ATTACHMENT C - Draft DD254 Security Continuing Pages.pdf

UNCLASSIFIED

Security Continuation Pages Contract Number: (APR # 221-0002-25-Z) HHM402-TBD

(Version 7a, Jan 2022) Previous versions are obsolete

Baseline Security Classification Guidance (SCG): Shall be provided by the COR as required.

1a. The Contractor will be required to possess and maintain a Top-Secret Facility clearance granted by the Defense Counterintelligence Security Agency (DCSA) prior to contract implementation and maintained throughout the life of the contract.

2a/7a - SUB-CONTRACT Procedures:

COR shall provide this office the company name and CAGE Code prior to award to validate facility clearance and level of safeguarding, if required. All security requirements levied upon the prime contractor and/or otherwise associated with this contract shall immediately be flowed down from the prime contractor to any sub-contractor (or from sub-contractor to a lower tier sub-contractor (2d Tier), regardless of the scope of any such participation should it require access to classified information or unescorted access to controlled space where classified information (regardless of media) and/or hardware is open-stored, generated or otherwise accessible.

The Notification of Intent (NOI) letter is not required at the time of award of contract when all subcontractors have been identified at the solicitation phase. Prime contractor should notify the COR, when there is a need to modify the original DD254. The COR will create a revision to the prime DD254 and complete the NOI letter. The NOI must include the original subcontractors and any other subcontractor(s) being added/removed. The NOI must be signed by the contracting officer. Upon approval send the DD254, the Security Continuation Pages (SCP) and approved NOI to the Industrial Security Office either by CMS, or group email accounts. Upon approval of the DD254, it will be returned to the COR to distribute to the prime contract company.

8a. /11a. Contract performance and access to classified information and or equipment is restricted to the Top-Secret level and is to be performed at Cape Canaveral facilities.

Unclassified contract support is authorized at the contract facility.

The contractor (TBD Enter Company Name) Facility Security Officer (FSO) on file with DCSA is: (TBD Enter name and phone number, and email address of FSO) If this information is not correct, the contractor must contact the DCSA Field Office identified in Block 6c, and update contractor information as applicable.

10a. COMSEC is the protective measures taken to deny unauthorized persons information derived from USG telecommunications relating to national security and to ensure the authenticity of such communications. Access to COMSEC material is restricted to US citizens holding a final US Government security clearance. Such information is not releasable to personnel holding only reciprocal clearance. The NOI letter is required from the Government Contracting Agency to grant COMSEC access to a Sub-contractor.

Contractor must comply with DIA/CIO guidelines. The NSA Central Office of Record has primary responsibility for COMSEC.

10b. Restricted Data. Contractor personnel must have a final ‘Q’ clearance issued by the DOE prior to access. DOE may require a 'Q' facility clearance or equivalent. Restricted Data (RD) is data concerning (1) design, manufacture, or utilization of atomic weapons; (2) the production of special nuclear material; or (3) the use of special nuclear material in the production of energy, but does not include data declassified or removed from the RD category pursuant to section 142 of the AEA.

Department of Defense Unclassified Controlled Nuclear Information (DOD UCNI) is information that has been determined that the unauthorized dissemination of such information could reasonably be expected to have a significant adverse effect on the health and safety of the public or the common defense and security by significantly increasing the likelihood of the illegal production of nuclear weapons or the theft, diversion, or sabotage of DOD Special Nuclear Material (SNM), SNM equipment, SNM facilities, or nuclear weapons in DOD custody. Any possible compromise of DOD UCNI shall be immediately reported to the DIA COR.

10c. CNWDI Access. Contractor personnel must have a final ‘Q’ clearance issued by the DOE and may require a 'Q' facility clearance or equivalent. CNWDI is a DOD category of classified information that reveals the theory of operation or design of the components of a thermonuclear or fission bomb, warhead, demolition munition, or test device. Specifically excluded is information concerning arming, fusing, and firing systems; limited life components; and total contained quantities of fissionable, fusionable, and high explosive materials by type. Among these excluded items are the components that DOD personnel set, maintain, operate, test or replace. Any possible compromise of DOD UCNI shall be immediately reported to the DIA COR.

Department of Defense Unclassified Controlled Nuclear Information (DOD UCNI) is information that has been determined that the unauthorized dissemination of such information could reasonably be expected to have a significant adverse effect on the health and safety of the public or the common defense and security by significantly increasing the likelihood of the illegal production of nuclear weapons or the theft, diversion, or sabotage of DOD Special Nuclear Material (SNM), SNM equipment, SNM facilities, or nuclear weapons in DOD custody.

10d. Formerly Restricted Data. Contractor personnel must have a final ‘Q’ clearance issued by the DOE and may require a 'Q' facility clearance or equivalent.

10e. (1) See attached SCI Release of Intelligence Information for additional security requirements. Access to intelligence information requires Sensitive Compartmented Information (SCI) indoctrination and a final Top Secret U.S. Government clearance. Contract personnel will require access to ICD 703 “Protection of Classified National Intelligence up to the SCI. For SCI Requirements: The contractor must provide individuals who are able to achieve and maintain the adjudicative standards set forth in the Intelligence Community Directive (lCD) Number 704 "Personnel Security Standards and Procedures Governing Eligibility For Access to SCI and other Controlled Access Program Information," for continued employment. See DIA Security Requirements paragraph 1.8 for polygraph requirements.

