derivative classification. Any derivatively classified information generated during performance under this contract will normally be marked consistent with the classification markings reflected on the source material(s). However, a compilation of information could warrant a change in classification level of the information, or, it could warrant the classification of previously unclassified information. The Contractor shall consult with the COR regarding any potential classification issues when generating information and/or deliverables in support of this contract.

12c. Block 11e - The Government requiring activity will identify, or provide, additional instruction or appropriate security classification guides/guidance to the contractor, as required.

The Contractor shall notify the respective COR, in writing, of any instance where referenced security classification guides/guidance cannot be accessed at links or sites specified in this contract, in supporting task orders, or in separate correspondence. The prime contractor shall ensure all applicable security classification guides/guidance are made available to subcontractor(s), as appropriate.

12d. Block 11e - In accordance with Under Secretary of Defense for Intelligence Memorandum, 31 January 2019, subject: Derivative Classification Training, all Department of Defense (DoD) personnel with access to classified information must complete derivative classification training on an annual basis. All Contractor personnel who require access to classified information during work performance on this contract shall successfully complete initial derivative classification training at employee work performance start date and successfully complete derivative classification refresher training on an annual basis, thereafter. Access to classified includes, but

NETCOM IMCS IV IDIQ

DD Form 254 (20190504) Block 13 - Continuation Sheet 5 of 11 is not limited to, access to classified systems and networks. Contractor initial and continued access to classified systems and networks is contingent upon successful completion of this prescribed training requirement. Derivative classification training is available on line at the DSSA/STEPP website http://www.cdse.edu/stepp/index.html, under Information Security.

(Derivative Classification Course (IF103.16)/ Derivative Classification Exam (IF109.06)/Derivative Classification Refresher (IF 109.16)/Derivative Classification Exam (IF 109.06), or current versions). Certificates of successful completion of initial and annual refresher training shall be provided to the COR within three (3) business days of completion of training.

12e. Block 11e – Above training requirements are applicable to subcontractor and lower-tier subcontractor personnel who require access to classified information. The prime Contractor shall require subcontractors to include above requirements in lower tier subcontracts.

13. Block 11i – At the direction of the Government requiring activity, the contractor may be required to install, or have installed, required TEMPEST countermeasures for information processing equipment at Government work locations only. Installation of such countermeasures will only be accomplished after a technical TEMPEST countermeasures review, by a Government (Army) certified TEMPEST technical authority (CTTA), has been completed.

TEMPEST countermeasures are designed to reduce or prevent exploitation of compromising emanations by containing them within the inspectable space of the equipment or facility processing classified information. Application of TEMPEST countermeasures will be in accordance with AR 380-27, in the case of Protected Distribution Systems (PDS) CNSSI 7003, and/or other applicable directives as situations warrant. Such requirements will be site specific and when required, reflected in the installation task order DD Form 254/PWS.

14. Block 11j – Operations Security (OPSEC). The Contractor is not required to prepare an OPSEC plan. The Contractor shall comply with DoD Directive 5205.02, Army Regulation 530- 1, and the requiring activity OPSEC program. The Contractor shall ensure all contractor employees and subcontractors performing work under this contract and all installation task orders, complete Level I OPSEC training within 30 calendar days of start of employee performance on this contract/installation task orders, and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the respective COR, upon request.

15. 11l- Controlled Unclassified Information: Reference paragraph 8 Ref 10.j.

16. Block 11m – Information Assurance (IA) Training. All contractor personnel with access to Government information systems and networks shall successfully complete all required IA awareness training as specified in AR 25-2 and as directed by the Government requiring activity.

Training is available at https://cs.signal.army.mil.

NETCOM IMCS IV IDIQ

DD Form 254 (20190504) Block 13 - Continuation Sheet 6 of 11

16a. Block 11m - Contractor employees and subcontractor employees performing work under this contract/task orders that have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at https://atc.us.army.mil, in the unit container managed by the respective COR. Certificates of successful completion of IA training, Acceptable Use Policies (AUP), applicable baseline and computing environment certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

16b. Block 11m - The Contractor shall ensure that all contractor employees and subcontractor employees requiring IA awareness training complete the training at start of work performance on this contract/task order and annually thereafter for the duration of this contract/task order.

