COMBINED DD FORM 254 PDF AND CONTINUATION SHEET.pdf

DD FORM 254, US ARMY SCI ADDENDUM

Yes (1) This contract requires access to Sensitive Compartmented Information (SCI). The Commander, US Army Intelligence and Security Command (INSCOM), acting on behalf of the DA Deputy Chief of Staff (DCS), G-2 is the Cognizant Security Authority (CSA) for the US Army, has exclusive security responsibility for all SCI released to the contractor or developed under the contract and held within the Contractor's SCI Facility (SCIF) or Co-utilization Agreement (CUA) SCIF.

Yes (2) The Defense Intelligence Agency (DIA) has security inspection responsibility for SCI and the Defense Security Service (DSS) retains responsibility for all collateral information released or developed under the contract and held within the DoD Contractor's SCIF.

Yes (3) The manuals, regulations and directives checked below provide the necessary guidance for physical, personnel, and information security for safeguarding SCI, and are part of the security classification specification for this contract:

Yes (a) ICD 503, Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation

Yes (b) ICD 704 Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information

No (c) IC Tech Spec-for ICD/ICS 705, Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities

Yes (d) Signals Intelligence Security Regulations (SISR) (Available from the CM) Yes (e) Imagery Policy Series (Available from the CM) Yes (f) DoDM 5105 Vol 1 3 SCI Administrative Security Manual.

Yes (g) AR 25-2, Army Cybersecurity Yes (h) AR 380-28, Army Sensitive Compartmented Information No (i) AR 380-381, Special Access Programs (SAPS).

Yes (j) Army Handbook for SCI Contracts.

No (k) Other N/A

Yes (4) Contract estimated completion date: 13 Feb 2028 ( normally provides the Period of Performance. Option years are not to be included, as an option is not valid until exercised by the government.)

Yes (5) Security Personnel. The Contractor Monitor and the contractor security officer must be registered in the Army Centralized Contracts and Security Portal (ACCS) at the level of contract, in order to process SCI actions.

a. Primary SCI Contract Monitor:

Name: Ryan R. Schellig Telephone: 256-876-6849 Mailing Address: Bldg. 5301, Redstone Arsenal AL 35898 Email Address: ryan.r.schellig.civ@army.mil

b. Alternate SCI Contract Monitor:

Name: Steven L. Thornton Telephone: 256-955-6094 Mailing Address: Bldg. 5301, Redstone Arsenal AL 35898 Email Address: steven.l.thornton20.civ@army.mil

c. Contractor Security POC:

Name: TBD Telephone: TBD Mailing Address: TBD Email Address: TBD

(The Contract Monitor and the contractor security officer must be registered in the Army Contractor Automated Verification System (ACAVS) in order to process SCI actions)

Yes (6) All DD Forms 254 prepared for subcontracts involving access to SCI under this contract must be forwarded to the CM for approval and then to HQ INSCOM, ACofS Security, G2, Contractor Support Element (CSE) for review and concurrence prior to award of the subcontract.

Yes (7) Visit certification to DoD location is not required, as need to know and accesses is verified at the visiting facility. Non DoD locations the contractor must process request for SCI visit certification(s) through ACCS to the CM for approval and to Contractor Support Element (CSE) for review and processing. Visit Certification request must be submitted at least ten (10) working days prior to the visit.

Yes (8 actual

AVS after completion of debriefing.

Yes (9) The contractor will not reproduce any SCI related material without prior written permission of the

CM.

Yes (10) Security Classification Guides or extracts are attached or will be provided under separate cover.

Yes (11) Electronic processing of SCI requires accreditation of the equipment in accordance with ICD 503 and AR 25-2.

No (12) This contract requires a contractor Controlled Space or CUA (No/No)

Yes (13) Request for Indoctrination/Debrief Authority

Yes (14) This contract requires X(SI) X(TK) X (G) X (HCS) (Add others as required)

Yes (15) The contractor will perform SCI work under this contract at the following locations located on Redstone Arsenal, AL:

Agency Name: PEO STRI, Targets and Threat Systems Management Offices (TSMO) SCI SMO or Cage Code: W8109F, 118

Yes (16) The contractor identified in Block 6 is a Multiple Facility Organization (MFO) and is authorized to submit DD254 and SCI Addendum for the following SCI locations (Facility Name and CAGE Code).

No (17) SCI Courier Requirement

DD Form 254 20220128 Continuation Sheets Page 1 of 16 ARTS Number: 007106RED230004622 Contract Number: Update upon award Prime Contractor: Update upon award Location: Regional Network Enterprise Center Redstone Arsenal, AL

This contract requires access to proscribed information. Proscribed information is defined in DoD 5220.22-M (National Industrial Security Program Operating Manual) (NISPOM) as Top Secret, Communications Security (COMSEC) information or material, excluding controlled cryptographic items when unkeyed or utilized with unclassified keys, Restricted Data (RD), Special Access Program (SAP) information, or Sensitive Compartmented Information (SCI).

Subcontracting any work effort that requires access to proscribed information requires written approval of the Contracting Officer.

