Attachment 6 SECURITY REQUIREMENTS FOR CONTRACTORS REQUIRING CLASSIFIED INFORMATION.docx

ATTACHMENT (6)

SECURITY REQUIREMENTS FOR CONTRACTORS REQUIRING

ACCESS TO CLASSIFIED INFORMATION

1. Security Facility Clearance Requirements. The contractor must possess or obtain an appropriate facility security clearance (Top Secret, Secret, or Confidential) prior to performing work on a classified government contract. If the contractor does not possess a facility clearance the government can sponsor the application for an FCL. The contractor shall notify the Security Manager (SM) at each operating location 30 days before on-base performance of the service. The notification shall include:

a. Name, address, and telephone number of company representatives.

b. The contract number and contracting agency.

c. The highest level of classified information which contractor employees require access to.

d. The location(s) of service performance and future performance, if known.

e. The date service performance begins.

f. Any change to information previously provided under this paragraph.

2. Personnel Security Clearance Requirements. Personnel will require a (Top Secret or Secret) security clearance to perform this contract and reflect so in the DD 254. The contractor shall request security clearances for personnel requiring access to classified information within 15 days after receiving a facility clearance or, if the contractor is already cleared, within 15 days after service award.

a. Contractor personnel shall successfully complete, as a minimum, a National Agency Check with Law and Credit (NACLC), before operating government furnished computer workstations or systems that have access to Navy e-mail systems. These investigations shall be submitted by the contractor. The contractor shall comply with the DoD 5200.2-R, Personnel Security Program and SECNAV M-5510.30 Personnel Security Program, requirements.

3. Visit Request. Contractors participating in the National Industrial Security Program are required to use Joint Personnel Adjudication System (JPAS) in lieu of sending Visitor Authorization Letters (VALs) for classified visit to Department of Defense facilities and military installations.

4. Contractor Security Representative (CSR) Appointment. The contractor shall appoint a CSR for the on base long-term visitor group and provide to the Navy Command’s Security Manager (CSM) and the Contracting Officer, in writing, the name, title, address and phone number for the CSR. The CSR may be a full-time position or an additional duty position. The CSR shall coordinate security training with the CSM and provide contractor employees with training required by DoD 5200.1-R, Information Security Program Regulation and SECNAVM 5510.36, Information Security Program. The contractor CSR/FSO shall provide initial and follow-on training to contractor personnel who work in Navy controlled/restricted areas. SWFLANT restricted and controlled areas are explained in SWFLANTINST 5530.7 Series Consolidated Directive Manual.

5. Obtaining and Retrieving Identification Media. As prescribed by the SWFLANTINST 5530.7 series, the contractor shall comply with the following requirements:

a. The contractor shall obtain base identification and vehicle passes for all contractor personnel who make frequent visits to or perform work on the Navy installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished identification badges above the waist unless safety is an issue while visiting or performing work on the installation.

b. During performance of the contract, the contractor shall be responsible for obtaining required identification for newly assigned personnel and for prompt return of credentials for any employee who no longer requires access to the area.

c. Upon completion or termination of the service or expiration of the identification passes, the contractor shall ensure that all base identification passes issued to contractor employees are returned to the SWFLANT security office. The SWFLANT security office will verify all base identification passes have been returned and/or accounted for.

6. Visitor Group Security Agreement (VGSA). The contractor shall enter into a long-term visitor group security agreement for contract performance on base. This agreement shall outline how the contractor integrates security requirements for contract operations with the Navy to ensure effective and economical operation on the installation. The agreement shall include:

a. Security support provided by the Navy to the contractor shall include storage containers for classified information/material, use of destruction equipment, classified reproduction equipment, use of classified mail services, security badging, base visitor control, investigation of security incidents, base traffic regulations and the use of security forms and conducting inspections required by DoD 5220.22-R, Industrial Security Regulation, DoDM-5200.01, Vol 1-4, Information Security Program, and SECNAV M-5510.36, Information Security Program.

b. Security support requiring joint Navy and contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks and internal security controls for protection of classified material and high-value pilferable property.

c. On base, the long-term visitor group security agreement may take the place of a Standard Practice Procedure (SPP).