16c. Block 11m - Information Assurance Workforce Certification. Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.239-7001 (Information Assurance Contractor Training and Certification) applies to this contract/task order. This contract/task order is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management IA skills for personnel performing IA functions within DoD. Functions spanning multiple levels require certification of the highest level functions. Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty.

16d. Block 11m - The Contractor shall ensure its IA workforce members have the baseline certifications corresponding to their IA functions, as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3 of DoD 8570.01-M at work performance start date. Contractors shall obtain all required Computing Environment (CE) certificates within 6 months of work start unless specified otherwise in the contract/task order. The IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. Contractor certification holders shall ensure that their certificates remain active and are renewed prior to expiration.

16e. Block 11m - Each individual shall upload a copy of their certification(s)to ATCTS in their account. The ATCTS manager is required to verify the individual’s certification(s).

16f. Block 11m - Non-Government-owned computing systems or devices. The Contractor shall comply with AR 25-1 and AR 25-2. The Contractor shall not install or connect non- Government-owned computing systems or devices to Government networks without the respective COR’s coordinating and obtaining proper authorization from the appropriate Information System Security Manager (ISSM), ensuring that all software has been authorized under the Risk Management Access Only process. The non-Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, https://atc.us.army.mil/

NETCOM IMCS IV IDIQ

DD Form 254 (20190504) Block 13 - Continuation Sheet 7 of 11

MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

16g. Block 11m - Protection of Sensitive Unclassified Data. The Contractor shall ensure any sensitive information, including, but not limited to, PII and FOUO, proprietary, and Law Enforcement Sensitive information residing on Mobile Computing Devices (MCD) or other external media, is protected in accordance with current Data at Rest (DAR) guidelines and requirements. The Contractor shall use an authorized, approved, and prescribed DAR solution.

The MCDs include, but are not limited to, laptop, netbook, notebook, or tablet computers, and Blackberry or equivalent devices. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks, and other portable digital storage devices. Guidance for protecting DAR information appears in DoD Policy Memorandum, 3 Jul 07, subject: Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Media, and DoD Component implementing instructions.

17. Block 11m – The Personnel Security (IT level) and IA workforce specialty requirements, aligning the IA functional responsibilities and access levels to the contract tasks, in accordance with DoD 8570.01-M, are site specific and will be identified in installation task orders.

18. The prime Contractors shall provide a copy of the DD Form 254 and all revisions, for any classified subcontract supporting this work effort, to address indicated below. In addition, the prime contractor shall require any sub-contractors who have lower tier sub-contractors to also comply with this requirement. DD Forms 254 shall be provided to the following:

NETCOM

ACofS. G2, ATTN: NETC-IS 2133 Cushing Street, Suite 2320 Fort Huachuca, AZ 85613-7070 E-mail:usarmy.huachuca.netcom.list.G2-ACCS-team@mail.mil

19. Antiterrorism Level I Training. The Contractor shall ensure that all contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas complete Antiterrorism (AT) Level I awareness training within 30 calendar days after start of employee performance on this contract/task order. Within 5 calendar days of training, the contractor shall certify to the respective COR or KO that all employees performing work under this contract/task order have completed the AT Level I awareness training. AT Level I awareness training is available at https://jkodirect.jten.mil, course #JS-

US007-14.

20. Access and General Protection Security Policy and Procedures. Contractor and all associated sub-contractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, NETCOM IMCS IV IDIQ

DD Form 254 (20190504) Block 13 - Continuation Sheet 8 of 11

Director of Emergency Services or Security Office. Contractor workforce must comply will all personal identity verification requirements of FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes. Contractor personnel shall comply with all security policies/procedures in effect at all work and TDY locations.