1. (Ref Block 1a) Contractor requires at least a FINAL TOP SECRET facility clearance at time of contract award.

2. (Ref Block 1b) There is no requirement for the Contractor to have or establish safeguarding capability for classified information at any Contractor facility, in support of this work effort.

3. (Ref Block 8a) Network support including NIPRNET and SIPRNET will be conducted on Redstone Arsenal, AL and ancillary sites affiliated with Redstone Arsenal, AL.

4. (Ref Block 10a) The Contractor is not required to establish a Communications Security (COMSEC) account. However, some work performance will/may require access to classified COMSEC information, COMSEC key, and/or Controlled Cryptographic Items (CCI), at Government work locations only. There may be a requirement for supporting Government KMI Operational Account Manager (KOAM) to hand-receipt COMSEC material to properly identified/trained Contractor personnel at specified Government work locations, in order to perform the mission under the terms of the contract. Contractor access to classified COMSEC information requires U.S. citizenship, a final personnel security clearance at the requisite level, established need-to-know in accordance with this contract, and receipt of all required briefings prior to being granted access to such information.

4a. (Ref Block 10a) The Contractor shall control, protect, safeguard, and account for COMSEC and/or CCI in accordance with AR 380-40, TB 380-41, Local Standard Operating Procedures, and other Army, DoD and National level policy, as directed by the Government requiring activity.

The Contractor shall comply with all applicable regulations and directives, including requiring activity policies and procedures in effect at requiring activity work locations. The Contractor shall remove any Contractor employee who fails to comply with COMSEC directives, policies and procedures from performance on this contract. Additionally, contractor employees who violate COMSEC directives, policies and procedures could be subject to criminal prosecution or other legal action.

4b. (Ref Block 10a) Contractor personnel shall be familiar with AR 380-40, Chapter 6, on what constitutes a reportable incident and shall report any such incident immediately but no later than four (4) hours to the responsible KOAM and Contracting Officer’s Representative (COR).

Contractor personnel shall be familiar with the security classification guidelines in AR 380-40, Appendix B and shall ensure any incident information is properly marked/protected and reported via approved secure means from Government requiring activity work locations.

4c. (Ref Block 10a) Contractor personnel shall be subject to the Department of the Army Cryptographic Access Program (DACAP) prior to being granted access to any SECRET cryptographic information that meets the criteria established in AR 380-40, Chapter 7.

DD Form 254 20220128 Continuation Sheets Page 2 of 16

Contract Number: Update upon award Prime Contractor: Update upon award Location: Regional Network Enterprise Center Redstone Arsenal, AL

Contractor enrollment in DACAP requires: receipt of a DACAP briefing administered by the supporting Government requiring activity Security Office, G-2/S-2; written acknowledgement that they may be randomly selected to undergo a non-lifestyle, counterintelligence scope polygraph (CSP) examination administered in accordance with applicable directives and law;

agreement to report all foreign travel and contacts in accordance with AR 380-67; and execution of Part I, SD 572 (Cryptographic Access Certification and Termination Statement). By executing Part I, SD 572, the Contractor employee acknowledges and agrees to be subject to a CSP examination as a requirement for continuing access to classified cryptographic information.

When such access is no longer required, Contractor personnel will be debriefed and shall execute Part II of the SD 572. The Government will deny access to classified cryptographic information to any Contractor employee who refuses to participate in DACAP. The Government will also immediately terminate access to classified cryptographic information for any Contractor employee who declines to submit to a CSP examination, and that employee shall be debriefed by the Government requiring activity Security Office, G-2/S-2. In the event that a Contactor employee is selected for a CSP examination, the Government will reimburse the Contractor in accordance with FAR part 31.205-46, for approved travel incurred to comply with CSP examination requirements under the DACAP.

4d. (Ref Block 10a) Contractor access to classified COMSEC information requires a final facility clearance commensurate with or higher than the classification level of information involved.

Written approval of the Contracting Officer (KO) is required prior to sub-contracting any work effort that requires access to COMSEC information.

4e. (Ref Block 10a) Contractor personnel may be required to transport (hand-carry) classified equipment and/or COMSEC items to/from work site to alternate locations on Redstone Arsenal, in support of this contract. See paragraph 8h, below, for additional guidance and requirements.

5. (Ref Block 10e (2)) At contract start date, these personnel will require a FINAL SECRET security clearance based on a Tier 3 (T3) Investigation or T3 Reinvestigation (T3R) Contractor personnel shall maintain the required security clearance throughout employment on this contract. ICD 703, Protection of Classified National Intelligence, including Sensitive Compartmented Information (SCI) provides policy on control, access, and dissemination of intelligence information. This policy is available from the Government requiring activity. Written approval of the Contracting Officer is required prior to subcontracting any work effort that requires access to intelligence information.

6. (Ref Block 10j) Controlled Unclassified Information. CUI includes legacy For Official Use Only (FOUO) marked Information and Personally Identifiable Information (PII.) CUI received or generated under this contract shall be controlled and protected, marked, and safeguarded, as specified in AR 25-55 (DA Freedom of Information Act Program), Chapter 4, AR 380-5 (Army Information Security Program) and DODI 5200.48, Controlled Unclassified Information (CUI).