10e. (2) See attached non-SCI (also known as collateral) Release of Intelligence Information for additional security requirements.

Contractor will require access to lCD 710 "Classification and Control Markings System" (11 SEP 2009)'' For Non-SCI Requirements:

Secret or Top Secret: All contract personnel assigned under this contract must possess and maintain a current personnel security clearance of Top Secret in accordance with acquisition document (SOW, PWS or SOO). Personnel are required to sign a non-disclosure statement. No polygraph is required for non-SCI contractors.

10f. The DIA Special Access Program (SAP) Program Manager (or appropriate User Activity) is responsible for contractor access for DIA SAP material. Access to SAP Information requires a final U.S. Government clearance at the appropriate level or as identified by the SAP Manager for each appropriate SAP. The contractor must coordinate with SAP Program Manager, through the CO/COR, prior to access. They must adhere to the special access requirements/procedures developed by the SAP Office of Primary Responsibility. SAP information/material will be processed IAW DODM 5205.07 (series), Volumes 1-4, and affiliated Service/Agency Regulations. SAP Program Manager must approve all such accesses. If a SAP sub-contract is awarded, it is the prime contractor’s responsibility to incorporate the additional security requirements in the sub-contract. Authority for access must be obtained from the DIA SAP Program Manager when the Need-to-Know is established and required to accomplish the required efforts under this contract. All SAP material remains the property of the releasing Government User Agency. Upon completion or cancellation of this contract, SAP materials previously furnished will be returned to the direct custody of the appropriate Special Access Program Central Office (SAPCO), to include final reports produced at the SAP level. The SAP Program Manager will provide security classification guidance for the performance of the contract. Contractor personnel must adhere to the special access requirements/procedures developed by the SAP program manager.

10g. Access to NATO material will be required for reference at the Government, or appropriately cleared contractor's facility. Access requires a final U.S. Government security clearance. Contractor personnel who require access to NATO Material, shall be briefed by the Government Contracting Agency. The Prime Contractor must receive approval from the Government Contracting Agency to grant NATO access to a sub-contractor. Contractor personnel shall be debriefed by the Government Cognizant Agency prior to departure from this contract. A NOI letter must be approved for sub-contracting.

10h. Foreign government information (FGI) is information that is (1) provided to the US by a foreign government or governments, an international organization of governments, or any element thereof with the expectation, expressed or implied, that the information, the source of the information, or both, are to be held in confidence; or (2) Produced by the US pursuant to, or as a result of, a joint arrangement with a foreign government or governments, an international organization of governments, or any element thereof, requiring that the information, the arrangement, or both are to be held in confidence. Prior approval from the Contracting Officer Representative is required for access to (FGI) for the performance of this contract. FGI must be protected at the equivalent level provided to similar categories of U.S. government information or as specified by the foreign government in written government-to-government agreements. An NOI letter must be approved for sub-contracting.

10i. Alternative Compensatory Control Measures (ACCM): During the course of the execution of duties while assigned to DIA, individuals assigned to this contract may require access onsite to Alternative Compensatory Control Measures (ACCM) information as determined by the COR and local ACCM control officer.

10j. Controlled Unclassified Information (CUI): The Contractor is authorized and may have access to UNCLASSIFIED information/material identified as Controlled Unclassified Information (CUI). The contractor is prohibited from further disclosure/dissemination of this information without the expressed written authorization of DIA. CUI provided under this contract shall be safeguarded as specified in NIST Special Publication 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, February 20, 2020", and may be supplemented by DIA. Information marked with legacy CUI markings (e.g., “For Official Use Only” (FOUO)) shall be protected to the same standard as stipulated for CUI at the moderate confidentiality level in the referenced NIST Special Publication. In addition, contractors or sub-contractors must obtain written approval from DIA CO/COR or DIA Office for Congressional and Public Affairs (CP) prior to posting any unclassified information on any web site or the internet. This will also apply to any acknowledgement of association between the contractor/sub-contractor and DIA.

10k. OTHER INFORMATION:

a. All unclassified DOD information in the possession of non-DOD entities on non-DOD information systems shall be protected in accordance with DODI 8582.01.

b. Hand Carry Authorization: Contract personnel, designated by the COR, may occasionally hand carry classified material to and from designated facilities (Government and or Contract), possessing the clearance levels commensurate or higher of the classified level of material in connection with a classified visit or meeting. The classified material remains in the personal possession of the hand carrier except for authorized overnight storage. The COR shall complete and submit the DIA Form 386 along with the MyHR Form to the SSO, identifying contract requirement for personnel to transport classified information and or equipment. A courier briefing is required for contract personnel and acknowledge his/her understanding of courier responsibilities prior to the issuance of DIA Courier Card.

