Attachment 3 - DD Form 254 Continuation Sheets.docx

Continuation Sheet 1 of 3 – DD Form 254 (Solicitation Number W91CRB-21-R-0018)

Block 13:

SECURITY GUIDANCE (contd):

Contractor personnel are subject to all local installation rules and procedures. Site-specific approval regarding access, issue of security badges, etc., will be coordinated as required. Contractor personnel should be aware at all times of any unusual persons or packages in their work area and immediately report those to the building security staff. If Contractor personnel become aware of any person seeking unauthorized access to classified materials, they should immediately report this to the Contracting Officer Representative (COR).

The Contractor shall conform to all applicable federal and industry security standards, and meet all existing DoD security requirements as outlined in the Performance Work Statement (PWS) Section 1.6.7, incorporated herein. In addition, the Contractor shall work closely with Army and DoD Security Teams to ensure the proposed implementation comports with DoD security requirements and appropriate FedRamp certification in order to ensure overall data protection to prevent loss, disaster or malicious attack. Any Contractor hosting Army data will be required to submit a System Security Plan (“SSP”) that meets or exceeds the requirements of NIST SP 800-171, and any amendments or replacements to NIST, FIPS, or other security standards.

All work under this contract is proprietary to Army and DoD; the Contractor shall not release any information regarding the work to anyone without written permission by the Government.

APPLICABILITY:

All OTJAG Army organizations residing, traversing or furnishing and receiving Department of Defense information network–Army (DODIN–A) information technology (IT) services, products, and support through the established contract for support to or on the local area network JAGCNet System Identification: 3575 Registration Type: Assess and Authorize System Acronym: Judge Advocate General's Corps Network System Name: JAGCNET Version / Release Number: 1.0 Information System Owner: HQDA Office of the Judge Advocate General The Department of Defense information network (DODIN) includes DoD IT (e.g., DoD-owned or DoD controlled information systems (IS), platform IT systems, and IT products and services) that are operated by or on behalf of DoD components as defined in DODI 8500.01 and control systems and industrial control systems (ICS) as defined in National Institute of Standards and Technology (NIST) Special Publication 800–82.

All information management, information technology Task-orders/ Delivery-orders within this contract will integrate security early and throughout the IT development life cycle, capital planning, investment control, portfolio management, and enterprise architecture processes in accordance with the DoD Cybersecurity Architecture and other applicable DoD and Army issuances. Contractor shall ensure the security standards are integrated into the acquisition planning and contract administration in accordance with this PWS, and issued Task-orders/ Delivery orders within this contract. Agency cyber security representatives will ensure that contracts and other agreements include specific requirements to provide cybersecurity for information and the IT used to process that information in accordance with DODI 8500.01 and DODI 8510.01. Document baseline cybersecurity requirements as a condition of contract award for acquisitions utilizing information technology.

Agencies’ cybersecurity program manager(s) shall ensure that the personnel, processes, and IT for which the contract supports the development, procurement, integration, modification, operation and maintenance, and/or final disposition responsibility in acquiring information technology will include the appropriate information technology security policies and requirements, including use of common security configurations available from the National Institute of Standards and Technology’s (NIST) website at http://checklists.nist.gov. Agency contracting officers should consult with the requiring official, local information assurance officers, and information security system managers to ensure the appropriate standards are incorporated. All Cybersecurity Request for Proposal (RFP), Task-Orders, Delivery-Orders and IM/IT considerations will be submitted to the agency Information Assurance officer and agency portfolio manager to assist in developing the risk management framework that reflects the specific stakeholder cybersecurity requirements and the specifics of the solution under development.

DoD organizations that use external IT services provided by a non-DoD U.S. Government agency must ensure the categorization of the system delivering the service is appropriate to the confidentiality, integrity, and availability needs of the information and mission. DoD organizations must also ensure that the system delivering the service operates under a current authorization from that agency. In accordance with DoDI 8500.01, the external government agency and the DoD organization need to develop an interagency agreement or government statement of work for this application with requirements for service level agreements (SLAs) that include the application of appropriate security controls which will be reviewed by the agency information assurance officer, information system security manager and agency cyber security division.

