Attachment C-SETA III Solicitation DD254_9July2021.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, MAY 2019

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

20220531 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification whs.mc-alex.esd.mbx.formswebmaster@mail.mil

WHS

List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

PEO STRI PAO, 12211 Science Dr Orlando, FL 32826

ITEM 13 SECURITY GUIDANCE:

The following items apply to this contract.

GENERAL GUIDANCE:

1. The vendor/contractor and sub-vendor/contractor(s) shall comply with the Security Agreement (DD Form 441) and following Security Regulations (DoDM 5200.01 Volumes 1 thru 3), DoD Information Security Program, (DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM), DoDM 5220.22 volume 2, DoDI 5200.48 Controlled Unclassified Information (CUI), DoDM 5105.21-Vol1-3, AR 25-2 Information Assurance, AR 380-5 Information Security, AR 380-49 Industrial Security, AR 380-10 current versions and affiliated regulations.

2. This DD254 only supports the base IDIQ contract! All other contract or delivery orders outside the scope of this contract and in support of other service components, government agencies and external organizations to PEO STRI must have their requiring activity security office develop their specific DD254 to support their contract effort.

3. The vendor/contractor and sub-vendor/contractor employees requiring access to DoD government or DoD vendor/contractor's facilities where proof of a security clearance is required, shall meet the security access requirements specified by the host and/or owner of those facilities.

4. Any prime Vendor/Contractors to include sub-vendors/contractors that are USA Foreign Owned, Controlled and Influenced (FOCI) company who poses a valid FCL issued by the Defense Counterintelligence Security Agency (DCSA) under a Special Security Agreement (SSA) are not allowed to work on this contract.

5. The vendor/contractor is not authorized to disclose or release TS/SCI or collateral Classified Military Information (CMI) information to the public.

a. The vendor/contractor is not authorized to disclose or release Controlled Unclassified Information (CUI) pertaining to this agreement/contract to the public without prior review and approval from the Requiring Activity OPSEC Officer, Legal and Public Affairs Officer. Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 12.

b. The vendor/contractor is not authorized to disclose or release any program Classified Military Information (CMI) Controlled Unclassified Information (CUI) Technical Data, Information pertaining to this contract to any Foreign Nationals or Foreign Representatives without prior review and approval from the Requiring Activity Cognizant Security Office, Foreign Disclosure Officer (FDO). Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 17a of the DD254.

6. The Vendor/Contractor shall only issue security clearances to those employees who meet the personal security requirements stated in the NISPOM and who require access to classified information based on a Need-to-Know.

a. For collateral security clearances and access, the vendor/contractor shall follow the Security guidelines established in DoD 5220.22M and the Defense Counterintelligence Security Agency (DCSA) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php

b. For TS/SCI security clearances and access, the vendor/contractor shall follow the Security guidelines listed in the SCI addendum to this agreement/contract.

c. Vendor/Contractor who do not require a security clearance but require a Government Common Access Card (CAC) must have a Tier 1 security investigation and follow the credentialing requirements of this contract!

7. The vendor/contractor and sub-vendor/contractors shall ensure that all Classified information, Controlled Unclassified Information (CUI), Controlled Technical Information (CTI) documents, data and or export controlled information; is marked, handled and safeguarded with the appropriate security classification, distribution statement(s) and export control warning statement in accordance with DoDD 5230.24, DoDI 5200.48, DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM), DoDI 5200.48, and DoDM 5200.01 Vol 1, 2 and 3.

a. The vendor/contractor and sub-vendor/contractors shall NOT ACCEPT any Documents, data or information from any source including the government requiring activity unless it is marked based on paragraph 7!

8. The prime vendor/contractor is responsible for vetting all sub-vendor/contractors for eligibility and suitability prior to issuing a sub-vendor/contractor DD Form 254 per chapter 7 of the NISPOM and AR 380-49. The prime vendor/contractor shall issue the PEO STRI vendor vetting process letter to all sub-vendor/contractors to fill out and respond to.

a. The prime vendor/contractor shall establish a Technology Control Plan (TCP) which will describe how government classified and technical data is handled, controlled, safeguarded and distributed to sub-vendor/contractors.

b. The prime vendor/contractor CSSO/FSO will sign DD Form 254, block 17h and Ensure that program, and/or Army activity points of contact information are included on DD Form 254, block 13.

c. The prime vendor/contractor shall follow DCSA sponsorship procedures (if required) only those not cleared Sub-vendor/contractor companies for a FCL who require access to classified data/information for this agreement/contract. The government nor the prime vendor/contractor shall incur any cost in this process.

d. The prime vendor/contractor shall not issue a DD254 to any USA FOCI Company’s.