11c. Authorizes the contractor to receive and/or generate classified information under this contract. The classified information is the property of the U.S. Government regardless of proprietary claims. Upon completion or termination of this contract, the U S.

Government will be contacted for destruction or disposition instructions. Derivative classifications must be derived from existing classification source documents. The contractor cannot act as an Original Classification Authority. The contractor is not authorized to release U.S. Government classified material to any activity or person, including sub-contractors without a signed Notice of Intent (NOI) letter, signed by the contracting officer.

11d. Classified hardware will consist of servers, printers, networking components, and workstations to support development, analysis, testing and production within the contractor's secure facility.

11f. Contractor and its sub-contractors, when performing or traveling outside the United States (OCONUS) under this contract shall:

1. Affiliate with the Overseas Security Advisory Council.

2. Ensure personnel who are in-country on a non-transitory basis, register with the U.S. Embassy, and contractor and sub-contractor personnel who are third country nationals comply with security related requirements of the Embassy of their nationality;

3. Obtain and comply with the most current antiterrorism/force protection guidance.

4. Approved overseas location of performance are designated by the COR based upon operational requirements.

11g. The Defense Technical Information Center (DTIC) is the largest central resource for DOD and government-funded research, development, technical, and engineering information.

1. Technical information on file at the Defense Technical Information Center (DTIC) will be available to the contractor if the contractor requires such information. The contracting officer will certify the field of interest relating to the contract

2. Contractor must prepare and forward DO Form 1540 and DO Form 2345 to the COR for authorization BEFORE the service may be requested.

11h. COMSEC Account.

The contractor must store accountable COMSEC information at their cleared facility in the performance of a contract. Contractor must forward request for COMSEC material/information through the Contracting Officer Representative.

(1) If non-accountable COMSEC information is involved, do not check this item.

(2) Accountable COMSEC material includes COMSEC aids and equipment which have the purpose to secure telecommunications or to ensure authenticity of such communications to include COMSEC key, CCI, in-process items that describe cryptographic logic and other items which perform COMSEC functions. This material must be controlled within the COMSEC Material Control System (CMCS) or an in-process accounting system.

(3) Non-accountable COMSEC material includes COMSEC equipment or aids that are not controlled within the CMCS or an in-process accounting system but may require control within a document control system.

11j. Operations Security (OPSEC):

a. The contractor will protect DIA information from adversarial exploitation of vulnerabilities identified during implementation of OPSEC Measures. The DOD and DIA policies and procedures described below provide details towards OPSEC Measures, the requirements below provide the minimum standards for OPSEC protection as directed in this contract.

b. The contract Program Manager (PM), Contracting Officer Representative (COR), Facility Security Officer (FSO), and contracted personnel will be familiar with OPSEC as descried in DODD 5205.02E, DODM 5205.02, and DIAD 5800.100. Other policies and procedures may apply if the contracted activity takes place in a Military Service or COCOM environment. Forward conflicts identified between local and DIA guidance to the DIA Element OPSEC Coordinator. The COR will provide updated DIA Element points of contact including OPSEC Coordinators, security, and counterintelligence.

c. OPSEC is a capability that identifies and controls critical information, indicators of friendly force actions attendant to military operations, and incorporates countermeasures to reduce the risk of an adversary exploiting vulnerabilities. The OPSEC process examines administration, acquisitions, and operations to determine exploitable evidence of classified or unclassified sensitive activity.

The OPSEC process used in assessments and surveys is an analytical, risk-based process that incorporates five distinct elements detailed below.

Identify Critical Information Conduct Threat Analysis Conduct Vulnerability Analysis Conduct Risk Assessment Apply Countermeasures

11j1. OPSEC Plans: OPSEC Plans provide the contractor and DIA elements a living document used to implement the appropriate countermeasures given the probability and impact of the assessed risk.

11j2. OPSEC Assessments: OPSEC assessments measure the contractors OPSEC posture. Conduct OPSEC assessments on an annual basis incorporating input from subject matter experts, counterintelligence, security, and cyber security personnel to assess threats and potential loss of critical information. Assessments are conducted:

a. Based on the sensitivity of the operation or program.

b. Based on adversarial attempts to gain critical information.

c. Prior to OPSEC program or plan development. The assessment establishes a profile by showing indicators that present exploitable vulnerabilities.

11j3. OPSEC Surveys: OPSEC surveys seek to reproduce the intelligence image in light of the known collection capabilities of adversaries. Surveys require a specialized team to look at an activity from an adversarial perspective to determine disclosure of critical information through normal operations and functions, identify vulnerabilities, and propose countermeasures. Surveys may include telecommunications monitoring, radio frequency monitoring, network and computer systems assessments, and OSINT collection. Survey team members use the same risk analysis criteria found in OPSEC Assessments every 3 years.

11j4. Content Reviews: A content or “OPSEC review” is an evaluation of information intended for release outside of DIA control, including public release. The review seeks to identify and protect DIA unclassified information that may individually or in the aggregate lead to the compromise of classified information and sensitive activities. Updated CIL’s are mandatory for Content Reviews.