Agency command senior intelligence official or information security manager shall approve or validate the need-to-know for individuals (contractor) requiring SCI access and validate the need to establish SCIFs, SCI communications, and information systems (classified and unclassified).

Regulations:

· Department of Defense INSTRUCTION, NUMBER 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) 12/29/2020

· AR 25-1, Army Information Technology, 07/15/2019

· AR 25-2, Army Cybersecurity (Previously: Information Management Information Assurance) 04/04/2019

· AR 380-5, Army Information Security Program, 10/22/2019

· Department of the Army Pamphlet 25–2–14 Information Management: Army Cybersecurity Risk Management Framework for Army Information Technology 04/08/2019

· DOD Instruction 8520.2, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, 24 May 2011

· Department of the Army Pamphlet 25–1–1 Information Management: Management of Sub-disciplines

· Army Information Technology Implementation Instructions 15/07/2019

· National Institute of Standards and Technology (NIST) Special Publication 800–82.

· Army Regulation 380–28 Security Army Sensitive Compartmented Information Security Program

ACCESS CONTROL:

Access to classified information requires a final U.S. Government clearance at the appropriate level and a need-to-know basis. The Contractor personnel who require access to classified information must obtain SECRET safeguarding capability prior to being provided SECRET information, and must comply with directions provided by the Contracting Officer’s Representative (COR).

Access to NATO information requires a final U.S. Government clearance at the appropriate level.

The Contractor personnel requiring access to DoD government or DoD contractor facilities where proof of security clearance is required, shall meet the security access requirements specified by the host and/or owner of those facilities.

The Prime contractor and subcontractor companies that are Foreign company(ies) and/or U.S. Foreign Owned, Controlled or Influenced (FOCI) will not be allowed access to Classified information or Controlled Unclassified Information (CUI), which includes International Trafficking in Arms Regulations (ITAR) or the Export Administration Regulations (EAR) defense articles unless they the mitigation requirements of DoD 5220.22M w/change 2 National Industrial Security Program Operating Manual (NISPOM) and AR 380-49 Chapter 2 Section I and II.

SUBCONTRACTOR MANAGEMENT:

The Prime Contractor is responsible for issuing all subcontractor DD Form 254 for any classified work or material that the subcontractor will have access to during this contract per DoD 5220.22M and AR 380-49.

a. The Prime Contractor FSO will sign DD Form 254, block 17h and ensure that program, and/or Army activity points of contact information are included on DD Form 254, block 13.

b. The Prime Contractor FSO will provide the KO and/or COR with a copy of all subcontract DD Form 254s to be attached to the prime contract. The KO and/or COR will provide a copy of all subcontract DD Form 254’s to the ISS and DSS.

c. The Prime Contractor shall develop a Technology Control Plan (TCP) which should state how they will safeguard and control government Technical Data and information provided to subcontractors.

Contractors who work in a DoD or Contractor cleared facility on DA installations and/or Government leased facilities and who are embedded or integrated within a DA program or activity, shall report all adverse information, suspicious contacts, and other reportable incidents to the local security office.

The Contractor and its subcontractors shall immediately report any loss, compromise, suspected compromise of classified information or any security violations which occur on this contract per DoD 5220.22M with current changes, to their Facility Security Manager (FSO) and local DSS office. The contractor shall also inform the KO, COR, and the ISS.

TRAINING REQUIREMENTS:

The Contractor and its subcontractors shall ensure that all contract employees with security clearances meet the prescribed security training required by chapter 3 of DoD 5220.22M and Chapter 2 of AR 381-12. New contractor personnel assigned duties related to the contractor shall receive training within 30 days on their assignment.

The Contractor and its subcontractors shall ensure that all contract employees with security clearances meet the annual security training required by DoD 5220.22M, NISPOM AR 380-5 and Chapter 2 of AR 381-12, including, when applicable:

· AT Level 1 Training

· AT Awareness Training for Contractor Personnel Traveling Overseas

· iWATCH Training

· Insider Threat Training

· Security Refresher Training

· Information assurance (IA)/information technology (IT) Training

· TARP Training

· OPSEC Training

New contractor personnel assigned duties related to the contractor shall receive training within 30 days on their assignment.

