Attachment 2 - Supplemental Clauses.pdf

Attachment 2 – Supplemental Clauses

5352.201-9101 AFGSC Ombudsman (July 2023)

(a) An ombudsman has been appointed to hear and facilitate the resolution of concerns from offerors, potential offerors, and others for this acquisition. When requested, the ombudsman will maintain strict confidentiality as to the source of the concern. The existence of the ombudsman does not affect the authority of the program manager, contracting officer, or source selection official. Further, the ombudsman does not participate in the evaluation of proposals, the source selection process, or the adjudication of protests or formal contract disputes. The ombudsman may refer the interested party to another official who can resolve the concern.

(b) Before consulting with an ombudsman, interested parties must first address their concerns, issues, disagreements, and/or recommendations to the contracting officer for resolution. Consulting an ombudsman does not alter or postpone the timelines for any other processes (e.g., agency level bid protests, GAO bid protests, requests for debriefings, employee-employer actions, contests of OMB Circular A-76 competition performance decisions).

(c) If resolution cannot be made by the contracting officer, the interested party may contact the ombudsman, for AFGSC (Air Force Global Strike Command) acquisitions please contact the Director of Contracts, Air Force Installation Contracting Center, Operating Location - Global Strike (AFICC/KG OL- GSC) via the following e-mail workflow address: ig.afica_kg.workflow@us.af.mil. Concerns, issues, disagreements, and recommendations that cannot be resolved at the Center/MAJCOM/DRU/SMC ombudsman level, may be brought by the interested party for further consideration to the Air Force ombudsman, Associate Deputy Assistant Secretary (ADAS) (Contracting), SAF/AQC, 1060 Air Force Pentagon, Washington DC 20330-1060, phone number (571) 256-2395, facsimile number (571) 256- 2431.

(d) The ombudsman has no authority to render a decision that binds the agency.

(e) Do not contact the ombudsman to request copies of the solicitation, verify offer due date, or clarify technical requirements. Such inquiries shall be directed to the contracting officer.

(End of clause)

5352.204-9000 Notification of Government Security Activities

As prescribed in DAFFARS 5304.404-90, insert the following clause in solicitations and contracts:

NOTIFICATION OF GOVERNMENT SECURITY ACTIVITIES (JUL 2023)

This contract contains a DD Form 254, DOD Contract Security Classification Specification, and requires performance at a government location in the U.S. or overseas. Prior to beginning operations involving classified information on an installation identified on the DD Form 254, the contractor shall take the following actions:

(a) At least thirty days prior to beginning operations, notify the Information Protection Office shown in the distribution block of the DD Form 254 as to:

(1) The name, address, and telephone number of this contract company’s representative and designated alternate in the U.S. or overseas area, as appropriate;

(2) The contract number and military contracting command;

https://www.acquisition.gov/daffars/part-5304-administrative-matters#DAFFARS_5304_404_90 http://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0254.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0254.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0254.pdf

(3) The highest classification category of defense information to which contractor employees will have access;

(4) The Department of the Air Force installations in the U.S. (in overseas areas, identify only the APO number(s)) where the contract work will be performed;

(5) The date contractor operations will begin on base in the U.S. or in the overseas area;

(6) The estimated completion date of operations on base in the U.S. or in the overseas area; and,

(7) Any changes to information previously provided under this clause.

(End of clause)

5352.204-9002 Security Incident Reporting and Procedures

As prescribed in DAFFARS 5304.404-90 Additional Contract Clauses, insert the following clause in solicitations and contracts:

SECURITY INCIDENT REPORTING AND PROCEDURES (JUN 2024)

(a) The contractor shall follow the below guidance when a contract contains a DD Form 254, DOD Contract Security Classification Specification:

(1) The contractor shall notify the Government Contracting Activity (GCA) of any security incident involving the potential or actual loss, compromise, or suspected compromise of Top Secret, Secret, and/or Confidential information, referred to as classified information, when the incident is discovered at the contractor’s location.