9. Contractor shall comply with FAR 52.204-2 “Security Requirements”. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret”. The Contractor shall comply with (1) Security Agreement (DoD Form 441), including the National Industrial Security Program Operating Manual (DOD 5220.22-M) and (2) any revisions to DOD 5220.22-M.

10. This agreement/contract does not have any security classification guides (SCGs) which are directly applicable to this effort. If, during this effort, it becomes necessary to create a security classification Reference (SCR) the contractor shall notify the agreement/contract officer representative who will seek the assistance and appropriate guidance from the local government ISSM, PM and Requiring Activity Cognizant Security Office.

11. Vendors/Contractors who work in a DoD or Vendor/Contractor cleared facility on DA installations and or government leased facilities and who are embedded or integrated within a DA program or activity, shall report all adverse information, suspicious contacts, and other reportable incidents to the local security office.

12. The vendor/contractor and their sub-vendor/contractors shall immediately report any loss, compromise, suspected compromise of classified information or any security violations which occur on this contract per DoD 5220.22–M with current changes, to their Facility Security Manager (FSO / CSSO) and local DCSA office. The vendor/contractor shall also inform the AO/KO, COR, government Contract Monitors (CM)) and the ISS.

13. The vendor/contractor and their sub-vendor/contractors will designate in writing a U.S. citizen (not a dual citizen) as the Insider Threat program official per paragraph 1-202 of DoD 5220.22M w/change 2. All vendor/contractors with security clearances shall comply with Insider Threat Training requirements per paragraph 3-103 of DoD 5220.22M w/change 2. Additionally the vendor/contractor shall report threat-related incidents, behavioral indicators to the Requiring Activity Cognizant Security Office. Insider Threat training information can be found at the following DCSA site https://www.cdse.edu/

14. The vendor/contractor shall ensure that all vendor/contract employees with collateral and TS/SCI security clearances meet the prescribed security training required below and by chapter 3 of DoD 5220.22M, paragraph 1-14 of AR 381-12, DoDM 5105.21-V1 paragraph 9m, DoDM 5105.21-V3 enclosure 6, DoDI 5200.48 and AR 380-5.

REQUIRED ANNUAL SECURITY TRAINING

The contractor shall read and execute the below listed annual security training requirements for only those employees who have security clearances and access to CUI on this contract;

Threat Awareness Reporting Program (TARP) All contractors and subcontractors with security clearances must receive annual Threat Awareness and Reporting Program (TARP) training per AR 381-12. The training should be provided by a CI agent or other trainer as specified in 2-4b and chapter 3 AR 381-12

The Contractor shall ensure its employees report threat-related incidents, behavioral indicators, and other matters of CI interest specified in the AR 381-12, to their FSO and the PEO STRI G2 Office, the nearest military CI office, the Federal Bureau of Investigation, or the Defense Security Service.

OPSEC Awareness Training.

Per AR 530-1 Operations Security, the contractor employees working on this contract must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their start date on this contract and annually thereafter. OPSEC Awareness training information and materials are available at https://www.cdse.edu/catalog/elearning/GS130.html

Insider Threat Training The contractor and their subcontractors will designate in writing a U.S. citizen as the Insider Threat program official per paragraph 1-202 of DoD 5220.22M w/change 2. All contractors shall comply with Insider Threat Training requirements per paragraph 3-103 of DoD 5220.22M w/change 2. Insider threat program information and materials are available at https://www.cdse.edu/catalog/elearning/INT101.html.

DoD Annual Security Awareness Refresher Training All contractor employees working on this contract with a security clearances must complete the annual security awareness refresher training. New employees must complete the initial security training and the security awareness refresher training annually thereafter. This training refreshes the employees basic understanding of initial security training requirements outlined in DoDM 5200.01 Volume 3, Enclosure 5, the National Industrial Security Program Operating Manual (NISPOM) and other applicable policies and regulations. This training is available at https://www.cdse.edu/catalog/elearning/IF142.html

Controlled Unclassified Information Training This contract / agreement contains CUI, all contractors shall have only those employees who handle CUI take annual CDSE CUI Training required for all DoD and Industrial personnel with access to controlled unclassified information. New employees must complete this training 30 day from start day of the contract. No CAC or password needed the training website also provides a resource tab which lists regulations, policies and more information on the subject. https://securityhub.usalearning.gov/index.html

Unauthorized Disclosure of Classified Information for DoD and Industry Contractor employees working on this contract with security clearances must complete the annual Unauthorized Disclosure of Classified Information for DoD and Industry training. New employees must complete this training 30 day from start day of the contract. This training provides an overview of what unauthorized disclosure is, including specific types of unauthorized disclosure and some common misconceptions about unauthorized disclosure, the types of damage caused by unauthorized disclosure and the various sanctions one could face if caught engaging in unauthorized disclosure. This training is available at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

AT Awareness Training for Contractor Personnel Traveling Overseas.

