Attachment 7 SCI ADDENDUM TO DD FORM Force Readiness.pdf

ADDENDUM TO DD FORM 254 (Block 10e (1)) SENSITIVE COMPARTMENTED INFORMATION (SCI) CLAUSES As of January 2021

Supporting SSO:

Office Symbol:

Address:

Phone Number:

Contract #:

Company Name:

Expiration Date:

SCI COR/CM:

Office Symbol:

Phone Number:

1. Reference Block 14: This contract requires access to Sensitive Compartmented Information (SCI). The following references (use current versions) are offered to provide the necessary guidance for physical, personnel, information, and information systems security measures and is part of the SCI security specifications for the contract:

National Security Act of 1947, as amended; Executive Order (EO) 12333, as amended; EO 13526; EO 13549; EO 12829; EO 12968, as amended; 32 CFR Part 2001; 32 CFR Part 2003, 32 CFR Part 2004; and other applicable provisions of law; AFI 16-1404; DoDM 5400.07; DoD Manual 5105.21, Volumes 1 -3; DoDI 5200.48 AFMAN 14-403; AFMAN 14-401; 5220.22-M (NISPOM and Supplement); ICD 701, ICD 702, ICD 703, ICD 704/ICPGs

704.1. ICPG 704.2, ICPG 704.3, ICPG 704.4, ICD 710, ICD 705, ICS 705-1; ICD 503 and related NIST/CNSSI guidance for Risk Management Framework, and the ICD 503 Practitioner Manual;(this defines the RMF, Reciprocity, Roles & Responsibilities and each of the 6 steps of RMF), CNSS policies and instructions, as applicable; National Counterintelligence and Security Center IC-Tech-Specs for Construction and Management of SCIFs.

2. SCI will not be released to contractor employees without the specific release approval by the originator or designated authority of the material as outlined in the governing directives and based on prior approval and certification of “need-to-know” by the SCI Contracting Officer’s Representative (COR) or Contract Monitor (CM), identified above.

3. Names of contractor personnel requiring access to SCI and justification for SCI positions will be submitted for coordination and action to the supporting SSO after the COR/CM approval/concurrence. Upon receipt of written approval from the COR/CM, the Facility Security Officer (FSO) and/or Contractor Special Security Officer (CSSO) may submit the necessary forms to Defense Security Service (DSS) for a Tier 5 investigation for those personnel nominated for SCI access in accordance with the National Industrial Security Program Operating Manual (NISPOM). The FSO/CSSO will monitor the approved system of record for status changes affecting adjudication and eligibility for personnel under their cognizance and notify the SSO when changes are noted.

4. This contract will require _____ SCI positions in order to fulfill contractual obligations incurred. SCI access is subject to U.S. Government review and approval as outlined in the aforementioned SCI security guidance. Upon completion or cancellation of the contract, the SSO/CSSO will debrief all personnel not required for contract closeout and those positions will be disabled.

N/A when Controlled Unclassified Information (CUI) is not applicable Controlled by:

Controlled by:

CUI Category:

Distribution/ Dissemination Controls Point of Contact (POC):

5. The SSO/CSSO must restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract. Further dissemination to other contractors, sub-contractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the releasing agency.

6. SCI materials furnished in support of this contract remain the property of the DoD department or command that released it. Upon completion or cancellation of the contract, all SCI materials furnished will be returned to the direct custody of the originator of the materials or the COR.

7. Classified foreign intelligence materials must not be released to foreign nationals or immigrant aliens whether or not they are also consultants, US contractors, or employees of the contractor, regardless of the level of their security clearance, except with advanced written permission from the originator.

8. The CSSO must not reproduce classified foreign intelligence without advance approval of the releasing agency.

If permission is granted, each copy will be controlled in the same manner as the original. The CSSO must not destroy any classified foreign intelligence without advance approval of the releasing agency.

9. Contractor personnel must maintain accountability for all intelligence (to include foreign intelligence) materials released to their custody.