(i) The contractor shall conduct the requisite inquiry(ies) in accordance with 32 CFR Part 117 and Cognizant Security Office (e.g., Defense Counterintelligence and Security Agency) guidance.

(2) Security incidents occurring at government performance locations where the contractor is categorized as a visitor will be processed and reported in accordance with government host security procedures.

(3) Security incidents involving the potential or actual loss, compromise, or suspected compromise of Special Access Program and/or Sensitive Compartmented Information is under the jurisdiction of the GCA and the contractor shall follow GCA guidance in lieu of this requirement.

(4) This requirement does not relieve the contractor from reporting requirements set forth in 32 CFR Part 117, DFARS 252.204-7012, or as otherwise directed by contract requirements and/or its Cognizant Security Office (e.g., Defense Counterintelligence and Security Agency).

(5) This requirement does not relieve the contractor from adhering to security incident guidance set forth by its Cognizant Security Office (e.g., Defense Counterintelligence and Security Agency).

(6) The contractor is responsible for ensuring all applicable subcontracts include these security incident reporting requirements.

(7) If the lost or compromised information is beyond the jurisdiction of the U.S. Government and cannot be recovered (e.g., media leak, public website posting, or loss in a foreign country), the https://www.acquisition.gov/daffars/part-5304-administrative-matters#DAFFARS_5304_404-90 notification and location of the compromise (e.g., geographic location of unrecoverable equipment) shall be classified commensurate with the classification level of the compromised material to prevent further unauthorized disclosure in accordance with DoDM5200.01 Volume 3, Enclosure 6.

The contractor will contact the GCA for instructions on how to communicate the notification prior to submission in all cases where lost or compromised information is beyond the jurisdiction of the U.S. Government and cannot be recovered.

(8) The contractor shall ensure all notifications determined to contain classified information are properly transmitted and marked in accordance with derivative classification and overarching marking guidelines in accordance with 32 CFR Part 117.

(b) Initial Notification of Security Incident

(1) The contractor shall provide an initial notification of security incident to the GCA within 72 hours of discovery of any incident where classified information may have been subjected to loss, compromise, or suspected compromise for all security incidents involving the contractor’s location unless otherwise directed by contract requirements.

(2) The initial notification to the GCA is considered Controlled Unclassified Information (CUI) [CUI category OPSEC, FEDCON Distribution/Dissemination Control] unless otherwise determined by the GCA, marked in accordance with DoDI5200.48, and shall be transmitted to the GCA through authorized means (e.g., encrypted email or DoD SAFE).

(3) If the initial notification contains classified information either by content or through classification through compilation, the contractor will contact the GCA for submission guidance and ensure the notification is properly marked in accordance with derivative classification and overarching marking guidelines in accordance with 32 CFR Part 117.

(4) The initial notification shall contain the following information, as available at the time of report:

(i) Prime contract number associated with the security incident.

(ii) Date of security incident occurrence.

(iii) Date of security incident discovery if different from date of occurrence.

(iv) Security Classification Guide (SCG) or guidance used to validate classification level of information involved (unclassified title/date); if SCG title is either classified or if listing SCG information will cause the notification to be classified by compilation, do not include and indicate as such in the initial notification.

(v) Classification level of information involved (e.g., Top Secret, Secret, or Confidential)

(vi) Brief description of incident prompting initial notification. If incident directly or indirectly involved government personnel, include government personnel name(s), email address(s), and office information.

(vii) Communicate whether it is possible for the contractor to properly retain and/or provide the suspected information in question for GCA classification review and/or damage assessment.

(c) Final Notification of Security Incident

(1) The contractor shall provide a final notification to the GCA 10 business days from date of initial notification. If the final notification cannot be made 10 business days from the date of the initial notification, the contractor shall request an extension and receive approval in writing from the GCA.

(2) The final notification to the GCA does not relieve the contractor from reporting requirements set forth by 32 CFR Part 117, DFARS 252.204-7012, or as otherwise directed by contract requirements and/or its Cognizant Security Office (e.g., Defense Counterintelligence and Security Agency).