11j5. Critical Information Lists (CIL): Critical information is information about administration, acquisitions, and operations that an adversary seeks in order to gain advantage. Such information, if revealed to an adversary, may prevent or degrade mission accomplishment, cause loss of life, or waste critical resources. The Critical Information List (CIL) contains critical information that has been coordinated and approved, and is used by DIA Affiliates to identify information requiring application of OPSEC measures. CIL’s are typically unclassified for widest dissemination. Classified CILs restrict dissemination depending on the sensitivity of the contracted activity.

11j6. Critical Program Information (CPI): CPI is a capability that contributes to DIA’s technical advantage. CPI can be unclassified, classified, and specific to RDT&E funded programs. Record CPI as critical information, protect CPI through OPSEC countermeasures, non-investigative and non-operational CI activities describes in DODI 5240.24, and Anti-Tamper (AT) analysis and protections described in DODI 5200.39 and DODD 5200.47E.

11j7. Supply Chain Risk Management (SCRM): Vulnerabilities to supply chains are susceptible to foreign subversion, exploitation, and sabotage. Record detailed supply chain information as critical information. The OPSEC assessment must incorporate supply chain information to determine vulnerabilities, determine risk to acquisition, and propose countermeasures.

11j8. OPSEC Deliverables:

a. Training. All DIA Affiliates will receive initial and reoccurring (annual) OPSEC training. The contractor will provide training to those with access to DIA information in accordance with DODD 5105.42 and DODD 5205.02E.

b. OPSEC Program Plan. The contractor will complete, implement, and maintain an OPSEC program plan specific to the location the contracted activity will occur at the beginning of the acquisitions process. Maintain and update annually OPSEC program plans detailing the OPSEC countermeasures identified during the OPSEC assessment. Provide a copy of the OPSEC program plan to the DIA element OPSEC coordinators and or DIA Program Manager at the beginning of the acquisition for review.

c. OPSEC Assessment. The contractor will complete, implement, and maintain an OPSEC assessment specific to the acquisition. The OPSEC assessment will meet the criteria established in DODM 5205.02. Route DIA security and counterintelligence support requests through the DIA element OPSEC coordinators and or DIA OPSEC Program Manager. Implement recommendations, OPSEC analysis, and planning materials provided by DIA element OPSEC coordinators and or DIA Program Manager, security and counterintelligence in a timely manner. Maintain a copy of the OPSEC assessment after completion of work for future reference.

Provide annual updates to the OPSEC assessment to the DIA element OPSEC coordinators, security, and counterintelligence for review.

d. Public Release. The contractor will notify the DIA element OPSEC coordinators and or DIA Program Manager and seek concurrence prior to public release of any information related to the contracted activity.

11j9. OPSEC Reporting. DIA affiliates, including contractors and sub-contractors will report OPSEC vulnerabilities and violations directly to the DIA element OSPEC coordinators. OPSEC disputes and violations will be resolved at the OPSEC coordinator level.

Contractor’s report OPSEC vulnerabilities that result in the theft, loss, spillage, and compromise of CPI, SCI, and SAP information to DIA’s CI & Security Reporting System (CISRS) found at https://diareporting.Dodiis.ic.gov/SelfReporting/. Contractors may also type “GO CISR” in the JWICS address bar to access CISRS directly

11k. In order to impose this requirement on a contractor. (1) Only certain classified material qualifies for movement by USTRANSCOM’s Defense Couriers. The GCA is responsible for complying with both DoD and TCJ3-C policy and procedures related to Defense Courier Operations. A NOI letter is required before a Prime Contractor can authorize a subcontractor to use the services of USTRANSCOM’s Defense Couriers.

11l. Receive, Store, or Generate Controlled Unclassified Information (CUI). Item 10j (CUI/FOUO) and Item 11i (TEMPEST) only pertain for the protection of any CUI required in the performance of this classified contract. The NISPOM, does not provide specific guidance concerning CUI so the GCA must provide guidance on protection procedures in Item 13.

11m. Contract companies shall provide all cleared employees with security training and briefings commensurate with their involvement with classified information. All contractors’ training shall reinforce the information provided during the initial security briefing and shall keep cleared employees informed of appropriate changes in security regulations. Contractors shall maintain records about the programs offered and employee participation in them. Contractors may obtain defensive security, threat awareness, and other education and training information and material from their CSA or GCA or other sources.

12. Disclosure of any information related to this contract (classified or unclassified) is strictly prohibited without the expressed written consent of the CO/COR, with concurrence from SEC-1. This includes, but is not limited to, use of information in unclassified brochures, promotion sales, literature, reports to stockholders, or similar material.

DIA Security Requirements

1.1. Supply Chain Risk Management (SCRM) Guidance:

a. According to Intelligence Community Directive (ICD) 731, SCRM is the management of risk to the integrity, trustworthiness, and authenticity of products and services within the supply chain. It addresses the activities of foreign intelligence entities (as defined in ICD 750, Counterintelligence Programs) and any other adversarial attempts aimed at compromising the IC supply chain, which may include the introduction of counterfeit or malicious items into the IC supply chain.

b. The industry partner must address supply chain risk associated with the provision of systems, products, and services by employing a comprehensive SCRM plan that identifies supply chain vulnerabilities to information and communications technology (ICT) acquisition and development cycle applicable to this contract. That SCRM plan must be available to Security, SCRM PO, and Counterintelligence offices for review and compliance.