The contractor FSOs and associated subcontractor FSOs will brief and make available government area of responsibility (AOR) specific AT awareness training and information to employees traveling overseas as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact. AT level I awareness training meets this requirement and is available at the following website: https://atlevel1.dtic.mil/at/

DCSA provides the Facility Security Officer (FSO) Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php

15. SELF EMPLOYED CONSULTANTS – The requiring activity security office shall be notified of any consultants who work for or support the Vendor/Contractor (prime and subs) for this effort! The Vendor/Contractor who employs or has consultants on their team shall provide a copy of all consultant certificate/agreements to the requiring activity AOR/COR and security office per paragraph 2-212 of the NISPOM.

16. TEMPORARY EMPLOYED PERSONNEL (Paid by 1099) – Temporary employees are NOT authorized to work on this contract/agreement.

17. TECHNOLOGY CONTROL PLAN – Vendors/Contractors (prime and subs) who meet the following criteria must develop and provide a copy of their Technology Control Plan (TCP) to the COR/ACOR and government Security representative for this effort when;

a. A cleared vendor/contractor with not cleared U.S. sub-vendor/contractors exits.

b. Information and a template on how to build a TCP can be found on the DCSA site provided; https://www.dcsa.mil/mc/ctp/foci/action/sample_tech_con_plan/

18. If the contractor requires access to the PM ST LT2 portal, all request for access must be made directly to the PM ST LT2 portal administrator.

ITEM 10:

Ref Item 10.a: COMSEC INFORMATION - Classified COMSEC material is not releasable to vendor/contractor employees who have not received a FINAL clearance at the appropriate security level. COMSEC access shall be IAW DoD 5220.22-M and AR 380-40. When access is required at Government facilities, vendor/contractor personnel will adhere to COMSEC rules and regulations as mandated by Command policy and procedures.

Ref item 10b: RESTRICTED DATA – Access to RESTRICTED DATA, information which is classified and controlled under the Atomic Energy Act of 1954, or CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) is required. A final U.S. Government Top Secret clearance is required for this project. Information in this category relates to: (1) the design, manufacture or utilization of atomic weapons; (2) the production of special nuclear material; or (3) the use of special nuclear material in the production of energy. Information of this category shall not be disseminated outside official and authorized channels without the consent of the originator. Access to and dissemination of this information shall be governed by DoD Instruction 5210.02. does not apply.

Ref item 10c: CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) – Contract personnel are permitted access to CNWDI in the performance of this contract. The government program manager or designated representative will brief all contractors prior to granting access to CNWDI information. Contractor must be briefed by at appropriate government agent and follow the guidelines as outline in DoD Instruction 5210.02. Restricted Data shall be handled in accordance with the applicable guidance for Nuclear Weapons (Secret/RD). does not apply

Ref item 10d: FORMERLY RESTRICTED DATA – Information that is removed from the Restricted Data category upon a joint determination by the Department of Energy (or antecedent agencies) and the Department of Defense that such information relates primarily to the military utilization of atomic weapons and that such information can be safeguarded adequately as classified defense information. For Foreign Dissemination however, it is treated in the same manner as Restricted Data. Information of this category shall not be disseminated outside official channels without the consent of the originator. Access to and dissemination of this information shall be governed by DoD Instruction 5210.02. Access to FORMERLY RESTRICTED DATA requires a final U.S. Government clearance at the Secret level. Does not apply

Ref Item 10.e(1): INTELLIGENCE INFORMATION (SENSITIVE COMPARTMENTED INFORMATION) SCI - SCI Access required. No public release of information authorized, public disclosure or confirmation of any subject related to the support agreement/contract is not authorized without first obtaining written approval from the AO/KO. No Foreign or USA FOCI vendor/contractors are allowed access.

Ref Item 10.e(2): INTELLIGENCE INFORMATION (NON-SCI) - Non-SCI Information is not releasable to vendor/contractor employees who have not received a clearance at the appropriate security level. Written concurrence of the AO/KO is required prior to sub-agreement/contracting. No Foreign or USA FOCI vendor/contractors are allowed access to Intelligence information required for the performance of this agreement/contract.

Ref Item 10.h: FOREIGN GOVERNMENT INFORMATION - Foreign Government Information (FGI) is not releasable to vendor/contractor employees who have not received a FINAL clearance at the appropriate security level. FGI is not authorized for disclosure or release to a third party without written permission from originating foreign government. The security requirements in DoD 5220.22-M the NISPOM chapter 10 and AR 380-10 must be adhered to. Written concurrence of the AOR, COR is required prior to sub-agreement/contracting.