(3) The final notification will be considered CUI [CUI category OPSEC, FEDCON Distribution/Dissemination Control] unless otherwise determined by the GCA, marked in accordance with DoDI5200.48, and sent through authorized means (e.g., encrypted email or DoD

SAFE).

(4) If the final notification contains classified information either by content or through classification through compilation, the contractor is required to contact the GCA for submission guidance and ensure the notification is properly marked in accordance with derivative classification and overarching marking guidelines in accordance with 32 CFR Part 117.

(5) The final notification shall contain the following information:

(i) Prime contract number associated with the security incident.

(ii) Date of security incident occurrence.

(iii) Date of security incident discovery if different from date of occurrence.

(iv) Security Classification Guide (SCG) or guidance used to validate classification level of information involved (unclassified title/date); if SCG title is either classified or if listing SCG information will cause the report to be classified by compilation, do not include this information, and indicate as such in the final notification.

(v) Classification level of information involved (e.g., Top Secret, Secret, or Confidential)

(vii) Detailed description of incident and include the following:

Sequence of events: When, where, and how did the incident occur?

What persons, situations, and/or conditions caused or contributed to the incident?

If incident originated with government personnel, include government personnel name(s), email address(s), and office information.

Include the name(s), email address(s), and office information of all government personnel involved, either directly or indirectly, as appropriate

If classified information is alleged to have been physically lost (e.g., lost classified document), what steps were taken to locate the material?

If security incident was categorized as a data spill, include measures taken to properly sanitize all impacted assets.

(viii) Corrective actions taken to prevent future occurrences

(ix) Result of inquiry (e.g., loss, compromise, suspected compromise, or no compromise)

(x) A copy of the supporting DD Form 254(s) associated with prime contract. If DD Form 254 cannot be provided, the contractor shall indicate the reasons why in the final report.

(d) Definitions

“32 CFR Part 117” means National Industrial Security Program Operating Manual.

“Business days” means days that do not include federal holidays or weekends.

“Classified information” means information the government designates as requiring protection against unauthorized disclosure in the interest of national security, pursuant to E.O. 13526, Classified National Security Information, or any predecessor order, and the Atomic Energy Act of 1954, as amended. Classified information includes national security information (NSI), restricted data (RD), and formerly restricted data (FRD), regardless of its physical form or characteristics (including tangible items other than documents).

“Cognizant security agencies (CSAs)” means agencies E.O. 12829, sec. 202, designates as having National Industrial Security Program implementation and security responsibilities for its own agencies (including component agencies) and any entities and non-CSA agencies under their cognizance. The CSAs are: Department of Defense (DoD); Department of Energy (DOE); Nuclear Regulatory Commission (NRC); Office of the Director of National Intelligence (ODNI); and Department of Homeland Security (DHS).

“Cognizant Security Office” means an organizational unit to which the head of a CSA delegates authority to administer industrial security services on behalf of the CSA.

“Compromise” means an unauthorized disclosure of classified information.

“Data spill” means electronic transmission of classified information via unsecure means such as classified information transmitted over an unclassified network.

“DD Form 254” means the Department of Defense Contract Security Classification Specification.

“Derivative classification” means incorporating, paraphrasing, restating, or generating in new form information that is already classified, and marking the newly developed material consistent with the classification markings that apply to the source information. Includes the classification of information based on classification guidance. The duplication or reproduction of existing classified information is not derivative classification.

“Final Notification of Security Incident” means contractor (or subcontractor) notification to the Government Contracting Activity communicating the results of the inquiry conducted.

“Government Contracting Activity” means an element of a Component designated and delegated by the Component head or designee with broad authority regarding acquisition functions to include the appropriate resources and personnel (e.g., contracting officers or their designees, program managers, program offices, and security personnel) as defined in DoDM 5220.32, Volume 1.

“Initial Notification of Security Incident” means the contractor’s (or subcontractor) notification to the Government Contracting Activity of a security incident occurrence and surrounding details of occurrence.

“Inquiry” means the initial fact-finding and analysis process to determine the facts of any security incident and conducted to determine whether or not there was a loss of classified information or whether or not unauthorized personnel had, or could have had, access to the information.

