FBI_Security_Requirements_Attachment.docx

Attachment J.2 FBI Security Requirements Contractors must meet all criteria stated in these regulations to be considered for award. This includes completing the Risk Assessment Questionnaire and Key Management Personnel List for the Prime Contractor and all proposed Subcontractors along with the Company Threat Assessments (CTA) Process for the Prime and all proposed subcontractors. The Non-Profit Information Technology Support and Services II Contract assumes that all Contractor personnel will require Top Secret Clearance. Future task orders issued may require various levels of security requirements, future task order clearance levels and security requirements will be determined at the task order level based on the work and access required for that task. In addition to the security requirements listed below, all contractors shall meet and implement the requirements identified in the most recent CJIS Controlled Access Protection Profile (CJIS CAPP) version and/or subsequent versions during the life of the contract. THE CJIS CAPP documents federal security requirements for the procurement, development, operation and maintenance for the CJIS Division IT information systems and services. THE FBI at the request of the contractor will provide the latest version to the CJIS CAPP as Government Furnished Equipment (GFE). This contract does not at this time require contractor’s to have a facility to perform work on this contract. However, if the facility does become a requirement due to unforeseen circumstances, physical security guidance will be provided at that time as part of that task order.

Classified Contract Special Security Requirements

The FBI has determined that performance of this effort requires that the Contractor have access to classified National Security Information (herein known as classified information). Classified information is Government information which requires protection in accordance with Executive Order 12356, Classified National Security Information, and supplementing directives. Executive Order 13292, dated 28 March 2003, “Further Amendment to Executive Order 12356, as amended, “Classified National Security Information” and implementation directives, provides principles and procedures for the proper classification and declassification of material. These principles and procedures are applicable to classified documents or materials generated by the contractor in performance of this contract.

This clause applies to the extent that this contract involves access to information classified (select either “Confidential”, “Secret” or “Top Secret”).

The contractor shall comply with:

(1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M)

(2) Any revisions to that manual, notice of which has been furnished to the contractor.

The Contractor shall abide by the requirements set forth in the DD Form 254 and the National Industrial Security Program Operating Manual (NISPOM), DoD 5200.22-M) for the protection of classified information at its cleared facility, if applicable, as directed by the DSS. If the Contractor has access to classified information at a FBI or other Government facility, it shall abide by the requirements set by the agency.

No classified document or material provided by the FBI, or generated by the contractor pursuant to the contract, may be downgraded or declassified unless authorized in writing by the CO.

The Contractor shall appoint a senior official to act as the Corporate Security Officer. The individual shall interface with the FBI Security Office on all security matters, to include physical, personnel and protection of all Government information and data accessed by the Contractor.

Contractor personnel will require access to classified information and have access to classified areas. Contractor personnel shall possess at least an active and transferable Government Secret clearance at the time of proposal submission. Contractors who will have access to FBI facilities, systems or data shall possess an active and transferable Top Secret clearance at the time of proposal submission. The Government reserves the right to waive this requirement for any portion of the work that deals with technologies or data that is in the public domain. Contractor personnel assigned to this project shall be subject to routine criminal and credit checks by the FBI.

Contractor personnel shall be subject to counterintelligence focused polygraph examinations at the Government's discretion. The polygraph examinations may be required prior to acceptance or at any time during the task order, without notice.

The contractor shall maintain an overall security program in accordance with the requirements of the NISP. All automated information systems utilized to process FBI information will be operated in accordance with the requirements of the NISPOM, NISPOM Supplement, dated February 1995, DCID 6/3 and/or FBI certification and accreditation policies and procedures, as appropriate. Revisions to these documents, when published, will be provided to the contractor and will become a part hereof upon such issuance.

If subsequent to the date of this contract, the security classification or security requirements under this contract are caused to be changed by the Government and if the changes cause an increase or decrease in security costs or otherwise affect any other term or condition of this contract, the contract shall be subject to an equitable adjustment as if the changes were directed under the Changes clause of this contract.

The contractor agrees to insert terms that conform substantially to the language of this clause, including this paragraph, but excluding any reference to the Changes clause of this contract, in all subcontracts under this contract that involve access to classified information.