Ref Item 10.j: CONTROLLED UNCLASSIFIED INFORMATION (CUI) - For Controlled Unclassified Information (CUI) Information generated and/or provided under this agreement/contract shall be safeguarded and marked as specified in DoDI 5200.48. (see the CUI attachment).

a. COMPILATION - The contractor shall be aware of certain information that would otherwise be unclassified or CUI when standing alone may require classification when combined or associated with other unclassified or CUI information. The determination that information requires classification by compilation will be based on specific guidance regarding compilation provided in a Security Classification Guide (SCG) or from the information/data owner. When classification is required to protect a compilation of such information, the overall classification assigned to the compilation shall be conspicuously affixed. The reason for classifying the compilation shall be stated at an appropriate location at or near the beginning of the compilation. Any unclassified or CUI portions will be portion marked (U) or (CUI), while the overall markings will reflect the classification of the compiled information.

Ref Item 10k: OTHER - Secret Internet Protocol Network (SIPRNET) access will be limited to only those employees who have a SIPRnet requirement during this agreement/contract. A list of employees having a SIPRnet account with justification must be provided to government upon request! The vendor/contractor is not authorized to access, download or further disseminate any classified information from SIPRnet which is outside the scope of the defined agreement/contract requirements unless specifically authorized in writing by the Government Program Manager (PM), COR, ISSM and G6 or network security authority. The vendor/contractor must complete and forward to the AO/COR, a SIPRnet access request for approval by the Requiring Activity SIPRnet Information Assurance Manager (IAM) prior to receiving access.

Although the NATO brief is a requirement for SIPRNet it does NOT mean that the vendor/contractor has a requirement for access to NATO information. Access to NATO information is a specific requirement that will need additional justification from the government Project Manager (PM) and AO/COR.

The vendors/contractors CSSO/FSO must administer a NATO awareness brief to only those vendor/contractors who require access to the SIPRNET. The vendor/contractor and CSSO/FSO must sign and retain the NATO briefing/debriefing form for the life of the agreement/contract. The CSSO/FSO is required to update individual vendor/contractors JPAS account reflecting the indoctrination to NATO Secret.

JWICS access and information is provided in the SCI addendum.

Ref Item 10k: OTHER - NATIONAL SECURITY AGENCY NETWORK (NSAnet) – Only those contractors who work on PEO STRI programs identified by their government leads shall require access to Signal Intelligence (SIGINT), and will also require access to National Security Agency network (NSAnet) for research, analysis, development and execution of training in accordance with 10 U.S. Code 1564a and United States Signals Intelligence Directive (USSID) SE1000 attached.

All personnel accessing SIGINT data are required to have a current Counterintelligence (CI)-scope polygraph (CSP) DD Form 2801, Jun 2011 addendum and complete all mandatory oversight training listed in United States Signals Intelligence Directive (USSID) SE1000.

The Contractor shall coordinate with the appropriate government program office and local site lead to ensure all requirements to include a signed Annex A: ACKNOWLEDGEMENT AGREEMENT FOR SIGINT ACCESS AGREEMENT [2017-05710] and ANNEX B: MEMORANDUM FOR CONTRACTOR SIGINT ACCESS AGREEMENT [ORG-2017-05710) attached are met.

Failure of the contractor to meet any of the requirements for access to NSAnet will result in a no access to NSAnet or employment for this position.

ITEM 11:

Ref Item 11.a: ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTORS FACILITY OR A GOVERNMENT ACTIVITY – Vendor/Contractor performance is restricted to the name and addresses of contractor facilities or government activities). Government agency or activity will provide security classification guidance for performance of this agreement/contract. Submit visit request to the Facility Security Officer (FSO), Security Management Office via JPAS for need-to-know verification and access.

PEO STRI Annex Naval Support Activity (NSA) 12211 Science Drive Orlando, FL 32826

De Florez Building Naval Support Activity (NSA) 12350 Research Parkway Orlando, FL 32826

Research Commons 4th Floor 12249 Science Dr Orlando, FL 32826

Tech Point One Integration Development Environment (IDE) 3045 Technology Parkway Orlando, FL 32826

Partnership I 12350 Research Parkway Orlando, FL 32826

Partnership II 3rd and 4th Floors 3100 Technology Parkway Orlando, FL 32826

Partnership III 3rd and 4th Floors 3139 Technology Parkway Orlando, FL 32826

Partnership IV 12809 Science Dr Orlando, FL 32826

Partnership V Joint Development Integration Facility (JDIF) 3rd Floor PM CT2, 2nd Floor International Program Office (IPO) 1st Floor 12000 Research Parkway Orlando, FL 32826

