(CUI) SOW Adm 1 Security Requirements (CUI).docx

CUI - OPSEC

UNITED STATES SPECIAL OPERATIONS COMMAND (USSOCOM)

WARRIOR CARE PROGRAM (WCP)

WARRIOR CARE GLOBAL SUPPORT (WCGS) SERVICES

SOW Addendum 1 – Security Requirements

As referenced in SOW Section 9.0, the following information is provided as it relates to the Security requirements for this action.

9.0 SECURITY REQUIREMENTS.

9.1 Security will be in accordance with the attached DD254. Contractor team individual(s) supporting this task will be cleared at the TOP SECRET/SCI level at the start of the task.

(CUI) 8.1.1 At the discretion of the Government, selected individuals supporting this task order will require access to Special Access Program (SAP) information. Access to SAP information requires the requisite security clearance based on a security investigation with a date less than 5 years old and requires employees to undergo additional personnel security screening meeting the DoD SAP-accessing directives and policies.

9.1.2 Contractors will require access to SCI, Foreign Government Information, NATO and ACCM material in performance of this effort. Contractor will require access to NIPRNET/SIPRNET/JWICS/JIANT/SOIS computer systems at Government facilities.

9.1.3 Contractor will be authorized to courier classified information up to TOP SECRET//SCI in performance of official duties upon approval of and designation by the COR.

9.2 The Contractor shall ensure requirements for safeguarding classified information and classified materials, for obtaining and verifying personnel security clearances, for verifying security clearances and indoctrination of visitors, for controlling access to restricted areas, for protecting Government property, and for the security of automated and non-automated management information systems and data are fulfilled. The Contractor's management system shall prevent unauthorized disclosure of classified and sensitive unclassified information. The Government shall be immediately notified if any security incident or any indication of a potential unauthorized disclosure or compromise of classified or sensitive unclassified information.

9.3 The Contractor shall provide security management support. Typical efforts include, but are not limited to, performing classified document control functions, classified material inventories, program access requests, preparing and monitoring personnel indoctrination and debriefing agreements, and maintaining and using security-related databases.

9.4 The Contractor shall comply with the base contract SOFARS clause 5652.242-9002 Accounting for Common Access Cards (CACs) for Contractor Personnel Departing HQ USSOCOM.

9.5 INTELLIGENCE OVERSIGHT. In accordance with DoDD 5148.13, Intelligence Oversight, effective April 26, 2017, on all contracts under which Contractor personnel will be conducting intelligence or intelligence-related activities or supporting those efforts under DoD authorities, Contractor personnel shall report any questionable intelligence activities (QIAs) and significant or highly sensitive matters (S/HSMs). The Contractor personnel shall report all QIAs and S/HSMs immediately by secure means to USSOCOM Enterprise Intelligence Oversight Officer (IOO), SOJA, or SOIG. As required, pertinent POCs will be provided by the COR. Contractor personnel shall complete initial Intelligence Oversight (IO) training within 30 days of assignment to applicable contracts, and complete yearly annual refresher training. IO training will be provided by the Government at no additional cost to the Contractor.

9.6 SECURITY RELATED FUNCTIONS

When no Government employee or military member is available the contractor will be required to conduct security related functions (traditionally considered inherently Governmental functions) such as opening/closing of security containers, end-of-day checks for processing and safeguarding classified information/material, and arming/de-arming USSOCOM Buildings and Rooms at MacDill AFB, FL as identified in the DD254. The Government will provide appropriate training and related Standard Operating Procedures and processes to perform security related functions. If the contractor fails to properly conduct these responsibilities and a security violation/incident occurs, the Government will have the option to act against the company in accordance with (IAW) U.S. law. In addition, the company will be responsible for reviewing preliminary inquiry reports for any security violation/incident for which an employee is found culpable and provide a written response to the Government Contracting Agency (GCA) and Organizational Security Manager for actions taken against the employee.

Commercial Solutions for Classified (CSfC) Mobile Devices. IAW USDI & DOD CIO Memo, Security and Operational Guidance for Classified Portable Electronic Devices, dated 25 Sep 2015, cleared and trained DoD Contractors are authorized to use Commercial Solutions for Classified (CSfC) Mobile Devices outside of secure government and/or contractor facilities to effectively accomplish their mission. Contractors requiring the use of CSfC devices will submit a USSOCOM IMT 33, CSfC Device User Agreement & Hand Receipt and an Authorization of Issuance (AOI) Memorandum to their Contracting Officer’s Representative/Program Manager (COR/PM). Authorization of Issuance Memorandums must be endorsed at the 0-6 or GS/GM-15 level at a minimum. The COR/PM will forward the IMT 33 and AOI memo to their local Industrial Security Office. As acknowledged in the User Agreement, contractor will ensure safeguarding measures are adhered to and necessary privacy is available to eliminate the possibility of compromise of classified information. HQ USSOCOM users will follow guidance as outlined in USSOCOM Manual 380-19, Mobility and Wireless Communications. USSOCOM issued devices will not be introduced into cleared contractor facilities or be connected to SIPRNet other than through the USSOCOM network. Any misuse of the device outside of mission purposes or security incidents associated with or involving the device, may result in contractor’s termination of access or subject the contractor to appropriate disciplinary or criminal action.

