Attachment 11 - Security Information Requirements.pdf

ATTACHMENT 11 – SECURITY INFORMATION REQUIREMENTS

1. Security Information

1.1. Security Classification Guide

Classification information is contained in the PGS Security Classification Guide (SCG) and the PGS FoA SCG. The Government considers all other verbal information and documents handled or generated in conjunction with this project to be Controlled Unclassified Information (CUI) information of a sensitive nature that must be protected against release to unauthorized individuals.

1.2. Security Classification Specifications - Controlled Classified Information (CUI)

The COMPANY shall adhere to the requirements of the PGS SCG for the protection of the unclassified information, Controlled Unclassified Information (CUI), and classified information, data, hardware, and computer software generated for or provided in support of the program. To preserve national security interest, the COMPANY shall ensure all aspects of the OTA and work performed are evaluated for conformance with security procedures and standards as identified in this OTA, the National Industrial Security Program Operating Manual

(NISPOM).

The COMPANY shall comply with DoDI 5200.48, Controlled Unclassified Information and DoDM 5400.07, DoD Freedom of Information Act (FOIA) Program. The COMPANY shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

The COMPANY will refer to DoDI 5200.48, Controlled Unclassified Information (CUI), for the protection and handling of CUI.

The COMPANY shall comply with DFARS clause 252.204-7012, which requires the contractor to comply with NIST 800-171 and DFARS provision 252.204-2019.

Acquisition officials should follow procedures outlined in DFARS 204.73 and verify vendors have an adequate NIST SP 800-171 summary assessment score within the Supplier Performance Risk System (within Procurement Integrated Enterprise Environment, PIEE). If the score doesn't show a medium- or high-level assessment with a score of 110 or better (as described in the "NIST SP 800-171 DoD Assessment Methodology"), include clause 252.204-7020 and obtain the vendor's "system security plan" and "plan of action" for NIST SP 800-171 verification and assurance by Army security officials.

1.3. Security Classification Specifications - Classified Information

For contracts that require handling or access to classified information. Contractor shall comply with FAR 52.204‐2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22‐M); (2) any revisions to DOD 5220.22‐M, notice of which has been furnished to the contractor.

2. Counterintelligence Awareness and Reporting (CIAR)

Formerly known as TARP, briefing is required for contractor personnel working under a contract for PEO Soldier. The link to the CIAR training is located at CDSE: https://www.cdse.edu/. Course number is: CI116.16. Current Direct Link to the training course is: https://www.cdse.edu/Training/eLearning/CI116/. The COMPANY shall submit certificates of completion initially and annually to their AO. People employed by Army contractors will be aware of and report threat related incidents, behavioral indicators, and other matters of Counterintelligence (CI) interest as specified in AR 381-12, Counterintelligence Awareness and Reporting (CIAR). Incidents will be reported to DCSA, PEO Soldier Security Office and nearest military CI office.

Deliverables: Provide certificates as necessary.

3. Critical Program Information (CPI)

CPI is defined as information/technologies resident in a particular system or program which if divulged to unauthorized persons, would likely result in the reduction of a critical U.S. military technological advantage. In as much, CPI may be identified by the government during a contracted effort and if identified must be protected by the COMPANY in accordance with guidance outlined in an Implementation Program Protection Plan (IPPP) IAW PEO Soldier’s Program Protection Plans (PPPs), written in collaboration with the COMPANY. The aforementioned IPPP or PPP will establish policy and procedures for the protection of CPI.

https://www.cdse.edu/ https://www.cdse.edu/Training/eLearning/CI116/

4. Antiterrorism (AT)

All contractor employees, including subcontractor employees, requiring access to government installations, facilities and controlled access areas shall complete AT Level l awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The COMPANY shall submit certificates of completion initially and annually to their AO.

AT Level 1 training is an annual requirement for contractor and subcontractor employees. AT Level I awareness training is available at the following website:

https://jkodirect.jten.mil.

For contractor personnel traveling overseas, AT Awareness Training is required for US based contractor employees and associated subcontractor employees to make available and to receive Government provided area of responsibility specific AT awareness training as directed by AR 525-13. Specific area of responsibility training content is directed by the combatant commander, with the units Anti-Terrorism Officer being the local point of contact.

Deliverables: Provide certificates as necessary.

5. Information Security

Contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures. The COMPANY shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office.

Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204‐9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes

Deliverables: Provide background check information as necessary.

https://jkodirect.jten.mil/

6. Operations Security

Per AR 530‐1, Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter. All contractor employees, including subcontractor employees, shall complete OSPEC awareness training within 30 calendar days after the contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The COMPANY shall submit certificates of completion, initially and annually, to their PM/COR who will forward to the PEO Soldier Security Office. OPSEC awareness training is an annual requirement for contractor and subcontractor employees. OPSEC awareness training is available at the following website: https://securityawareness.dcsa.mil/opsec/index.htm. The Prime contractor shall coordinate with the government OPSEC Officer and comply with the government’s OPSEC Plan.

Deliverables: Provide certificates as necessary.

7. Information Assurance

Contractor employees who require Access to Government Information Systems (IS). All contractor employees that require access to Government IS must successfully complete the DoD Information Assurance Awareness prior to access to the IS and then annually thereafter. All contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01‐M and AR 25‐2 within six months of appointment to IA/IT functions. Contractors will also take all other security related training, initially and annually, to include but not limited to, Information Security Awareness, Derivative Classification, and Cyber Awareness training. All Army data, information and software will be cyber protected in accordance with AR-25-2.

8. FARs and Defense FARs (DFARs) Clauses (as required)

• DFARS Clause 252.204-7012, “Safeguarding Covered Defense Information (CDI) and Cyber Incident Reporting,” Requires a company to safeguard CDI and to report to the DoD the possible exfiltration, manipulation, or other loss or compromise of unclassified

CDI.

• DFARS 252.204-7000, “Disclosure of Information,” Prohibits the contractor from releasing any classified information pertaining to the contract or any program related to the contract, unless they have CO approval.

• DFARS 252.204-7008, “Compliance with Safeguarding Covered Defense Information

Controls,” Requires contractors and subcontractors to safeguard covered defense information that resides in or transmits through covered contractor information systems by applying specified network security controls as identified in NISTSP 800-171.

https://securityawareness.dcsa.mil/opsec/index.htm

• DFARS 252.204-7009, “Limitations on the use or disclosure of Third-Party Contractor reported Cyber Incident Information,” Required for contractor services that include support for the Government’s activities related to safeguarding covered defense information and cyber incident reporting.