The contractor is obligated to comply with all relevant clauses and provisions incorporated into this contract and with the Contractor Non Disclosure Agreement, and as referenced therein, the NISPOM, dated January 1995, and all applicable FBI security policies and procedures, including the DCIDs. As applicable, the contractor shall maintain a security program that meets the requirements of these documents.

Security requirements are a material conduction of this contract. This contract shall be subject to immediate termination for default, without the requirement for a 10-day cure notice, when it has been determined by the CO that a failure to fully comply with the security requirements of this contract resulted from the willful misconduct or lack of good faith on the part of any one of the Contractor’s directors or officers, or on the part of any of the managers, superintendents, or equivalents of the contractor who have supervision or direction of:

a. All or substantially all of the contractor’s business, or

b. All or substantially all of the contractor’s operations at any one plant or separate location in which this contract is being performed, or

c. A separate and complete major industrial operation in connection with the performance of this contract.

When deficiencies in the contractor’s security program are noted which do not warrant immediate default, the contractor shall be provided a written notice of the deficiencies and be given a period of 90 days in which to take corrective action. If the contractor fails to take the necessary corrective action, the CO may terminate the whole or any part of this contract, for default. The contractor shall maintain and administer, in accordance with all relevant clauses and provisions set forth or incorporated into this contract, a security program that meets the requirements of these documents.

Classified Contract Clauses, Company Threat Assessment (CTA Process), Acquisition Security Risk Assessment and Key Management Personnel Listing Clauses for Contracts Involving Access to Classified Information The Government intends to secure services or equipment from firms which are not deemed to be an acquisition risk. The Government reserves the right to contract with such Offerors under appropriate arrangements, when it determines that such contract will be in the best interest of the Government.

Accordingly, all Offerors responding to this proposal or initiating performance of a contract are required to answer the acquisition risk questions included in this section. All answers are to be reflective of the parent and subsidiary levels of an organization. Offerors are also required to request, collect, and forward to the Government answers to these acquisition risk questions from all subcontractors undertaking classified work under the Offeror's direction and control. Offerors are responsible for the thoroughness and completeness of each subcontractor's submission. Responses should specify, where necessary, the identity, nature, degree, and impact of any Foreign Ownership, Control, or Influence (FOCI) on their organization or activities, or the organization or activities of a subcontractor. Additionally, a Key Management Personnel Listing (KMPL) must be submitted for each entity for which acquisition risk information is required. The KMPL must identify senior management by full legal name, position, social security number, date/place of birth, and citizenship status.

The Offeror shall, in any case in which it believes that foreign influence exists or is being sought over its affairs, or the affairs of any subcontractor, promptly notify the Contracting Officer's Security Representative of all pertinent facts.

The Selected Offeror shall promptly disclose to the Contracting Officer's Security Representative any information pertaining to any interest of a FOCI nature in the Selected Offeror or subcontractor that has developed at any time during the Selected Offeror's duration or has subsequently come to the Selected Offeror's attention. Written notification to the Contracting Officer is required of the Selected Offeror or any subcontractor whenever there is a change in response to any of the acquisition risk questions.

The Offeror is responsible for initiating the submission of the required risk acquisition information and KMPL for all subcontractors undertaking classified work during the entire period of performance of the contract. Failure to comply shall be cause for default under the Default Clause of this contract.

Offerors shall complete the Acquisition Risk Questions and Key Management Personnel Listing (KMPL) for the prime contractor and all proposed subcontractors. Provision of false information shall be cause for default under the Default Clause of this contract.

The information in RFQ regarding Key Management Personnel, which may identify U.S. persons, is being requested pursuant to the National Security Act of 1947, as amended, and Director of Central Intelligence Directive 7/6, Community Acquisition Risk Center, or superseding Acts or Directives. The FBI will use this information to conduct the acquisition risk determination and may share the information internally and externally with members of the Intelligence Community and other U.S. Government entities, if necessary, consistent with appropriate routine uses for its Central Records System (CRS), Justice/FBI-002, last published in full in the Federal Register on February 20, 1998 (63 Fed. Reg. 8671), or any updates thereto. In the absence of proof of death of any of the Key Management Personnel, their consent, or an overriding public interest, the information will not otherwise be disseminated except pursuant to the routine uses for the CRS.

The Government reserves the right to prohibit individuals who are not U.S. citizens from all or certain aspects of the work to be performed under this Contract.