9.7 COMMON ACCESS CARD (CAC)

Contractor employees that require access to government systems to perform services under this contract shall obtain a CAC. Proof of employment and security clearance/favorable background check is required before an identification (ID) CAC will be issued authorizing access to the Installation and government computer systems. CACs may not be issued to Contractor employees unless a data record authorizing CAC issuance is resident in the Defense Enrollment Eligibility Reporting System (DEERS). The Trusted Associate Sponsorship System (TASS) formerly called “Contractor Verification System (CVS)” was developed as a secure and authorized means of entering contractor data into DEERS in addition to automating the CAC application and approval process. To enter contractor data into TASS, the contractor's data must be resident in an authorized source database. Contractors must return the government credential to the TASS Trusted Agent as soon as one of the following occurs, unless otherwise determined by the service or agency:

9.8 ACCESS TO SYSTEMS CONTAINING PII

The contractor shall comply with the Privacy Act and all applicable agency regulations on individual privacy, to include DOD Directive 5400.11 “Department of Defense Privacy Program” and DOD 5400.11-R, Department of Defense Privacy Program.

9.9 SYSTEMS ACCESS

When requested by the government, the contractor shall provide access to and information regarding the systems that the contractor operates or maintains on behalf of the government under this contract.

9.10 SYSTEMS SECURITY

The contractor shall encrypt all contractor-owned laptops or other portable media storage devices that process or store PII, in accordance with National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) 140-2 (or successor). The contractor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the internet or other public networks.

9.11 DATA SECURITY

The contractor, unless otherwise authorized by the government, shall limit access to PII/PHI to those employees and Subcontractors who require the information to perform their official duties under this contract. The contractor, contractor employees, and subcontractors shall physically or electronically protect PII when not in use and/or under the control of an authorized individual. During contract performance, when PII/PHI is no longer needed or required to be retained under applicable government records retention policies, the contractor shall coordinate with the contracting officer to either turn over the PII to the government or shall destroy it through means that will make the PII irretrievable (i.e., permanently unavailable for access by any person). The contractor shall only use PII obtained under this contract for purposes of the contract and shall not collect or use such information for any other purpose without the prior written approval of the contracting officer. At expiration or termination of this contract, the contractor shall coordinate with the contracting officer to either turn over all PII managed under the contract that is in its possession to the government or successor contractor, or if the government so directs, destroy the PII.

9.12 DATA BREACH RESPONSE AND NOTIFICATION

The contractor shall adhere to the reporting and response requirements for PII set forth in Memorandum, Office of the Secretary of Defense, Subject: Safeguarding Against and Responding to the Breach of Personally Identifiable Information (PII), June 5, 2009, ALARCT 050/2009, DOD 5400.11-R, and any amendments and the Health Insurance Portability and Accountability Act of 1996. The contractor or its subcontractor(s) shall immediately notify the COTR upon discovery that a suspected or actual breach of PII has occurred. The notification shall include, to the greatest extent possible, the identification of everyone who’s PII has been or possibly has been breached. In addition, the contractor or its Subcontractor shall provide the COTR with any other available information that must be included in required breach reporting and notifications. The contractor shall provide this information at the time of the initial notification to the government or promptly thereafter as information becomes available. The government will determine whether a breach of PII has occurred, and whether breach notification to affected individuals is required. If breach notification to affected individuals is required, the government will determine if the contractor shall make the required notification. If the contractor is to notify the impacted population, it shall submit the notification letters to the COTR for review and approval.

9.13 COMMUNICATIONS SECURITY (COMSEC)

All communications with DOD organizations are subject to COMSEC review. The contractor shall be aware that telephone communications, and information technology (IT) networks are continually subject to intercept by unfriendly intelligence organizations. DOD has authorized the military department to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DOD organizations. Therefore, the contractor is advised that any time it places a call or receives a call it is subject to COMSEC procedures. The contractor shall assume the responsibility for ensuring wide and frequent dissemination of the above information to all employees dealing with DOD information. The contractor shall be aware of, and abide by, all government regulations concerning the authorized use of the government’s computer network (i.e.: viewing pornographic material or restricted/subversive sites on the web), including the restriction against using the network to recruit Government personnel or advertise job openings.

Controlled by: HQ USSOCOM Controlled by: USSOCOM WCP CUI Category: OPSEC Distribution/Dissemination Control: DISTRO C POC: Diego Esguerra, diego.esguerra.civ@socom.mil