10. Inquiries pertaining to classification guidance on SCI will be directed to the COR listed above. SCI security management issues shall be directed to the supporting SSO, identified at the top of this document.

11. All DD Form 254s prepared for subcontracts involving access to SCI under this contract must be forwarded to the COR for approval and then to the servicing SSO for review and concurrence prior to award of the subcontract.

Inquiries pertaining to classification guidance on SCI will be directed to the COR listed above. SCI security management issues shall be directed to SSO office listed above.

12. Ref Item 11i: Emanations security (aka TEMPEST) requirements apply to the SCIF execution location. See Defense Federal Acquisition Regulation Supplement (DFARS) Clause 252.239-7000, Protection Against Compromising Emanations, dated 25 June 2004, revised 10 January 2008; Intelligence Community (IC) Tech Spec-for ICD/ICS 705, Technical Specifications For Construction and Management of Sensitive Compartmented Information Facilities; Committee on National Security Systems Advisory Memorandum(CNSSAM) TEMPEST/01-13, Red/Black Installation Guidance, dated 17 January 2014.

13. If SCI access is for meeting, conferences, demonstrations, etc. ONLY check box and skip para 14.

14. An SCI Facility (SCIF) meeting the physical security requirements outlined in ICD 705 is required for this contracting effort. All SCI used for this contract shall be stored, handled, and maintained in an accredited SCIF, be it the local contractor SCIF or similarly SCI- accredited facilities used by the contractor. If the contractors' place of performance is in a SCIF, or if they are accessing an SCI IT system, or generating SCI in any format, the places of performance will be identified in the DD 254 item 8a and listed on this form. List the address for SCIF execution below in the following format:

(CUI) Office Symbol and/or Company Name; Street Address, Bldg#, City , State, Zip Code; SCIF ID Number(s); SSR/ CSSO Name, Phone Number **NOTE: CUA/JUA REQUIRED FOR NON AF SCIFs. DOCUMENT IS CUI WHEN SCIF LOCATION IS

IDENTIFIED. MARK DOCUMENT ACCORDINGLY**

Phone: SCI requirements reviewed and approved by:

(SSO WPAFB)

Continuation Block

15. For contract work within an approved contractor facility, all SCI information systems will be accredited and authorized following the Risk Management Framework (RMF), IAW ICD 503 and the ICD 503 Practitioners Manual. All SCI systems will be accredited through the Designated Authorizing Official using the XACTA system. These are processed through the Command CISO at HQ AFMC/A2S to the AF IC AO (AF Intelligence Community Authorizing Official). Other applicable policy as directed by DIA, ODNI, or HQ AFMC shall apply. This includes all electronic connectivity and electronic methods for storing and communicating within and outside the SCIF.

16. Other networks processing corporate unclassified, SIPRNET, or other collateral information will follow the cognizant authority policy requirements. Prior authorization by a cognizant authority must be obtained prior to operation.

Non-AF SCI systems must be accredited by the designated authority and may require a CUA/JUA for operation in DIA facilities.

17. Reference DD254 Block 15: This contract requires access to SCI. If the contractor has established a SCIF, DIA and its designees are responsible for all inspections of the contractor SCIF and SCI security management for ensuring compliance related to SCI security regulations and policies. The supporting SSO maintains security cognizance for all SCI requirements on this contract. Inspections of the SCIF(s) will be conducted by the Intelligence Community accrediting agency who approved the SCIF or their delegated official. The Defense Counterintelligence and Security Agency (DCSA) is relieved of security oversight for SCI performance.

18. Visits. The contractor will submit the written request for SCI visit certifications through the COR/CM for approval of the visit. The certification must arrive at their servicing SSO at least three working days prior to the visit.

19. This contract requires that the contractor requires courier authorization in order to transport classified materials between work locations. This authorization is based on duty location and distance and will be processed IAWDODM

5105.21 V1. Check here:

(CUI) 711 HPW/RHW, 2620 Q St, Bldg 852, WPAFB, OH 45433, SCIF ID Number: AF-10-068, SCIF POC: Michael Ervine, 711 HPW/OMSS, (937) 904-8832