Fort Benning, GA Fort Bliss, TX 75th Ranger Regiment Bldg 21100 BLDG 2930 Ordinance St, East Ft Bliss Fort Benning, GA 31905 Ft Bliss, TX 79916 SSO: John Taylor Phone: 706-545-9893

Fort Bragg, NC Fort Bragg, NC SSO: Rueben Vasquez XVIII Airborne Corps Battle Simulation Center Complex Tactical Simulation (TACSIM) Phone: (910) 396-8104/7104 Building A-4443 Address: Building 2-1138 Fort Bragg, NC 28307 Rear Basement Ft. Bragg, NC 28310

Fort Campbell, KY Fort Campbell, KY SSO: Specialist Lisa Jacoby IEWTPT Team 2700 Indiana Ave Kinnard BCTC B-6896 Air Assault Street Ft. Campbell, KY 42223 Fort Campbell, KY 42223 Phone: (270) 798-5322

Fort Carson, CO MCTC Attn: IEWTPT Building 2135 Fort Carson CO 80913

Ft. Hood, TX Fort Hood, TX SSO: Allan Stonerack III Corps & Fort Hood Phone: (254) 287-5474 Intelligence Contingency Readiness Center (ICRC) Building 22012 Address: Commander 53rd Street III Corps and Ft. Hood Fort Hood, TX 76544 Attn: AFZF-GS-SSO 1001 761st Tank BN Ave Room BC015 Fort Hood, TX 76544-5010

Ft. Irwin and National Training Center (NTC) Ft. Leavenworth, KS SSO: Josie Castorena SSO: John Flannigan Phone: (760) 380-5289 Phone: (913) 684-4789 Commander, Ft. Irwin and National Training Center (NTC) Physical Address: SSO, PMO Attn: AFZJ-I-S (Intelligence and Security) Fort Leavenworth, KS 66027-1370 P.O. Box 105059 Mailing Address: Provost Marshal Office Ft. Irwin, CA 92310-5059 Attn: Special Security Office 410 McPherson Ave.

Fort Leavenworth, KS 66027-1370

Fort Lewis, WA Joint Base Lewis-McChord (JBLM) SSO – Mr. Wayne Miller I CORPS Phone: (253A) 968-9133 Battle Command Training Center Physical Address: Bldg 9113 Building 1240, Railroad Ave. Jackson Avenue and Underhill road Fort Lewis, Washington 98433 Fort Lewis, WA Commander, I Corps & Fort Lewis

ATTN: AFZH-GSS (SSO)

MS # 3, Box 339500 Fort Lewis, WA 98433-9500

Fort Polk, LA Fort Riley, KS Joint Readiness Training Center BCTC Attn: IEWTPT 7173 Georgia Ave, Building 3005 BLDG 77694 Victory Drive Fort Polk, LA 71459 Fort Riley, KS

Joint base Elmendorf-Richardson, Alaska Fort Wainwright, AK Mr. Peter Larkin Wilson Mission Training Complex BLDG 802, Door 4, Warehouse Street Mr. Ricky Burroughs Joint base Elmendorf-Richardson, Alaska 3437 Luzon Avenue Phone: 907-384-6131 Fort Wainwright, AK 99703 Phone: 907-353-3214

Schofield Barracks Mission Training Complex - Hawaii Security manager: Lawrence Ahtuck Phone: 808-655-2834 2093 Trimble Road, Building 1503 Schofield Barracks, Hawaii 96857

Grafenwohr, Germany Joint Multinational Simulation Center 7th Army Training Center Building 1463 Joint Multinational Training Command Camp Aachen SSO: Robert Hanes Grafenwoehr Training Area, Germany Phone: 01109641837138 Mailing Address: USAG Grafenwohr

DPTMS

Unit 28130 (IMEU-GFW-PLS)

APO AE 09114

Ramstein AFB, Germany Warrior Prep Center (WPC) POC: Mr Andrew Wikoff, HQ USAFE/SSO Phone: 011 49 6371 47 6815 Mailing Address: HQ USAFE/A2SP Unit 3050 Box 80

APO AE 09094

Yongsan Army garrison, Korea Yongsan, Korea SSO: Mr, Tainangelo Korea Battle Simulation Center (KBSC) Mailing Address: HQ, EUSA, ACofS, G2 SSO: Mr. Henry Patton ATTN: SSO (Mr. Tainangelo) Phones: 011 82 505 725 8027 Intelligence & security Division, Unit 15236 011 82 505 723 5858

APO, AP 96205-0009 011 82 505 736 8040

SSO: MR. ELLISON (FOR Personnel Security Clearances) Mailing Address: ATTN: FKJ3-ED-KBSC Phone: DSN 315 723-8049 (Henry C. Patton) Commercial: 011 82 505 723 8049 PSC 303, Box 50 ssoeusa@korea.army.mil APO AP 96204-0050 Physical address: EUSA SSO