21. Common Access Card (CAC). The Government will provide special access badges as necessary. The Prime Contractor Facility Security Officer shall ensure that all Contractor personnel acquire and maintain CACs. The approving Government Trusted Agent (TA) may give access to the FSO using the online Trusted Associate Sponsorship System (TASS), https://tass.dmdc.osd.mil/tass. Contractor eligibility remains in force during employment under the contract for those employees who have a valid and recurring requirement for access to U.S.

Government facilities or automation systems to perform those duties stipulated in the contract.

The Contractor shall use a valid CAC to access the U.S. Government domain. The Contractor shall immediately return the CACs to the COR when the Contractor employee’s employment is terminated or upon expiration of the contract. The CACs expire when Contractor employee’s eligibility terminates or three years from the issuance date, whichever occurs first. The Contractor is responsible for all CACs and shall report all lost or stolen CACs to the COR immediately.

22. Contractor Identification Requirements. In accordance with FAR 37.114 (c), all contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious are required to identify themselves as such to avoid being mistaken for Government officials. Contractors performing work at Government workplaces shall provide their employees with an easily readable identification (ID) badge indicating the employee's name, the contractor's name, the functional area of assignment, and a recent color photograph of the employee. Contractors shall require their employees wear the ID badges visibly when performing work at Government workplaces. Contractor personnel shall also ensure that all e-mails, documents or reports they produce are suitably marked as Contractor products and/or that Contractor participation is appropriately disclosed. All signature blocks on e-mails shall indicate that the sender is a Contractor employee and include the Contractor's company name.

23. Contractor Responsibility: By memorandum dated 1 April 2005, the Deputy Under Secretary of Defense (Counterintelligence and Security) authorized the use of JPAS to verify security clearance levels for personnel who require access to classified information within DoD.

Within Army, use of JPAS is mandated. The Contractor FSO shall ensure all cleared personnel performing on this work effort have security access level, Information Technology (IT) level, Contractor affiliation, Security Management Office (SMO) affiliation and all other required information accurately reflected/populated in JPAS. The Contractor shall make available to the Government requiring activity, and all work locations under this effort, all information necessary

NETCOM IMCS IV IDIQ

DD Form 254 (20190504) Block 13 - Continuation Sheet 9 of 11 to enable verification of security access level/affiliation via JPAS. When Visit Authorization Letters (VAL) are required by the Government requiring activity, they shall be transmitted via JPAS. If any concerned organization is not on-line with JPAS, a hardcopy VAL may be necessary until JPAS is available. Non-DoD organizations may still require a hardcopy VAL.

24. Contractor personnel shall comply with all applicable security regulations, guidance and procedures, including local, referenced in this contract, in installation task orders, and in effect at all Government work locations. Contractor personnel shall attend all Government provided or Government sponsored security and security awareness training as specified by the Government requiring activity. This includes successful completion of all required on-line security training, as directed by the Government requiring activity.

25. Contractor personnel may require access to NIPRNET, Army Knowledge Online (AKO), SIPRNET, and other systems. The respective COR will validate such requirements.

26. Threat Awareness and Reporting Program. Contractor personnel shall comply with all Threat Awareness and Reporting Program (TARP) reporting requirements in accordance with AR 381-12, and as directed by the Government requiring activity. Contractor personnel shall report threat-related incidents, behavioral indicators, and other matters of Counterintelligence (CI) interest as specified in AR 381-12, Chapter 3, to the nearest military CI office, the Facility Security Officer, the Federal Bureau of Investigation, or the Defense Counterintelligence and Security Agency (DCSA).

27. The contractor shall ensure all employees, including subcontractor employees, attend threat awareness training within 30 calendar days of start of employee work performance at each installation work location, and annually thereafter. Annual training must be conducted by a supporting CI agent. The initial training may be satisfied by taking the authorized on-line training via AKO at https://www.lms.army.mil if attendance at a CI training session is not possible within 30 calendar days of employee work start. . Certificate of completion shall be maintained on file. The contractor shall maintain training records which include employee names, training dates, training location, and method of training and shall make such records available to the respective COR, upon request.

