Attachment 8 DD254 Addendum.pdf

FA8201-20-R-0007 Hill AFB Information Technology Consolidated Contract (ITCC) Attachment 8 DD254 Addendum

AFFARS 5352.204-9000, NOTIFICATION OF GOVERNMENT SECURITY ACTIVITY AND

VISITOR GROUP SECURITY AGREEMENTS (APR 2003) ADDENDUM

Solicitation FA8201-20-R-0007 Hill AFB Information Technology Consolidated Contract (ITCC)

1. This contract contains a DD Form 254, DOD Contract Security Classification Specification, and requires performance at a government location in the U.S. or overseas. Prior to beginning operations involving classified information on an installation identified on the DD Form 254, the contractor shall take the following actions:

a. At least 30 days prior to beginning operations, notify the Cognizant Security Office/s (IP Office/s) shown in block 8.c and Program Manager shown in block 13 of the DD Form 254 as to:

(1) The name, address, and telephone number of this contract company’s representative and designated alternate in the U.S. or overseas area, as appropriate;

(2) The contract number;

(3) The highest classification category of defense information to which contractor employees will have access;

(4) The Air Force installations in the U.S. (in overseas areas, identify only the APO number(s)) where the contract work will be performed;

(5) The date contractor operations will begin on base in the U.S. or in the overseas area;

(6) The estimated completion date of operations on base in the U.S. or in the overseas area; and,

(7) Any changes to information previously provided under this clause.

This requirement is in addition to visit request procedures contained in DOD 5220.22-M, National

Industrial Security Program Operating Manual.

b. Prior to beginning operations involving classified information on an installation identified on the

DD Form 254 where the contractor is not required to have a cleared facility, the contractor shall enter into a Visitor Group Security Agreement (or understanding) with the installation commander to ensure that the contractor’s security procedures are properly integrated with those of the installation. As a minimum, the agreement shall identify the security actions that will be performed:

(1) By the installation for the contractor, such as providing storage and classified reproduction facilities, guard services, security forms, security inspections under DOD 5220.22-M, classified mail services, security badges, visitor control, and investigating security incidents; and

(2) Jointly by the contractor and the installation, such as packaging and addressing classified transmittals, security checks, internal security controls, and implementing emergency procedures to protect classified material.

https://org.eis.afmc.af.mil/sites/75ABW/IP/IndustrialSecurity/default.aspx

Operations Security (OPSEC) Reference: National Security Decision Directive (NSDD) 298

DOD 5205.02

DODD 5205.02E

AFI10-701AFGM_2018-01

All contractors, subcontractors, their employees, associates, and consultants who have access to critical information must comply with the DOD and Air Force-sponsored Operations Security

(OPSEC) program. The OPSEC Program is directed by NSDD298, DOD Publications, and applicable Air Force guidance.

OPSEC is a systematic means of identifying and protecting information, which an adversary could use to their advantage or to our disadvantage. Critical Information (CI) is generally unclassified but can become classified through compilation. This sensitive information has been identified by the organization’s OPSEC program as requiring protection. OPSEC Measures (OM) are control standards with which all personnel must comply in order to protect CI against adversaries.

RESPONSIBILITIES:

The 75 ABW/SC OPSEC Program Coordinator, Carl D. Bortz, will provide / approve

OPSEC training curriculum for use by the contractor. Critical Information and Indicator Listings

(CIILs) will be protected by all contract personnel. Approved organizational OPSEC measures will be used by all contract personnel to protect critical information in their possession and protect against current foreign intelligence and industrial espionage threats. The OPSEC PM/Coordinator and the

Lead contractor must ensure all contract personnel working on the contract or having access to CI attend initial and annually recurring refresher training and that the approved curriculum is presented.

Training will be provided before contract personnel are allowed access to or handling of critical information. All contract personnel will comply with the organizations OPSEC standards and practices as trained. Additional training may be required based on updates to critical information, OPSEC measures, intelligence threat/vulnerability, or other fundamental changes to the OPSEC program. The OPSEC Coordinator is responsible for contacting the OPSEC Program Manager if

OPSEC isn’t written into the contract.

The OPSEC PM/Coordinator for the organization will track OPSEC training statistics for all personnel working on the contract, when each individual has received the required OPSEC training, and when refresher training is due. Forward training statistics to the installation OPSEC PM at the end of each calendar quarter and/or upon request. The OPSEC Coordinator will provide a copy of the 75 ABW OPSEC Plan to the contractor upon request and the contractor is subject to the requirements of that plan. The 75 ABW OPSEC Plan is “for official use only” and distribution outside the constraints of the contract in part or in its entirety is prohibited. Upon completion of the contract, the contractor will destroy the OPSEC Plan by shredding the document so that it cannot be reconstructed and deleting any electronic copies.

Contactors with OPSEC requirements within a contract must ensure employees receive

OPSEC training as specified within the contract. Accomplishment of training must not exceed 90 days from initial assignment to a contract with OPSEC requirements. Annual training will be accomplished NLT 30 September of each year. The contractor personnel will not be given access to an organization’s CIIL until after training has been completed and documented by the organization

OPSEC Coordinator.

Prior to seeking approval through Hill AFB Public Affairs, any information to be released outside of official U.S. Government channels, via any media, must be approved through an OPSEC review by the 75 ABW/SC Coordinator. All personnel must promptly report OPSEC related incidents, issues, and concerns to the 75 ABW/SC Coordinator, (801) 586-6633 who will then report it to the installation PM, 801-586-8008.