This includes PII, as defined in DoDI 5400.11 (DoD Privacy and Civil Liberties Programs). DoD provides on-line CUI training, https://securityhub.usalearning.gov/, which is required of all personnel on the contract within 30 calendar days of employee work start. Certificate of completion shall be provided to the COR and maintained on file.

7. (Ref Block 10k) Work performance will require Contractor access to Army Knowledge Online (AKO), Non-secure Internet Protocol Router Network (NIPRNET), Secure Internet Protocol

DD Form 254 20220128 Continuation Sheets Page 3 of 16

Contract Number: Update upon award Prime Contractor: Update upon award Location: Regional Network Enterprise Center Redstone Arsenal, AL

Router Network (SIPRNET) and other systems as stated in the PWS. All access to SIPRNET or any classified system will only be at Government requiring activity work locations. All access to Government systems will be sponsored by the COR.

7a. (Ref Block 10k) The Contractor shall use only Government provided property to access the VPN. Per DA Pam 25-1-1, the only authorized access from DoD-owned computers, Government provided bootable media, systems, and networks to the Internet is via the NIPRNET. The VPN allows remote DoD computers to meet this requirement by providing a secure tunnel to the NIPRNET. The VPN shall be used at all times that the DoD-owned computer or Government approved DoD bootable media is accessing the Internet when using commercial Internet Service Providers. Bootable media shall be utilized in accordance with its Authorization to Operate (ATO), and shall not be modified from the government approved and issued version. The Contractor shall verify that they are using the most recent version of approved bootable media, and that the bootable media has a valid and current ATO.

Unauthorized split-tunneling of VPN connections by the Contractor is prohibited. Authorized split-tunneling configurations will be accompanied by a signed Authorizing Official (AO), GO/SES level, risk assessment.

7b. (Ref Block 10k) There is not a defined requirement for access to NATO documents or information under this contract. However, accreditation of the SIPRNET backbone to transport NATO Secret and below information resulted in additional security measures across the board.

Per DoDM 5200.01-V1, all cleared DoD military, civilian and contractor personnel briefed on their responsibilities for protecting U.S. classified information, shall be briefed simultaneously on the requirements for protecting NATO classified information. The Contractor Facility Security Officer (FSO) shall provide a NATO awareness briefing to all cleared contractor personnel and shall maintain a written acknowledgement of the individual’s receipt of the awareness briefing along with a statement of understanding of responsibilities for safeguarding NATO classified information. The NATO awareness briefing does not constitute “need to know” or “approval for access” to NATO classified information, however, per AR 380-5, briefings shall be recorded in the Joint Personnel Adjudication System (JPAS). Briefings shall also be recorded in the successor system Defense Information System for Security (DISS) as migration to the DISS continues.

8. (Ref Block 11a) All cleared contractor personnel who have an established need-to-know in accordance with this contract, and who have satisfied prerequisite security training requirements, are authorized access to classified information which supports this work effort.

Access to classified information shall be at Government work locations only, to include while in a temporary duty (TDY) travel status in support of this contract. The Contractor shall not remove any classified materials or information, from the Government work site(s), nor shall the Contractor reproduce, generate, or store any classified materials or information relating to this contract at other than specified Government work locations. This includes downloading, storing, or transmitting classified information on or to any unauthorized software, hardware, or information technology system. Classified material shall only be stored at Government work locations in Government provided GSA approved security containers or as directed by the COR and/or supporting Government Security Officials.

8a. (Ref Block 11a) Within Army, DISS is the system of record for security information. The Contractor FSO shall ensure all cleared personnel performing work under this contract have

DD Form 254 20220128 Continuation Sheets Page 4 of 16

Contract Number: Update upon award Prime Contractor: Update upon award Location: Regional Network Enterprise Center Redstone Arsenal, AL security access level, Contractor affiliation, Security Management Office (SMO) affiliation and all other required information accurately reflected/populated in DISS. The Contractor shall make available to the Government requiring activity, and all work locations under this contract, that information necessary to enable verification of security access level/affiliation via DISS.

8b. (Ref Block 11a) Visit Authorization Requests (VARs) are required at all Government work locations. The Contractor shall submit a VAR via DISS, which reflects all cleared contractor personnel who will be performing on this contract. VARs shall include the contract number in the Title block and COR/Government Requiring Activity (RA) POC name and telephone number. All VARs shall be maintained current throughout the life of the contract and shall be updated as personnel or other relevant changes occur. All Contractor personnel shall be reflected on a current VAR in order to perform on this contract. The Prime contractor shall ensure all subcontractors comply with these requirements. All VARs shall be submitted to locations reflected below:

1) RNEC-C Redstone Arsenal, AL SMO code: W6S4AA6

2) 93d SIGNAL BDE SMO code: WCEHAA6

3) 7th SC (T) SMO code: WH4UAA3

4) Other locations as required.