7. Unescorted Entry to Restricted Areas. Prior to being issued a SUBASE badge, the contractor shall fill out all appropriate paperwork and follow all procedures to gain access to SUBASE. Once it has been established that the contractor can access SUBASE, the contractor shall submit a NACI (Standard Form SF85 and fingerprints) electronically via EQIP. This process shall be started and completed through SWFLANT SPK-52 Security Management Office. Once SF-85 is open in JPAS, temporary unescorted access may be granted for up to 90 days, or a favorable adjudication has been received. At which time, permanent unescorted access may be granted.

8. Computer Security Requirements. The contractor shall comply with SECNAV 5239 series and SWFLANTINST 5239 series when operating government computer workstations or systems. In addition to the above guidance, contractors processing classified information on government computer workstations or systems will comply with DoD M5200.01, Vol 1-4, Information Security Program, and SECNAV M-5510.36, Information Security Program.

9. Physical Security. Areas operated by contractor employees shall comply with base Operations Plans/instructions for FPCON procedures, Random Antiterrorism Measures (RAMS) and local search/identification requirements. The contractor shall safeguard all government property including controlled forms provided for contractor use. At the close of each work period, government training equipment, ground vehicles, facilities, support equipment, and other valuable materials shall be secured.

10. Controlled/Restricted Areas. The contractor shall implement local base procedures for entry to Navy controlled/restricted areas where contractor personnel will work.

Contractor personnel requiring unescorted entry to controlled or restricted areas designated by the installation commander shall comply with base access requirements.

11. Wireless Electronic Devices: No government, personal, or contractor cell phones, camera cell phones, cordless telephones, or wireless microphones, keyboards, or mice, wireless or Infrared Local Area Networks (LANs), or devices are allowed in areas where classified information is discussed, briefed, or processed. All other wireless Commercial Mobile Devices (CMD’s) not specifically addressed above, that are used for storing, and processing, and/or transmitting information shall not be operated in any SWFLANT building unless authorized by SWFLANT Commanding Officer.

12. Cellular Phone Operation Policy: Operators of government-owned and leased vehicles on or off base (including rental cars while on temporary additional duty) shall not use cell phones or other hand-held electronic devices unless the vehicle is safely parked, except for fire and emergency response or law enforcement/security purposes. POV operators may use Bluetooth (excluding in/over the ear), On-Star or other built in wireless technology. Additionally, the wearing of any portable headphones, earphones, or other listening devices while operating a motor vehicle is prohibited.

13. Operating Instructions. The contractor will adhere to the Navy activity Operating Instructions for internal circulation control, protection of resources and to regulate entry into Navy controlled areas during normal, simulated and actual emergency operations.

14. Key Control. The contractor will adhere to the Navy activity Operating Instructions control procedures to ensure keys issued to the contractor by the government are properly safeguarded and not used by unauthorized personnel. The contractor shall not duplicate keys issued by the government. All government issued keys will be turned in at the end of employment or contract.

15. Lost Keys. Lost keys shall be reported immediately to the CSR/FSO and the Navy activity that issued the keys. The government replaces lost keys or performs re-keying. The contractor will be required to complete a lost key report.

16. Government Authorization. The contractor shall ensure its employees do not allow government issued keys to be used by personnel other than current authorized contractor employees. Contractor employees shall not use keys to open work areas for personnel other than contractor employees engaged in performance of duties, unless authorized by the SWFLANT Security Manager.

17. Security Combinations. Combinations to security containers, secure rooms, or vaults are classified information and must be properly safeguarded. Only contractor employees, who have the proper security clearance and need-to-know, will be given combinations to security containers, secure rooms, or vaults. Contractor employees are responsible for properly safeguarding combinations. Contractor employees will not record security containers, secure rooms, or vaults combinations. All SF-700’s will be maintained by the SFLANT Security Office.

18. Freedom Of Information Act Program (FOIA). The contractor shall comply with DoD Regulation 5400.7-R, DoD Freedom Of Information Act Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding For Official Use Only (FOUO) material.

19. Traffic Laws. The contractor and their employees shall comply with base traffic regulations.