1. All potential and actual threat and vulnerabilities to the industry partner or DIA’s supply chain shall be reported to the Supply Chain Risk Management (SCRM) Program Office (PO) and mitigation strategies adopted.

2. Personnel supporting the contract should receive SCRM Awareness training initially then annually thereafter.

1.2. Antiterrorism Requirements for Contract Requirements in accordance with DOD Antiterrorism Guide: Contract Acquisition Documents shall include the Antiterrorism (AT) requirements listed below:

a. Annual Training. Employees requiring access to DIA facilities or automated information networks must complete Level I AT Awareness Training.

b. Travel Requirements. All persons performing overseas official travel on behalf of DIA shall comply with Department of Defense and DIA travel security requirements. Such persons shall obtain a security travel briefing from the Office of Security within three months prior to initiation of OCONUS travel.

c. Emergencies. While in DIA facilities, contractor personnel shall comply with posted evacuation procedures and instructions provided by facility security and emergency management personnel.

d. Mail and Deliveries. Mail and deliveries to DIA facilities are subject to inspection and shall be routed through the appropriate mail receiving facility.

1.3 Permanent/Visit Certifications

All classified permanent and visit certifications requests must be in support of this contract and requires coordination and authorization with the COR and DIA SSO. Permanent certifications are only processed at one-year intervals. Visit requests are not authorized in place of submission of nominations. Contract personnel identified to provide support at the SCI level, shall submit an SCI Nomination.

1.4 Downgrading and Declassification:

Should a contractor believe (a) that information is classified improperly or unnecessarily; or (b) that current security considerations justify downgrading to a lower classification or upgrading to a higher classification; or (c) that the security classification guidance is improper or inadequate, the contractor shall discuss such issues with the CO/COR who will follow the guidance in DIAG 5240-4, “Security Classification Challenges."

1.5 HANDLING and SAFEGUARDING CLASSIFIED INFORMATION:

All contract personnel providing support to the referenced contract are required to adhere to all requirements identified in the acquisition document (SOW/PWS/SOO), DD-254 and Security Continuation pages, applicable Federal, DOD, DIA directives, instructions and standard operating procedures, that includes the proper handling and safeguarding classified and unclassified information. Sponsor rules, regulations, direction, and requirements issued by COR or other authorized personnel for good order, administration, and security will apply to all Contractor personnel who enter the Government’s facilities. The Contractor shall comply with established security procedures for entering a facility and/or any special procedures that may be established for certain restricted areas. All persons granted access to premises in connection with the performance of this contract will be subject to the provisions of criminal or other laws protecting classified or intelligence information, including provisions of the espionage laws (Title 18, United States Code, sections 793, 794 and 798), provisions of the intelligence Identities Protection Act of 1982 (P.L. 97-200, SO U.S.C., 601

et. Seq.), and Title 32, Code of Federal Regulations (CFR), Section 1903. All persons performing work under this contract shall protect and safeguard national security information in accordance with Executive Orders, IC, DOD and DIA directives, instructions, and procedures.

1.6 SECURITY GUIDANCE:

a. Facility Clearance Requirements: The Contractor shall possess and maintain a Top-Secret level facility clearance.

Performance under the contract may require that the Contractor access data and information sensitive to another government agency, another government contractor, or of such nature that its dissemination or use other than as specified in this contract would be adverse to the interests of the Government or others. Neither the Contractor, nor its contract employees, shall divulge or release any information developed or obtained in the course of contract performance, except upon written approval of the Contract Officer.

The Contractor shall not use, disclose or reproduce any sensitive contract information that bears a restrictive legend, other than as specified in this contract. Any question regarding information contained within the SOW, will be addressed to or reported to the Contract Officer. Notify the COR and DIA’s Industrial Security office in addition to DCSA of any change in conditions affecting the Facility Clearance consisting of but not limited to:

(1.) Any change of ownership, including stock transfers that affect control of the company.

(2.) Action to terminate business or operations for any reason, imminent adjudication or reorganization in bankruptcy, or any change that might affect the validity of the FCL. Any information previously reported to DCSA concerning foreign ownership, control or influence (FOCI).

(3.) Changes in Storage Capability. Any change in the storage capability that would raise or lower the level of classified information the facility is approved to safeguard.