8c. (Ref Block 11a) Security In/Out-Processing. All contractor personnel integrated or embedded with NETCOM organizations shall in-process through the supporting NETCOM organizational S-2/Security Office at work performance start date. All contractor personnel integrated or embedded with NETCOM organizations shall out-process and clear through the supporting NETCOM organizational S-2/Security Office upon termination of employment on the contract or upon contract expiration/termination, whichever occurs first. Above requirements are applicable if there is a change in primary work performance location while employed on the contract. The prime contractor shall ensure above requirements are included in subcontracts and lower tier contracts when personnel are integrated or embedded with NETCOM organizations. Per AR 380-49, “embedded and/or integrated contractors are those who operate out of government-supplied on-base space.”

8d. (Ref Block 11a) Army Learning Management System (ALMS) Initial Security Orientation and Annual Refresher Training. Within 30 business days of work start date, contractor personnel shall complete the Department of the Army standardized computer web-based Initial Security Orientation training and annually thereafter, shall complete the Annual Security Refresher Training, both available at https://www.lms.army.mil, under Information Security Program Training. The system will automatically direct the user to the appropriate course based on their training history. Certificates of successful completion, of initial and annual refresher training, shall be provided to the COR within three (3) business days of completion of training. This training is in addition to unit or installation specific security training.

9. (Ref Block 11e) Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to Information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M) and any revisions to DoD 5220.22-M.

DD Form 254 20220128 Continuation Sheets Page 5 of 16

Contract Number: Update upon award Prime Contractor: Update upon award Location: Regional Network Enterprise Center Redstone Arsenal, AL

9a. (Ref Block 11e) This is a non-personal services contract (see block 9). Highest level security clearance requirement for this work effort is SECRET. All contractor personnel working on this contract shall have the required security clearance at performance start date and shall be able to maintain the required security clearances throughout employment on this contract. Security clearance requirements by functional category are reflected in the IA Table, below.

9b. (Ref Block 11e) Contractor personnel who require a Top Secret security clearance and who may require Privilege User system access or who may be performing Privilege User functions which require a Tier 5 (T5) investigation completed with a favorable fitness determination for Privilege User system access. If Contractor personnel do not have a favorable T5 or T5- Reinvestigation (T5R) on record, the Contractor shall contact the supporting Government Security Office/G2/S2 for submission of the T5 investigation (SF 86). The Contractor shall provide the contract/task order number as authority to request the investigation. Contractor interim privileged level access to Army systems prior to completion and favorable adjudication of the required investigation will be in accordance with current Army and DoD policy.

9c. (Ref Block 11e) Classified information generated or received during work performance on this contract shall be controlled, marked, protected, transmitted, transported, and safeguarded in accordance with AR 380-5 and current Army and DoD policy and shall only be at specified Government requiring activity work locations.

9d. (Ref Block 11e) The process of extracting, paraphrasing, restating or generating classified information based on a security classification guide or one or more source documents, or both, is derivative classification. Any derivatively classified information generated in performance of this contract shall normally be marked according to the classification markings reflected on the source material(s). However, a compilation of information could warrant a change in classification level of the information, or, it could warrant the classification of previously unclassified information. The Contractor shall consult with the COR regarding any potential classification issues when generating information and/or deliverables in support of this contract.

9e. (Ref Block 11e) The Government requiring activity will identify, or provide, additional instruction or appropriate security classification guides/guidance to the Contractor, as required.

The Contractor shall notify the COR, in writing, of any instance where referenced security classification guides/guidance cannot be accessed at links or sites specified in this contract or specified in separate correspondence. The prime contractor shall ensure all applicable security classification guides/guidance are made available to any subcontractor(s), as appropriate.

9f. (Ref Block 11e) In accordance with Under Secretary of Defense for Intelligence memorandum, 31 January 2019, subject: Derivative Classification Training, all DoD personnel with access to classified information must complete derivative classification training on an annual basis. All Contractor personnel who require access to classified information during work performance on this contract shall successfully complete initial derivative classification training at employee work performance start date and successfully complete derivative classification refresher training on an annual basis, thereafter. Access to classified includes, but is not limited to, access to classified systems and networks. Contractor initial and continued access to classified systems and networks is contingent upon successful completion of this prescribed training requirement. Derivative classification training is available on line at the Center for Development of Security Excellence (CDSE)/Security Training, Education and

DD Form 254 20220128 Continuation Sheets Page 6 of 16

Contract Number: Update upon award Prime Contractor: Update upon award Location: Regional Network Enterprise Center Redstone Arsenal, AL

Professionalization Portal (STEPP) website http://www.cdse.edu/stepp/index.html, under Information Security. (Derivative Classification Course (IF103.16)/ Derivative Classification Exam (IF109.06)/ Derivative Classification Refresher (IF 109.16)/Derivative Classification Exam (IF 109.06), or current versions). Certificates of successful completion of initial and annual refresher training shall be provided to the COR within three (3) business days of completion of training.

9g. (Ref Block 11e) The above training requirements are applicable to subcontractor and lower tier subcontractor personnel who require access to classified information. The prime Contractor shall require subcontractors to include above requirements in lower tier contracts.

