2nd Draft RFP Appendix E 2 of 2 CLS DD254 Continuation Sheet DRAFT_16 Mar 2023.docx

Appendix F: DD254 Continuation Sheet Contract #: TBD

a. Reference Blks 1a/1b: Contractor must obtain a SECRET Facility Security Clearance prior to being granted access to SECRET information and must obtain SECRET safeguarding capability prior to being provided SECRET information.

b. Reference Blks 8a/8c: Primary work performance will occur at military installations in the U.S. and worldwide. The installation commanders have formally elected to retain security cognizance as outlined in Table 1 below; therefore, DCSA is relieved of inspection responsibility for contractor performance at these military installations.

Table 1: Main Operating Base CSOs

1190 Menoher Drive, Suite 30 Joint Base Andrews, MD 20762

800 Scott Circle JBPH- Hickam Field HI 96853 Phone 15wg.ip.workflow@us.af.mil

Marine Corps Air Station (MCAS) Kaneohe Bay, Hawaii

HQBN/STAC6

Building 208 2nd Street Kaneohe Bay, HI 96863

Unit 3300

APO AE 09094

DSN: 314-480-2970

Comm: 06371-47-2970 86aw.imformationprotectionoffice@us.af.mil

Naval Base Ventura County (NBVC) PT Mugu, California VX-30, Commanding Officer Attn: VX30 Security Officer 575 “I” Avenue Suite 1, Hangar 372 Point Mugu, CA 93042-5049

c. Reference Blk 10a/11h: COMSEC/Cryptographic safeguarding requirements apply. COMSEC information includes accountable or non-accountable COMSEC information and controlled cryptographic items (CCI).

Contractor is authorized to receive Government furnished cryptographic equipment. Release of COMSEC material and equipment to DoD contractors requires Air Force Cryptological Support Center approval. Contractor will forward requests for COMSEC information and material to the COMSEC officer through the program office. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires prior approval of the GCA.

Non-accountable COMSEC information, though not tracked in the COMSEC material control system, may still require a level of control within a document control system. Refer to NSA/CSS Manual 3-16, Control of Communications Security Material, and the Committee on National Security Systems Instruction (CNSSI) 4001, Controlled Cryptographic Items, for guidance.

Personnel accessing classified COMSEC material shall be U.S. citizens possessing a final U.S. security clearance equal to or greater than the classification of the COMSEC material and will have received a Cryptographic Access Briefing. Access to un-keyed/unclassified Controlled Cryptographic Items (CCI) does not require a security clearance but is restricted to U.S. citizens who have received a COMSEC briefing. Contractor is authorized to subcontract classified COMSEC work.

Government Facilities: Classified COMSEC equipment and material at the MOBs must be shipped, received, and stored by the host unit COMSEC account. See AFMAN 17-1302, Communications Security (COMSEC) Operations for guidance.

Contractor Facilities: Cleared contractor facilities shall maintain COMSEC accounts for shipping, receiving, and storing COMSEC equipment and material up to and including SECRET, to include un-keyed/unclassified Controlled Cryptographic Items (CCI) equipment and material. The Contractor shall receive and provide on-site accountability and safeguarding of classified material and equipment at its cleared contractor facilities IAW NSA/CSS Policy Manual 3-16, Control of COMSEC Material. NSA maintains oversight for COMSEC at Contractor Facilities.

d. Reference Blk 10j/11l: CUI information provided and generated under this contract shall be safeguarded as specified in DoDI 5200.48_DAFI16-1403, Controlled Unclassified Information, DoDM 5200.01, Vol 1_AFMAN16-1404, Vol 1, Air Force Information Security Program, and DoDM 5400.07_AFMAN33-302 Air Force Manual, DoD Freedom of Information Act (FOIA) Program. The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

e. Reference Blk 10k: C-37 A/B Program Protection Plan and all of its appendices will be provided by the C-37 Program Office.

f. Reference Blk 11c: Any classified information generated in the performance of this contract shall require the contractor to apply derivative classification and markings consistent with the source material. Contractor will also reference the current version of the C-37A/B Security Classification Guide when generating or deriving classified material or hardware. All classified information received or generated will be properly stored and handled according to the markings on the material. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of this contract, the U.S. Government will be contacted for proper disposition instructions.

g. Reference Blk 11d: The contractor is required to provide adequate and approved storage for classified hardware or material to the level of SECRET which because of size or quantity cannot be safeguarded in a General Service Administration (GSA) approved security container. The contractor must provide adequate storage for classified hardware and materials to the level of SECRET which exceeds 2 cubic feet but not more than 18 cubic feet of storage area.

h. Reference Blk 11f: Overseas contractor performance will occur at Ramstein Air Base, Germany. DCSA is relieved of all security oversight for performance on the installation and overseas performance. Security oversight at Ramstein Air Base, Germany will be under the cognizance of HQ USAFE/IP. Contractor is also authorized to access classified material and equipment up to and including SECRET at deployed locations outside the U.S. in support of the work effort.

i. Reference Blk 11g: Contractor will maintain a current DD Form 2345, Military Critical Technical Data Agreement (MCTDA) certification and obtain need-to-know concurrence from the PCO when requesting to obtain access to unclassified technical data disclosing militarily critical technology with military or space application that is under the control of, or in the possession of, the DoD and required for contract performance.