DISSEMINATION CONTROL:

The Contractor is not authorized to disclose or release Classified information to the public. Disclosure or release is not authorized to other DoD organizations or agencies without review and written approval from the Requiring Activity KO, COR, Cognizant Security Office.

The Contractor is not authorized to disclose or release CUI, Controlled Technical Information (CTI), or Critical Program Information (CPI) pertaining to this contract to the public without prior review and approval from the government Public Affairs Officer, Requiring Activity KO, COR, and Cognizant Security Office. Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 12 of DD Form 254.

The Contractor is not authorized to disclose or release Classified information, CUI, CTI, or CPI pertaining to this contract to any Foreign Nationals or Foreign Representatives without prior review and approval from the government Contracting Officer (KO), Contracting Officers Representative (COR) and Requiring Activity Cognizant Security Office, Foreign Disclosure Officer (FDO). Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 17a of the DD Form 254.

The Contractor and subcontractors shall ensure that all Classified information, CUI, CTI, or CPI documents, data, and/or export controlled information is marked, handled, disseminated, and safeguarded with the appropriate security classification, distribution statement(s), and export control warning statement in accordance with Executive Order 13556 (“Controlled Unclassified Information”), 32 CFR Section 2002.4, DoDIs 5200.48, 8500.01, 8510.01 and 8582.01, DoDD 5230.24, DoD 5220.22-M, and AR 380-49 Chapter 2 Section I and II.

The Contractor may disseminate authorized CUI to its employees and subcontractors who have an authorized lawful government purpose, which includes any activity, mission, function, operation, or endeavor that the U.S. Government authorizes or recognizes as within the scope of its legal authorities or the legal authorities of non-executive branch entities (such as state or local law enforcement). The Contractor must ensure employees and subcontractors are aware of the special handling instructions detailed below.

During working hours, CUI shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms must provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

All public release of information shall require authorization from the Government in writing, however all information CUI or higher will be cleared IAW Section 12 of the DD Form 254. All information gathered by the Contractor to provide services to the U.S. Government shall be considered contractually sensitive and shall not be released to any person or organization not part of the U.S. Government, and shall become the property of the U.S. Government.

TRANSMITTAL: Authorized holders may send CUI via U.S. Postal Service (USPS) or any commercial delivery service to authorized recipients in accordance with CFR 32, Section 2002.14. DoD components, officials of DoD components, and authorized DoD contractors, consultants, and grantees may use interoffice or interagency mail systems to transport CUI to each other to conduct official DoD business. Authorized holders should tell recipients the status of such information, and send the material in a way that prevents unauthorized public disclosure, including using tracking and accountability tools. Authorized holders must mark packages that contain CUI according to CUI marking requirements, and make sure documents that transmit CUI material call attention to any CUI-marked attachments. Authorized holders may send CUI records over facsimile equipment. To prevent unauthorized disclosure, consider attaching special cover sheets, the location of sending and receiving machines, and whether authorized personnel are around to receive CUI. Use applicable CUI markings and tell the recipient the information is exempt from public disclosure under the FOIA and requires special handling.

REPRODUCTION: Authorized holders may reproduce (e.g., copy, scan, print, electronically duplicate) CUI in furtherance of a lawful Government purpose in accordance with CFR 32, Section 2002.14. Authorized holders must ensure, when reproducing CUI material on equipment such as printers, copiers, scanners, or fax machines, that the equipment does not retain data or the agency must otherwise sanitize it in accordance with NIST SP 800-53.

DISPOSITION: When no longer needed, CUI must be destroyed in accordance with CFR 32, Section 2002.14. Destroying CUI in electronic form requires the authorized holder to do so in a manner that makes the data unreadable, indecipherable, and irrecoverable. The method of destruction is determined by law, regulation, or Government-wide policy. If the authority does not specify a destruction method, Contractor must confer with the COR who will refer to NIST SP 800-53 and NiST SP 800-88 for guidance.

UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of CUI does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of CUI protected by the Privacy Act may result in criminal sanctions and disciplinary action may be taken against those responsible.