Attachment 3 - AOI 4 Security Requirements.pdf

Attachment 3: Security Considerations

HT003826X0004 / CSO HT003825SC001

AOI 4 - Data Application

Subject to negotiation, the Government anticipates language similar to the following to be included in the prototype other transaction award:

Security This clause establishes requirements and processes for the Personnel Security Screenings for Defense Health Agency Contractor personnel (including subcontractors) in performance of this agreement, in accordance with Department of Defense (DoD) and federal regulations.

General Requirements The Contractor shall ensure that all personnel performing work under this agreement comply with the applicable DoD personnel security requirements as outlined in DoD Manual 5200.02, DoD Instruction 5200.46, DoD Instruction 1402.05, and all other relevant regulations. The Contractor shall verify that all personnel performing duties under this agreement are suitable for access to Controlled Unclassified Information (CUI) and/or secure facilities, as determined by the appropriate security clearance level and background checks.

Background Investigations All personnel performing duties on this agreement must be vetted by the Defense Health Agency (DHA) Administration Security Division (ASD). Procedures and requirements for submission can be found in DHA Administrative Instruction 5200.04, 5200.05, and DHA Internal Policy Memorandums. Vetting packages must be submitted for processing by the assigned Agreement Officer’s Representative (AOR) or Security Officer/Facility Security Officer, depending on Personnel Security office of primary responsibility.

Access to Sensitive Information and Moderate Risk Information Systems Personnel assigned to this agreement who require access to specific categories of sensitive/controlled unclassified information and access to Unclassified Moderate Risk Information Systems may be subject to a higher Tier background investigation with a favorable final determination. Personnel falling into this category must have a valid need-to-know, determined by the Agreements Officer or AOR. In situations where this paragraph applies, a justification memorandum must be submitted with the security package.

At a minimum, this memorandum should clearly identify the Contractor personnel; Names, access requirements, and permission levels of the information system(s) required to perform duties on this agreement; shall be endorsed by the applicable Information Systems Security Officer (ISSM), confirming the system requirements; signed by the Government official validating the personnel’s need-to know.

Access to classified information is not required to perform duties on this agreement therefore investigations processed by ASD will not result in a National Security determination. The Agreements Officer has identified the staffing requirement to be base number (12). The US Government will initiate up to base number + 25 % (3) background investigations over the life of the agreement. Requests in excess of this amount will require Agreements Officer approval.

Minimum Background Investigation All personnel performing duties on this agreement must undergo, at a minimum, a Tier 1, or equivalent background investigation as required by the Office of Personnel Management Federal Investigation Standards. The Contractor shall submit all required background investigation requests the appropriate security office as described in paragraph 1.6.1.2. Any personnel who are found to be unsuitable shall be removed from the project at the direction of the Agreements Officer or ASD Personnel.

In accordance with DoDI 8500.2 and DoD 8570.01-M a designator shall be assigned to certain personnel that indicate the level of IT access required to execute the responsibilities of the position based on the potential for an individual assigned to the position to adversely impact DoD missions or functions. As defined in DoD 5200.2-R, the IT Position categories include:

a. IT-I (Privileged)

b. IT-II (Limited Privileged)

c. IT-III (Non-Privileged)

Note: The term IT Position is synonymous with the older term Automated Data Processing (ADP) Position (as used in DoD 5200.2-R, Appendix 10).

Investigative requirements IT Position categories vary, depending on the role and whether the individual is a U.S. civilian contractor or a foreign national. The contractor Program Manager shall assist the AOR or other designated Government official in determining the appropriate IT Position Category assignment for all contractor personnel. All required Single-Scope Background Investigation (SSBI), SSBI Periodic Reinvestigation (SSBI-PR), and National Agency Check (NAC) adjudication shall be performed in accordance with DoDI 8500.2. IT Position Categories shall be determined based on the following criteria:

IT-I Level (Privileged) Positions in which the contractor is responsible for the planning, direction, and implementation of a computer security program; major responsibility for the direction, planning and design of a computer system, including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain. Personnel whose duties meet the criteria for IT-I Position designation require a favorably adjudicated SSBI or SSBI-PR. The SSBI or SSBI-PR shall be updated a minimum of every five (5) years.

IT-II Level (Limited Privileged) Positions in which the contractor is responsible for the direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed at the IT-II Position level by a higher authority to ensure the integrity of the system. Personnel whose duties meet the criteria for an IT-II Position require a favorably adjudicated NAC.

IT-III Level (Non-Privileged) All other positions involved in computer activities. Incumbent in this position has non-privileged access to one or more DoD information systems/applications or database to which they are authorized access.

Personnel whose duties meet the criteria for an IT-III Position designation require a favorably adjudicated

NAC.

Background Checks Supporting Local Anti-Terrorism/Force Protection Requirements Screenings conducted by ASD will be limited to those required to perform duties as described in this statement of work. The Defense Health Agency does not control Military Installation Physical Security requirements; supplemental background checks may be required to for entry. Additional costs associated with processing supplemental background checks are not covered within this agreement.