9h. (Ref Block 11e) Contractor personnel may be required to transport (hand-carry) classified equipment and/or COMSEC items to and from Government work site to customer locations, on Redstone Arsenal, in support of this contract. The Prime Contractor shall submit written request through the COR to the supporting Government Security Office/G2/S2 and in the case of COMSEC, supporting Government KOAM, for required briefings and issuance of proper courier authorization documentation. Hand-carry of classified information shall be in accordance with AR 380-5, current Army and DoD policy, local policies and procedures and in the case of COMSEC, AR 380-40, TB 380-41 and Local COMSEC Standard Operating Procedures.

10. (Ref Block 11j) The Contractor is not required to develop an OPSEC Plan. However, the Contractor shall comply with DoD Directive 5205.02E, Army Regulation 530-1 and the requiring activity’s OPSEC program. The Contractor shall ensure all contractor employees and subcontractors performing work under this contract complete Level I OPSEC training within 30 calendar days of start of employee performance under this contract and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the COR upon request.

11. (Ref Block 11l) See paragraph 6 (Ref 10j) above for Controlled Unclassified Information.

12. (Ref Block 11m) Information Assurance/Cybersecurity (IA/CS) Training. All contractor personnel with access to Government information systems and networks shall successfully complete all required initial and annual IA/CS awareness training as specified in AR 25-2 and as directed by the Government requiring activity. Training is available at https://cs.signal.army.mil.

12a. (Ref Block 11m) Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at: https://atc.us.army.mil in the unit container designated by the COR.

Certificates of successful completion of IA training, Acceptable Use Policies (AUP), applicable baseline and computing environment (CE) certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

12b. (Ref Block 11m) The Contractor shall ensure that all contractor employees and subcontractor employees requiring IA/CS awareness training complete the training at start of work performance on this contract and annually thereafter for the duration of this contract.

DD Form 254 20220128 Continuation Sheets Page 7 of 16

Contract Number: Update upon award Prime Contractor: Update upon award Location: Regional Network Enterprise Center Redstone Arsenal, AL

12c. (Ref Block 11m) Information Assurance Workforce Certification. Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.239-7001 (Information Assurance Contractor Training and Certification) applies to this contract. This contract is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management IA skills for personnel performing IA functions within DoD. Functions spanning multiple levels require certification of the highest level functions. Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty.

12d. (Ref Block 11m) The Contractor shall ensure its IA workforce members have the baseline certifications corresponding to their IA functions, as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3 of DoD 8570.01-M at work performance start date. Contractors will obtain all required CE certificates within 6 months of being engaged. The IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. The Contractor shall ensure that all employee certifications remain active and are renewed prior to expiration.

12e. (Ref Block 11m) Each individual shall upload a copy of their certification(s) to ATCTS in their account. The ATCTS manager is required to verify the individual’s certification(s).

12f. (Ref Block 11m) Table 1 reflects the Personnel Security and IA Workforce Specialty requirements, aligning the IA functional responsibilities and access levels to the contract tasks, in accordance with DoD 8570.01-M:

Table 1.

Personnel Security, Information Technology Access and Cybersecurity Certification Requirements

FUNCTIONAL CATEGORY

NETWORK

TYPE

ACCOUNT

BACKGROUND

INVESTIGATIO

N REQUIRED

SECURITY

ACCESS

LEVEL

REQUIRED

IA/CS

CERTIFICATION

CATEGORY &

LEVEL

REQURED

(IAW DoD 8570.01-M and

BBP 05-PR-M-

0002)

COMPUTING

ENVIRONMENT

CERTIFICATION

REQUIRED

Program Manager Authorized

(General) user T3 Secret N/A NO

Systems Engineer-Senior Elevated

Privileged user T3 Secret IAT-III YES

Systems Engineer- Intermediate

Elevated Privileged user

T3 Secret IAT-II YES

Systems Engineer- Associate

Elevated Privileged user

T3 Secret IAT-II YES

DD Form 254 20220128 Continuation Sheets Page 8 of 16

Contract Number: Update upon award Prime Contractor: Update upon award Location: Regional Network Enterprise Center Redstone Arsenal, AL

Systems Administrator - Senior

Elevated Privileged user

T3 Secret IAT-II YES

Systems Administrator – Senior (SIPRNET/JWICS)

Elevated Privileged user

T5 Top

Secret/SCI

IAT-II YES

Systems Administrator - Intermediate

Elevated Privileged user

T3 Secret IAT-II YES

Systems Administrator - Associate

Elevated Privileged user

T3 Secret IAT-II YES

Database Administrator –

Senior

Elevated Privileged user

T3 Secret IAT-I YES

Database Administrator –

Intermediate

Elevated Privileged user

T3 Secret IAT-II YES

Database Administrator –

Associate

Elevated Privileged user

T3 Secret IAT-I YES

Facilities Manager / Data Center Manager

Limited Privileged User

T3 Secret IAT I NO

Communication Facility Engineer - Associate

Authorized (General) user

T3 Secret N/A NO

Communication Facility Engineer - Intermediate

Authorized (General) user

T3 Secret N/A NO

Computer User Support Specialist – Senior

(SIPRNET/JWICS)