Access to DTIC can be requested through the DD Form 1540, Registration for Scientific and Technical Information Services or online at: https://discover.dtic.mil/dtic-registration-benefits/dtic-registration/

j. Reference Blk 11j: OPSEC requirements apply. The contractor must comply with the U.S. Government, DoD, Air Force, and AFMC Operations Security (OPSEC) plans. Contractor shall develop and implement an Operations Security (OPSEC) plan for the protection of Critical Program Information (CPI) identified in the C-37 Program Protection Plan and other CPI as identified by the PCO. See C-37A/B Program Protection Plan, Annex F: AFLCMC PE Operations Security Plan.

k. Reference Blk 11k: Contractor is authorized to use the Defense Courier Service (DCS) for shipping and receiving classified COMSEC equipment and keying material.

Go to https://www.ustranscom.mil/cmd/associated/dcd/ for Defense Courier Service points of contacts and guidance.

l. Reference Blk 11m: The Following FARS and DFARS Clauses apply, FAR Clause 52.204-2, FAR Clause 52.204-21, DFARS Clause 252.204-7012, DFARS 252.204-7000, DFARS 252.204-7008 and DFARS 252.204-7009. Pre-contract award access to classified is not required.

1. Contractor shall apply "PL 3" level security protection to C-20 and C-37 aircraft while at the contractor's cleared facilities IAW DAFI 31-101, Integrated Defense.

2. Permanently assigned contractor personnel at the Main Operating Bases (MOBs) working directly on the aircraft shall have a SECRET clearance (interim or final). Contractor personnel performing recurring maintenance on the aircraft at the contractor facilities shall, at a minimum, have received a favorable background check. Individuals requiring infrequent access to the aircraft at the MOBs or contractor facilities shall be escorted in a ratio not exceeding four escorted persons to one authorized escort.

3. Contractor shall establish means to ensure only authorized contractor personnel are allowed unescorted access onto or near C-20 or C-37 aircraft. Escort exemptions are U.S. Military, U.S. Government Civilian and Defense Contract Management Agency (DCMA) personnel with a SECRET security clearance who have an official requirement in conjunction with the maintenance of the aircraft.

4. The Government will provide the Contractor with a copy of the program Cybersecurity Strategy as an annex to the Program Protection Plan.

5. Partial work performance may occur at undisclosed installations. Upon determination, the contractor shall provide the on-base servicing Security Forces office all information required by the Notification of Government Security Activity Clause and any other additional information required by that office.

6. DoDM 5220.32, Volume 2, National Industrial Security Program: Procedures for Government Activities Relating to Foreign Ownership, Control, or Influence (FOCI) and 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM) shall apply to this contract.

7. Provide the information requested by the Notification of Government Security Activity and Visitor Group Security Agreements clause, Air Force Federal Acquisition Regulation Supplement (AFFARS 5352.024-9000, to the security activities listed in Block 8a.

8. Primary work performance will occur at military installations in the U.S. and worldwide. The installation commanders have formally elected to retain security cognizance as outlined in Table 2 below; therefore, DCSA is relieved of inspection responsibility for contractor performance at these military installations.

m. Reference Blk 12: Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the 32 CFR Part 117 section 117.19 (g) (7), unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office phone contact information and, if available, an e-mail address identified in Item 12.

Contractor is to submit requests through the Contracting Officer for OPSEC Program Manager review and public release authorization. The Contracting Officer will provide contractor with written approval/disapproval. Information requiring AF or DoD-level review will be reviewed by the unit’s OPSEC Program Manager or Coordinator who will in-turn forward to the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690.

Transmission of public release request via e-mail is not authorized. Requests must be sent via mail to:

AFLCMC/WVV

3001 Staff Dr. 1AC4-105A Tinker Air Force Base, OK 73145 Attn: C-37 PO PCO Subcontractors must submit requests for public release through the prime contractor. The prime contractor is responsible for submitting the subcontractor’s request for public release to the GCA public release authority identified in item 12.

n. Reference Blk 13: Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware. All classified information received or generated will be properly stored and handled according to the markings on the material. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of the contract, the U.S. Government will be contacted for proper disposition instructions. Contractor will abide by and shall apply derivative classification and markings governed by the current version of the security classification guidance.

The Contractor will confirm the Original Classification Authority (OCA) has not extended the classification period by consulting with the C-37 Program Office prior to declassifying or downgrading information marked with a date or event on the "declassify on" line.

The Contractor will notify the Government Contracting Activity and the Government Security Manager (contact information listed below) within 48 hours of any incident involving the actual or suspected compromise/loss of classified information to enable the Government to conduct immediate assessment of potential impact pending formal inquiry/investigation. Actual or suspected compromise of Covered Defense Information will be reported IAW DFARS Clause 252.204-7012.