(4.) Inability to Safeguard Classified Material. Any emergency situation that renders the facility incapable of safeguarding classified material.

b. Safeguarding: Contract facility must possess and retain the level of safeguarding Secret granted by the

DCSA.

b. SCI Security Requirements: Contract employees shall be United States (U.S.) citizen, possess and maintain a final TS personnel security clearance issued by the Office of Personnel Management (OPM), the Defense Industrial Security Clearance Office (DISCO), or another government agency for contract personnel providing support to referenced contract in accordance with DOD 5200.2-R (DOD Security Program), DOD 5105.21, Vol 1-3 (Sensitive Compartmented Information Administrative Security Program), and Intelligence Community Policy Guidance number 704.1 (Personnel Security investigative Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information). The Facility Security Officer (FSO) or Contract Special Security Officer (CSSO) must ensure that contract personnel who have been nominated to support the referenced contract have completed actions to take an ownership or servicing role within Defense Information Security Service (DISS) under its CAGE Code. The FSO or CSSO is required to verify that the nominated contractor possess a final Top- Secret clearance based upon a current Single Scope Background Investigation (SSBI), Periodic Re-investigation (PR) or Phased Periodic Re-investigation (PPR). All nominations must be accompanied by an SF-86C (available through open sources). If the current investigation is out-of-scope, the FSO/CSSO must have initiated a PR, PPR or JVS must indicate enrollment in the Continuous Evaluation (CE) program. The nomination memorandum must be dated no later than 30 days from submission.

1) Interim Clearance: Contractor personnel, who possess an Interim SECRET or TOP SECRET clearance by DISCO or another agency are not authorized for SCI nomination to determine SCI eligibility until the completion of SSBI.

2) Secret Clearance: Contract personnel who possess a SECRET clearance by DISCO or another government agency are not authorized for nomination for SCI eligibility, until the SSBI has been completed and Top-Secret clearance granted.

3) Reciprocity: Contract personnel previously granted SCI eligibility within the last 24 months or are currently in SCI access with no deviations, waivers or exceptions shall be reciprocally accepted for SCI eligibility/access.

c. TIER 5 Guidance. Notice of six-year submission window for contractor periodic reinvestigations.

1. Company FSO will submit Tier 5 Periodic Reinvestigations (PRs) to DCSA for industry personnel six years after the date of the previous investigation rather than at the five-year mark to the National Background Investigations Bureau (NBIB) of the Office of Personnel Management. Therefore, industry will no longer submit Tier 5 PRs unless directed by DCSA. This change in Tier 5 PR submission periodicity will keep the Tier 5 PR investigations within the current seven-year reciprocity guidelines, resulting in the continued reduction of the backlog of personnel security investigations and enable DCSA to prioritize initial investigations and improve timeliness for interim determinations. Exceptions will be made for Tier 5 PRs required for Special Access Programs (SAP) as determined by DIA.

2. As a reminder, the Office of the Undersecretary of Defense for Intelligence signed a memorandum on Dec. 7, 2016, reminding DOD Components that personal security clearances do not expire. Individuals with current eligibility in the DISS should not be denied access based on an out-of-scope investigation. When the system of record shows current adverse information, but eligibility is still valid, access may continue.

c. Personal security clearances are required to be in scope based upon the current: Federal Investigative Standards (FIS) Tier 1(T1); Tier 2 (T2)/(T2R); Tier 4 (T4)/T4R); Tier 3(T3)/(T3R); Tier 3 (T3); Tier 5 (T5)/(T5R) respectively. In the event the contractor’s current investigation is out-of-scope, the FSO or CSSO must initiate a (T2R; T4R; T3R; T5R) respectively which must be reflected in DISS prior to submitting the nomination. Upon successful SCI eligibility determination and completion of the polygraph, the FSO will submit a permanent certification to the DIA Special Security Office via DISS, SMO Code XP124CS or via facsimile @ 202-231-8892. The permanent certification will be valid for the period of performance, however, not to exceed one year and must be renewed upon the exercise of each option period or extension and identifying the COR as the agency POC/Sponsor.

f. Collateral (Non-SCI Clearance SECRET Security Requirements: Contract employees shall be a U.S. Citizen who possess and maintains a minimal final Secret personal security clearance issued by the Office of Personnel Management (OPM), the Defense Industrial Security Clearance Office (DISCO), or another government agency for contract personnel providing support to this contract in accordance with DOD 5200.2-R (DOD Security Program), DOD 5105.21-M-1 (Sensitive Compartmented Information Administrative Security Program), and Intelligence Community Policy Guidance # 704.1(Personnel Security Investigative Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information). The FSO/CSSO must ensure that contract personnel who have been nominated to support the referenced contract have completed actions to take an ownership or servicing role within DISS under its CAGE Code. The FSO or CSSO is required to verify that the nominated contractor possess a final clearance respective of level of access required in support of contract. For all nominations, an updated SF-86c – dated not older than 1 year will be required.

e. SCI Nomination Information: The formatted nomination letter, placed on company letterhead, on the contractor employee for access to this contract is attached at Enclosure 1. Submission of nomination and Form 86c to the DIA COR or Special Security Representative (SSR) facilitates the coordination with the contract employee, FSO/CSSO coordinates the scheduling of a counter-intelligence-scope polygraph (CSP) examination with DIA’s Credibility Assessment office. Contract personnel who possess a current or acceptable polygraph (CI or Lifestyle) will be reciprocally accepted.