BLDG 2516

Yongsan Army Garrison Seoul, South Korea

APO, AP 96205-009

Fort Drum, New York Fort Knox, Kentucky Fort Leavenworth, Kansas Fort Lewis, Washington Fort Monroe, Virginia and the Greater Tidewater Area Fort Sill, Oklahoma Fort Rucker, Alabama Fort Sam Houston, Texas Fort Monmouth, New Jersey Fort Polk, Louisiana ARCENT - Iraq/Kuwait Combined Security Transition Command - Afghanistan Combat Training Center (CTC), Joint Multinational Readiness Center (JMRC), Hohenfels, Germany Joint Coalition Warfare (JCW), Suffolk, Virginia Redstone Arsenal, Alabama

Ref Item 11e: PERFORM SERVICES ONLY - This agreement/contract is for a non-personal support services contract for program management, planning, design, development, engineering, implementation, logistics, evaluation, sustainment, security, operations and support acquisition, and ancillary services for PEO STRI. The vendor/contractor will work in contractor and/or DoD cleared facilities. Classification markings and distribution statements on any material to be furnished will be provided by the agreement/contract logistics personnel and site security guidance necessary for the performance of the agreement/contract.

Ref Item 11.f: ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S - This agreement/contract may require your company to have access to classified information in an overseas area. The specific overseas area(s) will be provided by the Contract Monitor or the Agreement/Contracting Officer. Classified information or materials will remain under the direct control of the US government while in an overseas area unless prior approval is granted by this command. Release of classified information to a foreign entity will be accomplished in accordance with Chapter 10, DoD 5220.22-M w/change 2 and AR 380-10.

Ref Item 11.g: AUTHORIZED TO USE DEFENSE TECHNICAL INFORMATION CENTER (DTIC) - The vendor/contractor is authorized to use the services of Defense Technical Information Center (DTIC) and is required to prepare and process a DD Forms 1540 and 2345 to registration for Scientific and Technical Information Services. The contracting activity must be involved in certifying need-to-know to DTIC.

Ref Item 11.j: OPERATIONS SECURITY (OPSEC) REQUIREMENTS - The vendor/contractor shall develop, implement, and maintain a facility level OPSEC program to protect classified and/or sensitive unclassified information used at the vendor/contractor, government and other vendor/contractor facilities during the performance of this agreement/contract. The OPSEC requirements may be included in the Vendor’s/Contractor’s Standard Practice Procedures (SPP) or Technology Control Plan (TCP), whichever is more applicable.

Ref Item 11.l: RECEIVE, STORE OR GENERATE CONTROLLED UNCLASSIFIED INFORMATION (CUI) – The vendor/contractor and all sub-vendor/contractors personnel must protect CUI material and information in accordance with DoDI 5200.48. (see the CUI addendum attached).

a. COMPILATION - The contractor shall be aware of certain information that would otherwise be unclassified or CUI when standing alone may require classification when combined or associated with other unclassified or CUI information. The determination that information requires classification by compilation will be based on specific guidance regarding compilation provided in a Security Classification Guide (SCG) or from the information/data owner. When classification is required to protect a compilation of such information, the overall classification assigned to the compilation shall be conspicuously affixed. The reason for classifying the compilation shall be stated at an appropriate location at or near the beginning of the compilation. Any unclassified or CUI portions will be portion marked (U) or (CUI), while the overall markings will reflect the classification of the compiled information.

Ref Item 11.M: Dual Citizens The vendor FSO must maintain a list of all dual citizen employees and provide that list upon inspection from DCSA or the cognizant security authority ISS. Vendor employees who are dual citizens and have access to software and technical data must have the appropriate security clearance in accordance with the current version of DoD 5220.22-M w current changes.

Ref Item 11.M COURIER CLASSIFIED MATERIAL: The vendor/contractor and their sub-vendor/contractor must comply with DOD 5220.22–M w/change 2 NISPOM chapter 5, section 4 for couriering collateral classified material. The vendor/contractor FSO shall only issue courier orders to authorized vendor/contractors for Conus travel including Alaska and Hawaii only! Courier of Classified material Oconus is not authorized for this contract. Courier orders must at a minimum list the following information;

Couriers full First and Last Name Agreement/Contract Number Program Name Level of information authorized for transmission (not to exceed DD254) Date authorization expires

The vendor/contractor courier is not authorized to courier COMSEC materials/data, information or equipment. The courier must have a valid driver’s license and or picture ID and set of courier orders in their possession at all time for inspection.