Elevated Privileged user

T5 Top Secret/SCI

IAT-1 YES

Computer User Support Specialist - Senior

Elevated Privileged user

T3 Secret IAT-1 YES

Computer User Support Specialist - Intermediate

Elevated Privileged user

T3 Secret IAT-1 YES

Computer User Support Specialist - Associate

Elevated Privileged user

T3 Secret IAT-1 YES

Information Systems Auditor Senior

Limited Privileged User

T3 Secret IAT-1 YES

Information Systems Auditor

- Intermediate

Limited Privileged User

T3 Secret IAT-I YES

DD Form 254 20220128 Continuation Sheets Page 9 of 16

Contract Number: Update upon award

Information Systems Auditor

- Associate

Limited Privileged User

T3 Secret IAT-I YES

Network Administrator - Senior

Elevated Privileged user

T3 Secret IAT-II YES

Network Administrator - Intermediate

Elevated Privileged user

T3 Secret IAT-II YES

Network Administrator - Associate

Elevated Privileged user

T3 Secret IAT-II YES

Network Engineer-Senior Elevated

Privileged user T3 Secret IAT-II YES

Network Engineer- Intermediate

Elevated Privileged user

T3 Secret IAT-II YES

Network Engineer- Associate

Elevated Privileged user

T3 Secret IAT-I YES

Draftsman-Intermediate Limited

Privileged User T3 Secret NA NO

Video Teleconference Support-Senior

Limited Privileged User

T3 Secret NA YES

Video Teleconference Support-Intermediate

Limited Privileged User

T3 Secret NA YES

Video Teleconference Support-Associate

Limited Privileged User

T3 Secret NA YES

12g. (Ref Block 11m) Non-Government-owned computing systems or devices. The Contractor shall comply with AR 25-1 and AR 25-2. The Contractor shall not install or connect non- Government-owned computing systems or devices to Government networks without the COR's coordinating and obtaining proper authorization from the appropriate Information System Security Manager (ISSM), ensuring that all software has a Government Certificate of Networthiness (CoN) or has been authorized under the Risk Management Framework (RMF) Access Only process. The non-Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

12h. (Ref Block 11m) Protection of Controlled Unclassified Information (CUI). The Contractor shall ensure any CUI, which includes, but is not limited to legacy Personally Identifiable Information (PII) and For Official Use Only (FOUO), proprietary, and Law Enforcement Sensitive information residing on Mobile Computing Devices (MCD) or other external media, is protected

DD Form 254 20220128 Continuation Sheets Page 10 of 16

Contract Number: Update upon award Prime Contractor: Update upon award Location: Regional Network Enterprise Center Redstone Arsenal, AL in accordance with current Data at Rest (DAR) guidelines and requirements. The Contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to, laptop, netbook, notebook, or tablet computers, and Blackberry or equivalent devices.

External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks and other portable digital storage devices.

13. Access to Protected Information. Protected information means all non-public information, including, but not limited to, trade secrets or proprietary information of other Contractors, Government source selection information, Privacy Act or personally identifiable information (PII), or any other information with distribution limited by the U.S. Government. If, during the performance of this requirement, Contractor personnel obtain access by any means to protected information, they shall not disclose, publish, divulge, release, or make known, in any manner or to any extent, the information except as necessary to carry out duties under this contract.

Protected information shall be given only to persons specifically granted access to this sensitive information and may not be further divulged without specific prior written approval from an authorized U.S. Government individual. Further, contractor employees may use any non-public information for official/authorized U.S. Government purposes, and they shall not use the information for their personal gain, the gain of their employer, or the gain of anyone else. The Contractor shall notify the Contracting Officer of any potential organizational conflicts of interest created by any such access; however, a nondisclosure agreement will not overcome an Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5. Moreover, the Trade Secrets Act prohibits releasing proprietary information without the owner’s consent. Accordingly, all Government Contractors are required to mark their proprietary information, and any time the Contractor is given inadvertent access to such marked information, the Contractor shall inform the Contracting Officer of the access.

14. Common Access Card (CAC). The Government will provide special access badges as necessary. The Prime Contractor Facility Security Officer (FSO) shall ensure that all Contractor personnel acquire and maintain CACs. The approving Government Trusted Agent (TA) may give access to the FSO using the online Trusted Associate Sponsorship System (TASS), https://tass.dmdc.osd.mil/tass. Contractor eligibility remains in force during employment under the contract for those employees who have a valid and recurring requirement for access to Government facilities or automation systems to perform those duties stipulated in the contract.

The Contractor shall use a valid CAC to access the Government domain. The Contractor shall immediately return the CACs to the COR when the Contractor employee’s employment is terminated or upon expiration of the contract. The CACs expire when Contractor employee’s eligibility terminates or three years from the issuance date, whichever occurs first. The Contractor is responsible for all CACs and shall report all lost or stolen CACs to the COR immediately.

15. Contractor Identification Requirements. In accordance with FAR 37.114 (c), all contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious are required to identify themselves as such to avoid being mistaken for Government officials. Contractors performing work at Government workplaces shall provide their employees with an easily readable identification (ID) badge indicating the employee's name, the contractor's name, the functional area of assignment, and a recent color photograph of the employee. Contractors shall require their

DD Form 254 20220128 Continuation Sheets Page 11 of 16

Contract Number: Update upon award Prime Contractor: Update upon award Location: Regional Network Enterprise Center Redstone Arsenal, AL employees wear the ID badges visibly when performing work at Government workplaces.