1.7 Adverse Information.

a. Contractors shall report any adverse information through their respective FSO and Industrial Security Office. Reports based on rumor or innuendo should not be reported. The subsequent termination of employment of an employee does not preclude the requirement to submit this report. Contract personnel are required to obtain and maintain Top Secret clearance. The company FSO is required too immediately notify DIA of the suspension/revocation of personal security clearances providing contract support.

1. Individuals authorized access to SCI incur a special and continuing security obligation to be aware of the risks associated with foreign intelligence operations and/or possible terrorist activities directed against them in the U.S. and abroad. These individuals also have a responsibility to recognize and avoid personal behaviors and activities that may adversely impact their continued eligibility for access to SCI. Accordingly, these individuals shall report to their DIA, actual or planned involvement in any of the activities listed below prior to participation in such activities or otherwise as soon as possible following the start of their involvement. DIA shall, following an analysis of such reported activities, determine if participation poses a potential threat to the protection of SCI or to the national security and take appropriate action.

2. SCI-indoctrinated individuals are discouraged from unofficial travel to countries when it is determined that such travel presents a threat to their personal safety and/or to SCI. In addition, SCI-indoctrinated individuals are discouraged from visiting the diplomatic or trade missions of these countries, as well as traveling on transportation carriers owned or controlled by these countries.

3. Failure to comply with reporting requirements and resultant determinations made by the DIA or designee may result in administrative action to include, but not limited to, revocation of SCI access and denial of future SCI access approval.

4. DIA may determine that operational and mission needs preclude strict adherence to these reporting requirements. In these instances, equivalent notification, briefing, and reporting shall be accomplished in accordance with DIA requirements.

b. SCI Suspension or Revocation Requirements. The Government reserves the right to suspend or revoke SCI eligibility/access based upon ICD 704, for access to SCI and other Controlled Access Program Information, based upon violation or deviation from established administrative or security procedures by contract personnel, resulting in the revocation of their security clearance or SCI access, removal from the facility, denial of future entry, and possible civil or criminal proceedings. The Contractor and its employees shall cooperate fully in security matters, which may arise relating to this contract. Failure to do so may be interpreted as purposeful non-cooperation and may result in removal from contract, SCI access and security processing and reporting of information to DCSA, impacting facility clearance

c. For reportable activities refer to the following regulations:

1. DODM, DOD 5105.21, Vol 1-3, Sensitive Compartmented Information Administrative Security Program, February 24, 2012

2. Intelligence Community Policy Guidance number 704.1 Personnel Security Investigative Standards and

Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information

3. DOD 5200.2-R, DOD Security Program

Note:

Contract personnel with access to CI & Security Reporting System (CISRS) shall report adverse information to DIA Security and company FSO. Contract personnel without access to CISRS are required to report adverse information to the Personnel Security Division at Sec.Customer@Dodiis.mil and company FSO.

1.8 Polygraph.

a. Polygraph Requirements: All contractors or employees of contractors identified to perform work for DIA, where contract support requires access to DIA classified information, facilities or systems must successfully complete a CSP examination in accordance with Intelligence Community Policy Guidance 704.6, SEAD 7 and DOD Directive 5210.48 or have a valid polygraph examination displayed in DISS or Scattered Castles from another federal agency to be reviewed to determine reciprocity PRIOR to scheduling and completing the SCI indoctrination process and accessing DIA systems, facilities, or information.

b. SCI Indoctrination and NATO Access Process: The COR will schedule contract personnel for SCI Indoctrination and NATO access with the DIA SSO upon receiving electronic notification that SCI eligibility has been granted by the DIA Central Adjudication Facility SEC3, and successfully completed or validated a current polygraph.

c. Unfavorable SCI Determination or Unsuccessful CI Polygraph: The DIA CAF will advise the COR when an un-favorable SCI determination has been rendered and or un-successful completion of a CI polygraph, resulting in the contractor not being authorized to provide support contracts to DIA associated with classified contracts.

d. No polygraph requirement for SECRET clearances.

1.9 Debrief Requirements.

a. The contractor must relinquish government issued credentials consisting of IC or DIA Staff Badge, Common Access Card

(CAC), Courier Card if applicable, and/or other government issued badges or system access cards immediately upon resignation, removal from contract, termination from company, suspension or revocation of security clearance or SCI access or end performance of contract.

b. Contractor must coordinate with the COR for notification of the DIA SSO to administer an SCI debrief, relinquish badge(s) CAC or courier card as applicable upon ending of contract support with DIA.

c. The FSO/CSSO accesses DISS to ensure contractor completed SCI debrief with DIA SSO. If DISS reflects SCI accesses associated with the respective contract company’s Security Management Office (SMO) Code, contact the COR advising that the contractor did not out-process through the DIA SSO and immediately inform the SSO to initiate administrative debrief actions. The FSO/CSSO should retrieve government issued credentials from the contractor upon discontinuing contract support with DIA.