ADDITIONAL SECURITY GUIDELINES FOR COMSEC

Vendor/Contractor Generated, Communications Security (COMSEC) Material: any material generated by the vendor/contractor (including, but not limited to: correspondence, drawings, models, mockups, photographs, schematics, status programs and special inspection reports, engineering notes, computations and training aids) will be classified according to its own content and in accordance with AR380-5 and AR 380-40. Classification guidance will be taken from other elements of this Agreement/Contract Security Classification Specification, DD Form 254, Government furnished equipment or data, or special instructions issued by the government program appointed COMSEC account manager (CAM), Contracting Officer, or his/her duly appointed representative.

REQUIREMENTS:

1. All vendor/contractor personnel to be granted access to classified COMSEC information must be U.S. citizens granted a FINAL security clearance prior to being given access. Immigrant aliens, interim cleared personnel, or personnel holding a vendor/contractor granted CONFIDENTIAL clearance are not eligible for access to classified COMSEC information released or generated under this agreement/contract. This shall be monitored and validated by the government program appointed COMSEC account manager (CAM) and Director, NSA.

2. No vendor/contractor generated COMSEC or government furnished material may be provided to the Defense Technical Information Center (DTIC). Contractor generated technical reports will bear the statement “Not Releasable to the Defense Technical Information Center per DOD Directive 5100-38.”

3. The following downgrading and Declassification notation applies to all classified COMSEC information provided to and generated by the vendor/contractor must be done in accordance with AR 380-5 and AR 380-40 paragraph 2-25 and Appendix B.

4. Classified COMSEC materials should be destroyed in the presence of the government program appointed COMSEC account manager (CAM) (primary and or alternate) and in accordance with AR 380-40, Safeguarding and Controlling Communications Security Material. Also, a record of the destruction must be recorded on Standard Form 153 rev (9-88) COMSEC Material Report and provided to the government program appointed COMSEC account manager (CAM) and contracts officer.

5. Vendor/Contractor employees or cleared commercial carriers shall not carry COMSEC materials on commercial passenger aircraft anywhere in the world without the approval of the government program appointed COMSEC account manager (CAM), procuring Program Manager or agreement/contracting officer.

6. Unclassified COMSEC Information released or generated under this agreement/contract shall be restricted in its dissemination to personnel only involved in this agreement/contract. Release in open literature or exhibition of such information without express written permission of the Director, NSA is strictly prohibited.

7. Recipients of COMSEC Information under this agreement/contract may not release information to sub-vendor/contractors without permission of the government program appointed COMSEC account manager (CAM) and User Agency.

8. The vendor/contractor shall adhere to the following regulations as it pertains to safeguard and management of COMSEC. AR 380-40, AR 380-5 and follow the direction provided by the government program appointed COMSEC account manager(s) (CAM).

9. The vendor/contractor must report all security violation and or suspected compromises of COMSEC material of any kind immediately to the government program appointed COMSEC account manager (CAM).

10. Additional notices to be affixed to the cover and title or first page of vendor/contractor generated COMSEC documents:

a. “COMSEC MATERIAL – ACCESS BY VENDOR/CONTRACTOR PERSONNEL RESTRICTED TO U.S. CITIZENS HOLDING FINAL GOVERNMENT CLEARANCE.”

b. “THIS PUBLICATION OR INFORMATION IT CONTAINS MAY NOT BE RELEASED TO FOREIGN NATIONALS WITHOUT PRIOR SPECIFIC APPROVAL FROM THE DIRECTOR, NSA. ALL APPROVALS WILL IDENTIFY THE SPECIFIC INFORMATION AND COPIES OF THIS PUBLICATION AUTHORIZED FOR RELEASE TO SPECIFIC FOREIGN HOLDERS. ALL REQUESTS FOR ADDITIONAL ISSUANCES MUST RECEIVE PRIOR SPECIFIC APPROVAL FROM THE DIRECTOR, NSA”

11. Point of contact is the contract government program appointed COMSEC account manager (CAM) and Requiring Activity Cognizant Security Office.

“CONTROLLED UNCLASSIFIED INFORMATION (CUI) ” ATTACHMENT

1. GENERAL:

The contractor shall adhere to DoDI 5200.48 CUI and Army Controlled Unclassified Information (CUI) guidance as it relates to controlling, marking, safeguarding, storage and disposal of CUI materials on this contract /agreement.