Contractor personnel shall also ensure that all e-mails, documents or reports they produce are suitably marked as Contractor products and/or that Contractor participation is appropriately disclosed. All signature blocks on e-mails shall indicate that the sender is a Contractor employee and include the Contractor's company name. Contractor identification badges shall be worn in conjunction with any Government provided identification cards or badges.

16. Access and General Protection Security Policy and Procedures. Contractor and all associated sub-contractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce shall comply will all personal identity verification requirements of FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

16a. Contractor personnel shall comply with all entry control requirements and security policies/procedures in effect at all work and TDY locations. This includes, but is not limited to, displaying Common Access Card (CAC) or any special access badges as required at any work location.

17. Antiterrorism Level I Training. The Contractor shall ensure that all contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas complete Antiterrorism (AT) Level I awareness training within 30 calendar days after start of employee performance on this contract and annually thereafter.

Within 5 calendar days of training, the contractor shall certify to the COR or KO that all employees performing work under this contract have completed the AT Level I awareness training. AT Level I awareness training is available at:

https://jkodirect.jten.mil/Atlas2/faces/page/login/Login.seam (Course # JS-US007).

17a. Outside Continental United States (OCONUS) Travel. If this contract requires OCONUS travel, contractor employees shall obtain KO or COR approval prior to such travel. The contractor employees shall contact the Government requiring activity Antiterrorism Office (ATO) to receive a specific theater AT/threat briefing prior to departing on OCONUS temporary duty travel.

18. Counterintelligence Awareness and Reporting Program (CARP). Contractor personnel shall comply with all Counterintelligence Awareness and Reporting Program (CARP) reporting requirements in accordance with AR 381-12, and as directed by the Government requiring activity. Contractor personnel shall report threat-related incidents, behavioral indicators, and other matters of Counterintelligence (CI) interest as specified in AR 381-12, Chapter 3, to the nearest military CI office, the Facility Security Officer, the Federal Bureau of Investigation, or the Defense Counterintelligence and Security Agency (DCSA).

18a. The Contractor shall ensure all employees, to include sub-contractor employees, attend threat awareness training within 30 calendar days of employee work start date and annually thereafter. Training must be conducted by a supporting CI agent. The initial training may be

DD Form 254 20220128 Continuation Sheets Page 12 of 16

Contract Number: Update upon award Prime Contractor: Update upon award Location: Regional Network Enterprise Center Redstone Arsenal, AL satisfied by taking the authorized on-line training via AKO at: https://www.lms.army.mil if attendance at a CI training session is not possible within 30 calendar days of employee work start. Certificate of completion shall be maintained on file. The on-line training does not replace the requirement to attend the first available CI conducted threat awareness training session.

The contractor shall maintain training records that include employee name, training dates, training locations, and method of training and shall make such records available to the COR, upon request.

18b. Contractor personnel who require access to information, or who will be performing or participating in any functions, as outlined in AR 381-12, paragraph 2-6, shall contact their COR who will coordinate with the supporting Government Security Manager for scheduling of special CI threat-awareness briefings, and debriefings, as appropriate. This includes contractor personnel who require access to Sensitive Compartmented Information (SCI), Special Access Program (SAP) information, cryptographic information, or who are system administrators or key information network personnel with administrator-level privileges on classified or unclassified Army information systems. These contractor personnel shall notify their COR in advance of any foreign travel to determine if special CI threat travel briefings/debriefings are required, as specified in AR 381-12 paragraph 2-6a. The COR will coordinate with the supporting Government on-site Security Manager for this determination.

19. iWATCH. The Contractor shall ensure that all employees and subcontractor employees performing work under this contract are trained on the local iWATCH program within 30 calendar days of start of employee performance on this contract. The requiring activity ATO will provide the locally developed iWATCH training. The Contractor shall maintain all iWATCH training records and shall provide copies to the COR upon request.

20. Contractor personnel shall comply with all applicable security regulations, guidance, and procedures, including local, referenced in this DD Form 254, the Performance Work Statement (PWS), and in effect at all work locations. Contractor personnel shall attend all Government provided security and security awareness training as specified by the Government requiring activity. This includes successful completion of all required on-line security training, as directed by the Government requiring activity.