1.10 BADGE GUIDANCE:

a. Issuance of IC Badge: The IC Badge will be issued to respective contract personnel who have been nominated, favorably adjudicated and briefed by DIA Office of Security into SCI eligibility and access, based upon contract requirements identified within the acquisition document (SOW, PWS or SOO) requiring contract personnel to access other IC agencies (ODNI, Army, Marine, Navy, Air Force, USCG, DoS, Treasury, DOE, DHS, FBI, CIA, NSA, NRO, NGA, and DEA) in support of DIA contractual requirements. The COR is responsible for selecting the appropriate badge category (IC or DIA Staff Badge) on the DIA Form 386.

b. Issuance of DIA Staff Badge: The DIA Staff Badge will be issued to respective contract personnel who have been nominated, favorably adjudicated and briefed by DIA Office of Security into SCI eligibility and access, based upon contract requirements identified within the acquisition document requiring contract personnel to access DIA facilities in support of DIA contractual requirements. The COR is responsible for selecting the appropriate badge category (IC or DIA Staff Badge) on the DIA Form 386.

c. Common Access Card (CAC): The CAC will be issued to respective contract personnel, based upon location of performance at DIA and contract facilities requiring access to DIA’s unclassified systems and access to federal facilities and installations in support of DIA granted contracts.

d. Courier Briefing/Card: The Acquisition document (SOW/PWS/SOO) must identify if contract support requires contract personnel to transport classified information/equipment outside of DIA, government and or contract facilities. Facilities must be accredited to or higher than the classification of information/equipment identified for transport. Information/equipment must meet the security requirements associated with wrapping and markings in accordance with DODM 5105.21-V1, Enclosure 4, paragraph 16 and 32 Code of Federal Regulation (CFR), Part 117, NISPOM, Rule, Section 4, paragraphs 5-402; 5-403 and 5-410. Courier briefing will be administered by DIA’s SSO. The COR is responsible for completing the DIA Form 386 to facilitate issuance of courier briefing/card.

Note:

All DIA issued badges, courier card, and CAC (credentials):

- The SSO must be notified within 24 hours of any lost or stolen credentials.

- Credentials must be returned to the DIA SSO and notification of COR immediately upon discontinuance of contract support.

- Failure to return government issued credentials, could result in security infraction imposed against the individual through DISS.

1.11. Disposition of Government Information and or Equipment: The Contractor shall not release information (including photographs, files, public announcements, statements, denials or confirmations) on any part of the subject matter of this contract, on any phase of any Government program, or regarding any individuals, without the prior written approval of the Contract Officer. The Contractor may provide only the following information regarding this contract in the past performance section of any proposal that it submits in response to any solicitations issued by any local, state, or U.S. Government agency:

The unclassified contract numbers.

The unclassified contract types.

The unclassified contract award date.

The unclassified contract dollar value.

The unclassified contract periods of performance.

The unclassified contract project title.

The unclassified contract work description summary.

The unclassified contract places of performance.

1.12 Transmitting for Official Use Only/Controlled Unclassified Information (FOUO/CUI):

a. Transmitting FOUO/CUI, routinely occurs when emailing acquisition documents (Statement of Works (SOWs), Statement of Objectives (SOOs), Performance Work Statements (PWS) and Acquisition Purchase Requests (APRs), completed DD- 254s, Security Continuation Pages, Notification of Intent to Sub-Contract Memorandums, Co-Utilization Agreements, SCI/Collateral Security Nominations Memorandums, etc… that has classification markings as Unclassified/For Official Use Only or Controlled Unclassified Information, requiring transmission to non .mil and or .gov email addresses. Although this information is not classified it is not for public release and measures must be implemented to prevent the unauthorized receipt of for official use only information.

b. CIO and OPSEC have implemented measures to prevent this from occurring. Information transmitted to non .mil and .gov email addresses are systematically screened to identify PII, FOUO and CUI from being transmitted unencrypted. In the event an email is transmitted that contains PII, FOUO and CUI the installed software on NIPR will prevent the transmission and simultaneously send an electronic OPSEC Violation Notification to the originator of the email and the supervisor.

c. The DOD SAFE application is used to send large files to individuals which would normally be too large to send via email. There are no user accounts for SAFE - authentication is handled via email and CAC. Everyone has access to SAFE, and the application is available for use by anyone. DOD SAFE Link: https://safe.apps,mil/

1) To encrypt unclassified information that is categorized as FOUO/CUI through encryption to minimize the un-authorized receipt of sensitive Security Addendum unclassified information, resulting in an OPSEC Violation, the Department of Defense (DOD) Safe Access File Exchange (SAFE) or the Microsoft Office encryption tool must be used to encrypt the email containing sensitive unclassified information.

2) Either of the referenced encryption tools can be used to facilitate the encryption of the transmission of various acquisition and security documents to or from a non .mil or .gov email address between DIA and contract companies.

3) Contract Security personnel will utilize DOD SAFE as a guest user, due to no Common Access Card (CAC) access at contract facilities. Note highlighted information.

d. Microsoft Encryption Tool:

1) The Microsoft encryption tool is another option to utilize for encryption of PII and FOUO unclassified information transmitted to non .mil and .gov email addresses. The tool can be accessed utilizing the following procedures:

2) At the prompt Security setting will not be applied to the document until you have saved the document.