“Loss” means the inability to physically locate or account for classified information.

“Security classification guide” means a documentary form of classification guidance issued by an Original Classification Authority that identifies the elements of information regarding a specific subject that must be classified and establishes the level and duration of classification for each such element.

“Security Incident” means an incident that results from the mishandling of classified information.

“Suspected Compromise” means when a result of no loss or compromise of classified information cannot be determined with certainty.

(End of clause)

5352.223-9000 Elimination of Use of Class I Ozone Depleting Substances (ODS)

As prescribed in DAFFARS 5323.804-90, insert the following clause in solicitations and contracts:

ELIMINATION OF USE OF CLASS I OZONE DEPLETING SUBSTANCES (ODS) (JUN 2024)

(a) Contractors shall not:

(1) Provide any service or product with any specification, standard, drawing, or other document that requires the use of a Class I ODS in the test, operation, or maintenance of any system, subsystem, item, component, or process; or

(2) Provide any specification, standard, drawing, or other document that establishes a test, operation, or maintenance requirement that can only be met by use of a Class I ODS as part of this contract/order.

(b) For the purposes of Departmet of the Air Force policy, the following products that are pure (i.e., they meet the relevant product specification identified in AFI 32-7086) are Class I ODSs:

(1) Halons: 1011, 1202, 1211, 1301, and 2402;

(2) Chlorofluorocarbons (CFCs): CFC-11, CFC-12, CFC-13, CFC-111, CFC-112, CFC-113, CFC-114, CFC-115, CFC-211, CFC-212, CFC-213, CFC-214, CFC-215, CFC-216, and CFC-217, and the blends R-500, R-501, R-502, and R-503; and

(3) Carbon Tetrachloride, Methyl Chloroform, and Methyl Bromide.

[NOTE: Material that uses one or more of these Class I ODSs as minor constituents do not meet the Department of the Air Force definition of a Class I ODS.] https://www.acquisition.gov/daffars/part-5323-environment-energy-and-water-efficiency-renewable-energy-technologies-occupational-safety-and-drug-free-workplace#DAFFARS_5323_804_90 http://static.e-publishing.af.mil/production/1/af_a4/publication/afi32-7086/afi32-7086.pdf

5352.223-9001 Health and Safety on Government Installations

As prescribed in DAFFARS 5323.9001, insert the following clause in solicitations and contracts:

HEALTH AND SAFETY ON GOVERNMENT INSTALLATIONS (JUL 2023)

(a) In performing work under this contract on a Government installation, the contractor shall:

(1) Take all reasonable steps and precautions to prevent accidents and preserve the health and safety of contractor and Government personnel performing or in any way coming in contact with the performance of this contract; and

(2) Take such additional immediate precautions as the contracting officer may reasonably require for health and safety purposes.

(b) The contracting officer may, by written order, direct Department of the Air Force Occupational Safety and Health (AFOSH) Standards and/or health/safety standards as may be required in the performance of this contract and any adjustments resulting from such direction will be in accordance with the Changes clause of this contract.

(c) Any violation of these health and safety rules and requirements, unless promptly corrected as directed by the contracting officer, shall be grounds for termination of this contract in accordance with the Default clause of this contract.

(End of clause)

5352.242-9000 Contractor Access to Department of the Air Force Installations

As prescribed in DAFFARS 5342.490-1, insert a clause substantially the same as the following clause in solicitations and contracts:

CONTRACTOR ACCESS TO THE DEPARTMENT OF THE AIR FORCE INSTALLATIONS (JUN 2024)

(a) The contractor shall obtain base identification and vehicle passes, if required, for all contractor personnel who make frequent visits to or perform work on the Department of the Air Force installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished, contractor identification badges while visiting or performing work on the installation.