28. Contractor personnel who require access to information, or who will be performing or participating in any functions, as outlined in AR 381-12, paragraph 2-6, shall contact their respective COR who will coordinate with supporting Government Security Manager for scheduling of special CI threat-awareness briefings/and debriefings, as appropriate. This includes contractor personnel who require access to Sensitive Compartmented Information (SCI), Special Access Program (SAP) information, cryptographic information, or who are system administrators or key information network personnel with administrator-level privileges on classified and unclassified Army information systems. These contractor personnel shall notify their respective COR in advance of any foreign travel to determine if special CI threat travel briefings/debriefings are a requirement, as specified in paragraph AR 381-12, paragraph 2-6a.

https://www.lms.army.mil/

NETCOM IMCS IV IDIQ

DD Form 254 (20190504) Block 13 - Continuation Sheet 10 of 11

The COR will in-turn coordinate with the supporting Government on-site Security Manager for this determination.

29. Federal Acquisition Regulation (FAR) Clause 52.204-9 (Personal Identity Verification of Contractor Personnel) is applicable to this contract/task orders.

30. Block 14 – References

AR 25-1 Army Information Technology AR 25-2 Army Cybersecurity AR 25-55 The Department of the Army Freedom of Information Act Program AR 190-13 The Army Physical Security Program AR 190-51 Security of Unclassified Army Resources (Sensitive and Non-sensitive) AR 380-5 Army Information Security Program AR 380-27 Control of Compromising Emanations AR 380-40 Safeguarding and Controlling Communications Security Material (FOUO requires AKO access) AR 380-49 Industrial Security Program AR 380-53 Communications Security Monitoring AR 380-67 Personnel Security Program AR 381-12 Threat Awareness and Reporting Program AR 525-13 Antiterrorism (FOUO requires AKO access) AR 530-1 Operations Security DA PAM 25-2-6 Cybersecurity Training and Certification Program DISA Cir 300-115-3 Defense Information System Network (DISN) Secret Internet Protocol Routing Network Security Classification Guide DoDM 5105.21-V1 Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Information and Information Systems Security DoDM 5105.21-V2 Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Physical Security, Visitor Control, and Technical Security DoDM 5105.21-V3 Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Personnel Security, Industrial Security, and Special Activities DoDM 5200.01 V1 DoD Information Security Program: Overview, Classification, And Declassification DoDM 5200.01 V2 DoD Information Security Program: Marking Of Information DoDM 5200.01 V3 DoD Information Security Program: Protection Of Classified Information DoDM 5200.01 V4 DoD Information Security Program: Controlled Unclassified Information

(CUI)

DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM) DoDI 5400.11 DoD Privacy and Civil Liberties Programs DoD 8570.01-M Information Assurance Workforce Improvement Program DoDD 5205.02E DoD Operations Security (OPSEC) Program DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT)

NETCOM IMCS IV IDIQ

DD Form 254 (20190504) Block 13 - Continuation Sheet 11 of 11

TB 380-41 Security: Procedures for Safeguarding, Accounting, and Supply Control of COMSEC Material (FOUO requires AKO access) CNSSAM TEMPEST/1-13, RED/BLACK Installation Guidance (FOUO) CNSSI 7003 Protected Distribution Systems --Army CIO/G-6 Best Business Practice 05-PR-M-0002, Information Assurance (IA Training and Certification (available at https://www.milsuite.mil/wiki/Portal:Army_Cybersecurity/Best_Business_Practices --Memorandum, Department of the Army G-2, 29 May 2007, subject: Classified Visit Request Process (available from the Government requiring agency), --Memorandum, Office of the Under Secretary of Defense, 1 April 2005, subject: Facilitating Classified Visits within Department of Defense (available from the Government requiring agency), --Memorandum, Department of the Army G2, 13 August 2008, subject: Clarification on Personnel Security Investigative Requirements for IT Positions – Correct Copy (available from the Government requiring agency)

--ICD 703 Protection of Classified National Intelligence, Including SCI https://www.milsuite.mil/wiki/Portal:Army_Cybersecurity/Best_Business_Practices