Government Security Manager:

Courtney Penn

AFLCMC/WVV

(405) 734-6460 aflcmc.wvv.securityworkflow@us.af.mil Contractor is governed by the security guidance listed below:

· 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM)

· AFMAN 17-1302, Communications Security (COMSEC) Operations

· C-37 A/B Program Protection Plan and it’s appendices:

· C-37A/B PPP ANNEX A: C-37A/B Security Classification Guide

· C-37A/B PPP ANNEX B: AFLCMC PE Directorate Counterintelligence Support Plan

· C-37A/B PPP ANNEX C: C-37 Critical Program Information (CPI) and Critical Components (CC) Determination

· C-37A/B PPP ANNEX D: C-37 A/B Anti-Tamper Plan (Classified, will be provided via appropriate means upon request/contract award)

· C-37A/B PPP ANNEX E: C-37 A/B Cybersecurity Strategy

· C-37A/B PPP ANNEX F: AFLCMC PE Operations Security Plan

· DoDI 5200.48_DAFI 16-1403, Controlled Unclassified Information (CUI)

· DoDI 5230.09, Clearance of DoD Information for Public Release

· DoDI 5230.24, Distribution Statements on Technical Documents

· DAFI 31-101, Integrated Defense

· NSA/CSS Policy Manual 3-16, Control of Communication Security (COMSEC) Material

DoDI 5200.48, March 2020, has replaced and cancelled DoDM 5200.0l, Volume 4 removing the designation of "For Official Use Only" FOUO. Contractors will no longer use the FOUO designation and change to using CUI. For this contract the Contractor will safeguard Controlled Unclassified Information (CUI) in accordance with DoDI 5200.48, Controlled Unclassified Information, 06 Mar 20, and AFGM 2020-16-01, Air Force Guidance Memorandum for Controlled Unclassified Information, 23 Jul 20.

There is no requirement for the Contractor to re-mark legacy FOUO documents as CUI. However, any new document created with information derived from legacy material must be marked as CUI if the information qualifies as CUI. DoD legacy information does not automatically become CUI. It must be reviewed by the owner of the information to determine if it meets the CUI requirements. If it is determined the specific legacy information meets the CUI requirements, it will be marked in accordance with this issuance and corresponding manual.

The "Controlled Unclassified Information (CUI)" marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that laws, regulations, or government-wide policies allow for, or require safeguarding. All CUI must be controlled until authorized for public release in accordance with departmental public release policies.

Other non-security markings, such as, "Limited Official Use" and "Official Use Only" are used by non-DoD User Agencies for the same type of information and should be safeguarded and handled in accordance with instructions received from such user agencies.

Use of the above markings does not mean that the information cannot be released to the public, only that it must be reviewed by the government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

Contractors may disseminate "CUI" information to their employees and subcontractors who have a need for the information in conjunction with a classified contract.

3. Storage:

During working hours, "CUI" and legacy "FOUO" information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files, desks, is adequate when internal building security is provided during non-working hours. When such internal security controls are not exercised, locked building, or rooms will provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desk or bookcases.

4. Transmission:

CUI information and material may be transmitted via first class mail, parcel post, or, bulk shipments. When practical, CUI information may be transmitted electronically (e.g., data, website, or e-mail), via approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure or transport layer security (e.g., https). Avoid wireless telephone transmission of CUI when other options are available. CUI transmission via facsimile machine is permitted; however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive CUI; facsimile machine located in a controlled government environment).

5. Disposition:

All CUI records must follow the approved mandatory disposition authorities whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and DoDI 5200.48.

6. Unauthorized Disclosure (UD):

During working hours, steps will be taken to minimize the risk of access by unauthorized personnel, such as not reading, discussing, or leaving CUI information unattended where unauthorized personnel are present. After working hours, CUI information will be stored in unlocked containers, desks, or cabinets if the government or government-contract building provides security for continuous monitoring of access. If building security is not provided, the information will be stored in locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas. The concept of a controlled environment means there is sufficient internal security measures in place to prevent or detect unauthorized access to CUI. For DoD, an open storage environment meets these requirements.

7. Controlled Unclassified Military Information (CUMI), Controlled Unclassified Information (CUI):

The Contractor shall provide adequate security to safeguard Controlled Unclassified Military Information (CUMI), Controlled Unclassified Information (CUI) and Unclassified Controlled Technical information from compromise. The Contractor will notify the Government of any security violation, security incident, or of any indication of a potential unauthorized disclosure or compromise of classified or CUI.

NOTE: PII is unique information about an individual that can be used to distinguish or trace his or her identity. It includes, but is not limited to name, social security number, date and place of birth, mother's maiden name, home address and phone number, personal email address, biometric records, financial records, medical history, criminal or employment history, and other information to which a security manager may have access. PII does not include an individual's name when it is associated with work elements, such as duty phone number, duty address and U.S. Government mail address.

o. Reference Blk 18e:

Denene M. Ballenger Administrative Contracting Officer DCMA AIMO Greenville - DCMAA-AGA 244 Terminal Road, Bldg. 1040 Greenville, SC 29605-5298 864-299-7175 Denene.M.Ballenger.civ@mail.mil