21. The prime contractor shall provide a copy of the DD Form 254 and all revisions, for any classified sub-contract supporting this work effort, to the Government requiring activity (COR, BDE INDSEC Specialist (if applicable), 7th SC (T) and NETCOM INDSEC Specialists). In addition, the prime contractor shall require any subcontractors who have lower tier subcontractors to also comply with this requirement. DD Forms 254 shall be provided to the following:

NETCOM Commander, 7th SC (Theater) ACofS, G-2 (NETC-IS) ATTN: NETC-SFC-ISS/G-2 2133 Cushing Street, Suite 2320 423 22nd Street, Bldg 21715 Fort Huachuca, AZ 85613-7070 Fort Gordon, GA 30905 Unclassified Fax: 520-538-8787 E-mail: usarmy.huachuca.netcom.list.G2- ACCS-team@army.mil

E-mail: usarmy.gordon.7-sig-cmd.list.cmd-g2-security@mail.mil

DD Form 254 20220128 Continuation Sheets Page 13 of 16

Contract Number: Update upon award

93d Signal Brigade Regional NEC-Central-Redstone ATTN: NETC-SFG-IS ATTN: Dominique Voltz 662 Sheppard Place Building 3400, Ajax Road Fort Eustis, VA 23604 Redstone Arsenal, AL 35898 Unclassified Fax 757-878-7785 Email: dominique.voltz.civ@army.mil E-mail: usarmy.jble.93-sig-bde.mbx.hq-93sb-s2@army.mil

Other locations as required or as directed by the Government requiring activity/COR.

22. Emergencies and Force Protection Conditions. During declared emergencies and/or elevated Force Protection Conditions (FPCONs) Charlie or Delta, contractor performance under this contract shall be determined by the COR or KO. All Contractor employees providing services under this contract are required to report for duty as scheduled and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the KO or COR. The Contractor Project Manager shall keep the COR apprised of all personnel whereabouts when in a temporary duty (TDY) location.

23. (Ref Block 14) Additional Security Requirements:

Technical Bulletin (TB)

TB 380-41 Security: Procedures for Safeguarding Accounting and Supply Control of COMSEC Material (FOUO)

Department of the Army Pamphlets (DA PAM)

DA Pam 25-1-1, Army Information Technology Implementation Instructions

DA Pam 25-2-6, Cybersecurity Training and Certification Program

DA Pam 25-2-9, Wireless Security Standards

DA Pam 25-2-7, Army Information System Privileged Access

Department of the Army CIO/G-6 Policies

Army CIO/G-6 List of Network Enterprise Centers (NEC) Service Level Agreement (SLA)/Operational Level Agreement (OLA) (Implemented by the Secretary of the Army (Office, Chief Information Officer, via OASA memorandum, SAIS-AOI, subject: Army Command, Control, Communications, Computers, and Information Management (C4IM) Services List current version is available from the R-NEC.

Army Information Technology Metrics Program (available from the R-NEC)

Department of the Army Regulations (AR)

DD Form 254 20220128 Continuation Sheets Page 14 of 16

Contract Number: Update upon award Prime Contractor: Update upon award Location: Regional Network Enterprise Center Redstone Arsenal, AL

AR 25-1 Army Information Technology

AR 25-2, Army Cybersecurity

AR 25-55, The Department of the Army Freedom of Information Act Program

AR 190-13, The Army Physical Security Program (CUI (previously FOUO) requires AKO access)

AR 190-51, Security of Unclassified Army Resources (Sensitive and Non-sensitive)

AR 380-5, Army Information Security Program

AR 380-28, Army Sensitive Compartmented Information Security Program

AR 380-40 Safeguarding and Controlling Communications Security Material (CUI (previously FOUO) requires AKO access)

AR 380-49, Industrial Security Program

AR 380-67, Personnel Security Program

AR 381-12, Threat Awareness and Reporting Program

AR 525-13, Antiterrorism (CUI (previously FOUO) requires AKO access)

AR 530-1, Operations Security (OPSEC)

Department of Defense Instructions (DoDI)

DoDI 5200.48, Controlled Unclassified Information (CUI)

DODI 5220.22, National Industrial Security Program (NISP)

DoDI 5400.11, DoD Privacy and Civil Liberties Programs

DoDI 8500.01, Cybersecurity

DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT)

Department of Defense Directives (DoDD)

DoDD 8100.2, Use of Commercial Wireless Devices, Services, and Technologies in The Department of Defense (DoD) Global Information Grid (GIG)

DoDD 8140.01, Cyberspace Workforce Management

Department of Defense Manuals

DD Form 254 20220128 Continuation Sheets Page 15 of 16

Contract Number: Update upon award

DoDM 5105.21-V1, Sensitive Compartmented Information (SCI) Administrative Security Manual:

Administration of Information and Information Systems Security

DoDM 5105.21-V2, Sensitive Compartmented Information (SCI) Administrative Security Manual:

Administration of Physical Security, Visitor Control, and Technical Security

DoDM 5105.21-V3, Sensitive Compartmented Information (SCI) Administrative Security Manual:

Administration of Personnel Security, Industrial Security, and Special Activities

DoDM 5200.01-V1, DoD Information Security Program: Overview, Classification, and Declassification

DoDM 5200.01-V2, DoD Information Security Program: Marking of Information

DoDM 5200.01-V3, DoD Information Security Program: Protection of Classified Information

DoD 5205.02, DoD Operations Security (OPSEC) Program Manual

DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM)

DoDM 5220.22-V2, National Industrial Security Program: Industrial Security Procedures for Government Activities

DoD 8570.01-M, Information Assurance Workforce Improvement Program

Defense Information Systems Agency (DISA)

DISA Cir 300-115-3, Defense Information Systems…