(b) The contractor shall submit a written request on company letterhead to the contracting officer listing the following: contract number, location of work site, start and stop dates, and names of employees and subcontractor employees needing access to the base. The letter will also specify the individual(s) authorized to sign for a request for base identification credentials or vehicle passes. The contracting officer will endorse the request and forward it to the issuing base pass and registration office or Security Forces for processing. When reporting to the registration office, the authorized contractor individual(s) should provide a valid driver’s license, current vehicle registration, valid vehicle insurance certificate, and [ insert any additional requirements to comply with local security procedures ] to obtain a vehicle pass.

https://www.acquisition.gov/daffars/part-5323-environment-energy-and-water-efficiency-renewable-energy-technologies-occupational-safety-and-drug-free-workplace#DAFFARS_5323_9001 https://www.acquisition.gov/daffars/part-5342-contract-administration-and-audit-services#DAFFARS_5342_490_1

(c) During performance of the contract, the contractor shall be responsible for obtaining required identification for newly assigned personnel and for prompt return of credentials and vehicle passes for any employee who no longer requires access to the work site.

(d) When work under this contract requires unescorted entry to controlled or restricted areas, the contractor shall comply with [insert any additional requirements to comply with AFI 31-101 , Integrated Defense, and DODMAN5200.02_AFMAN 16-1405 , Air Force Personnel Security Program ] citing the appropriate paragraphs as applicable.

(e) Upon completion or termination of the contract or expiration of the identification passes, the prime contractor shall ensure that all base identification passes issued to employees and subcontractor employees are returned to the issuing office.

(f) The contractor shall provide an after-hours contact number or after-hours email in the Emergency Mass Notification System (EMNS) for each of their personnel, whose normal place of duty is on a DoD installation or within a DoD facility. The contractor shall comply with any additional requirements in DAFMAN 10-206 for emergency operational reporting. Foreign Nationals may participate and may remove themselves from the Emergency Mass Notification System at any time.

To update information, personnel can access the globe icon on their system desktop screens and choose the “Access Self-Service” option.

(g) Failure to comply with these requirements may result in withholding of final payment.

(End of clause)

5352.242-9001 Common Access Cards (CAC) for Contractor Personnel

As prescribed in DAFFARS 5342.490-2, insert a clause substantially the same as the following clause in solicitations and contracts:

COMMON ACCESS CARDS (CAC) FOR CONTRACTOR PERSONNEL (JUL 2023)

(a) For installation(s)/location(s) cited in the contract, contractors shall ensure Common Access Cards (CACs) are obtained by all contract or subcontract personnel who meet one or both of the following criteria:

(1) Require logical access to Department of Defense computer networks and systems in either:

(i) the unclassified environment; or

(ii) the classified environment where authorized by governing security directives.

(2) Perform work, which requires the use of a CAC for installation entry control or physical access to facilities and buildings.

(b) Contractors and their personnel shall use the following procedures to obtain CACs:

(1) Contractors shall provide a listing of personnel who require a CAC to the contracting officer. The government will provide the contractor instruction on how to complete the Contractor Verification System (CVS) application and then notify the contractor when approved.

https://www.acquisition.gov/daffars/part-5342-contract-administration-and-audit-services#DAFFARS_5342_490_2

(2) Contractor personnel shall obtain a CAC from the nearest Real Time Automated Personnel Identification Documentation System (RAPIDS) Issuing Facility (typically the local Military Personnel Flight (MPF)).

(c) While visiting or performing work on installation(s)/location(s), contractor personnel shall wear or prominently display the CAC as required by the governing local policy.

(d) During the performance period of the contract, the contractor shall:

(1) Within 7 working days of any changes to the listing of the contract personnel authorized a CAC, provide an updated listing to the contracting officer who will provide the updated listing to the authorizing government official;

(2) Return CACs in accordance with local policy/directives within 7 working days of a change in status for contractor personnel who no longer require logical or physical access;

(3) Return CACs in accordance with local policy/directives within 7 working days following a CACs expiration date; and

(4) Report lost or stolen CACs in accordance with local policy/directives.

(e) Within 7 working days following completion/termination of the contract, the contractor shall return all CACs issued to their personnel to the issuing office or the location specified by local policy/directives.

(f) Failure to comply with these requirements may result in withholding of final payment.