2. IDENTIFYING CUI.

a. The official CUI Registry approved by the CUI Executive Agent identifies all approved CUI categories; provides general descriptions for each; identifies the basis for controls; establishes markings, and includes guidance on handling procedures. The Contractor shall refer to the CUI Registry’s category listing found at https://www.archives.gov/cui/registry/category-list to determine if information can be designated as CUI. The contractor shall also coordinate with the COR/AOR for support and advice.

b. The authorized holder (originator/owner of the information; the original classification authority or other official (government or contractor) that controls the information) is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. If so, the authorized holder is responsible for applying CUI markings and dissemination instructions accordingly.

c. Only categories listed in the CUI Registry (includes DoD related categories) can be used to identify if the information meets CUI designation.

3. LEGACY MATERIAL.

a. Policy for legacy CUI created and marked under Department of Defense Manual (DoDM) 5200.01, Volume 4 is cancelled. For information on Army legacy material: (Ref: DoDI 5200.48, para 3.2)

(1) Will not be required to be re-marked or redacted while it remains under control or is accessed on line and downloaded for use on the contract. However, when legacy CUI is incorporated into, or cited in, another document or material, it must be reviewed for CUI and marked in accordance with DoDI 5200.48.

(2) Marked and stored on an access-controlled website or database does not need to be remarked as CUI, even if other agencies and contractors are granted access to the websites or databases.

(3) Does not automatically become CUI. It must be reviewed by the owner of the information to determine if it meets or falls under one of the new CUI categories. If it meets the new CUI requirements, it will be marked in accordance with DoDI 5200.48.

b. The original classification authorities (OCAs) are required to review all SCGs under their authority to determine if the information (previously marked as “For Official Use Only” or “FOUO” or other legacy markings) meets the CUI designation. The SCGs must be reissued to ensure clear protection guidance is provided. (Ref: DoDI 5200.48, para 3-7e and 3.8)

4. Marking. The contractor shall ensure that all documents containing CUI carry the CUI markings in accordance with DoDI 5200.48. Discontinue all use of legacy or other markings is not permitted or included in either the CUI Registry or DoDI 5200.48. Refer to the OUSD(I&S)/DDI(CL&S) Information Security CUI Marking Guidance dated April 2020.

5. Safeguarding and Storage. The contractor shall protect CUI from unauthorized disclosure or access by unauthorized personnel, by ensuring these measures are implemented: (Ref: DoDI 5200.48, para 4.1e)

a. During working hours. Contractor employees working with CUI will be careful not to expose CUI to unauthorized users or others who do not have a lawful government purpose to see the information. Cover sheets (Stand Form 901) can be placed on top of documents to conceal the contents from casual viewing.

b. The contractor shall keep CUI under control at all times or protect it with at least one physical barrier and reasonably ensure that the information is protected from unauthorized access and observation.

c. CUI will not be stored in personal residence, hotel room safes, and automobiles or viewed while on public transportation if allowed to transfer hard-copy (document form) CUI material outside the organization.

6. Transmission Requirements.

a. CUI information may be transmitted electronically (e.g., data, website, or e-mail), via approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure or transport layer security (e.g., https). Avoid wireless telephone transmission of CUI when other options are available. (Ref: DoDI 5200.48, para 4.1e).

b. CUI transmission via facsimile machine is permitted; however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive CUI; facsimile machine located in a controlled government environment) or an authorized DoD contractor facility.

c. CUI information and material may be transmitted via first class mail, parcel post, FEDEX or, bulk shipments. Do not place CUI markings on the outer envelopes or packaging. Refer to the OUSD(I&S)/DDI(CL&S) Information Security CUI Marking Guidance dated April 2020.

d. The contractor shall not use unofficial or personal (e.g., .net; .com) e-mail accounts, messaging systems, or other non-DoD information systems, except approved or authorized government contractor systems, to conduct official business involving CUI.

7. CUI within Information Systems. (Ref: DoDI 5200.48, para 3-3, 3-10)

a. DoD information systems (IS) processing, storing, or transmitting CUI will be categorized at the moderate impact level, and follow the guidance in DoDI 8500.01 and 8510.01.

b. Non-DoD information systems processing, storing, or transmitting CUI will provide adequate security, and the appropriate requirements must be incorporated into all contracts, grants, and other legal agreements with non-DoD entities in accordance with DoDI 8582.01. The NIST-SP 800-171 identifies the baseline system requirements for processing CUI for industry.

c. For systems, networks, and programs operating on the various domains, a splash screen warning and notice of consent must be employed to alert users of the presence of CUI.

d. When made available by the DoD Chief Information Officer and OUSD(I&S), Army organizations will modify or install classification marking tools on unclassified, Secret and Top Secret network systems to account for CUI information and readily permit inclusion of CUI markings and designator indicators.

8. Dissemination. (Ref DoDI 5200.48, para 4-2)

a. The contractor shall follow CUI access to the extent the access or dissemination: complies with the Law, Regulation, and Government-wide policy (LRGWP) identifying the…