Foreign Ownership, Control, or Influence (FOCI) - For purposes of this clause, a U.S. company is considered under FOCI whenever a foreign interest has the power, direct or indirect, and whether or not exercisable through the ownership of the U.S. company's securities, by contractual arrangements or other means, to direct or decide matters affecting the management or operations of that company.

Changed conditions, such as change in ownership, indebtedness, or the foreign intelligence threat, may justify certain adjustments to the security terms under which a company is operating, or, alternatively, that different acquisition risk mitigation measures be employed. If a changed condition is of sufficient significance, it might also result in a determination that a company is no longer considered to be an acquisition risk. There is a continuing obligation of the Selected Offeror to advise the Government of such changed conditions. Failure to abide by this obligation shall be cause for default under the Default Clause of this contract.

Factors: The following factors will be used as the basis for making an acquisition risk determination. If the Offeror, or its proposed subcontractors, meet any of the following factors, they must identify themselves as a potential FOCI company and submit themselves for a Government acquisition risk evaluation and assessment:

(1) Ownership or beneficial ownership, direct or indirect, of 5 percent or more of the Offeror's company's voting securities by a foreign person.

(2) Ownership or beneficial ownership, direct or indirect, of 25 percent or more of any class of the Offeror's company's non- voting securities by a foreign person.

(3) Management positions, such as directors, officers, or executive personnel of the Offeror's company held by non-U.S. citizens.

(4) Foreign person power, direct or indirect, to control the election, appointment, or tenure of directors, officers, or executive personnel of the Offeror's company or other decisions or activities of the Offeror's company.

(5) Contracts, agreements, understandings, or arrangements between the Offeror's company and a foreign person.

(6) Loan arrangements between the Offeror's company and a foreign person if the Offeror's company's (the borrower) overall debt to equity ratio is 40:60 or greater; or financial obligations that are subject to the ability of a foreign person to demand repayment.

(7) Annual total revenues or net income in excess of 5 percent from a single foreign person or in excess of 30 percent from foreign persons in the aggregate.

(8) Ten percent or more of any class of the Offeror's voting securities held in "nominee shares", in "street names", or in some other method that does not disclose the beneficial ownership of equitable title.

(9) Interlocking directors with foreign persons and any officer or management official of the Offeror's company who is also employed by a foreign person.

(10) Any other factor that indicates or demonstrates a capability on the part of foreign persons to control or influence the operations or management of the Offeror's company.

(11) Ownership of 10 percent or more of any foreign interest.

Every effort must be made to ensure that supplies are provided and integrated and services are performed using sound security components, practices, and procedures. Acquisition of supplies or services from concerns under Foreign Ownership, Control, or Influence (FOCI) or of supplies developed, manufactured, maintained, or modified by concerns under FOCI (any or all of which shall be referred to herein as "Use of FOCI source") is of serious concern and must be approved prior to contract award and evaluated during contract performance. Approval decisions will be made on a case by case basis after the source or technology has been identified by the Offeror and subjected to a risk assessment.

Any Offeror responding to this Request for Proposal (RFP), Request for Quotation (RFQ), or Sealed Bid acknowledges the Government's requirements to secure services or equipment from firms which are not an acquisition risk; are not under Foreign Ownership, Control, or Influence (FOCI); or where any FOCI, in the opinion of the Government, adversely impacts on National Security or security requirements. The Offeror understands and agrees that the Government retains the right to reject any response to this RFP, RFQ, or Sealed Bid made by the Offeror, without any further recourse by or explanation to the Offeror, if the acquisition risk for that Offeror is determined by the Government to be an unacceptable security risk.

The risk assessment process will vary depending on the acquisition type and proposed use of a FOCI source, available risk mitigation measures, and the information/justification provided by the Offeror.

Risk assessments will be on a case by case basis and will be used to determine whether the use of a FOCI source poses an unacceptable security risk. If an unacceptable security risk is determined, the Government retains the right to reject the use of a FOCI source or to require that certain risk mitigation measures be taken by the contractor. Similarly, the Government retains the unilateral right to approve the use of a FOCI source when the risk assessment indicates that such use would be in the Governments' best interests. If the use of a FOCI source is not approved, no classified information will be disclosed to the Offeror as part of the Government's rationale for non approval. The Offeror (prime and subs) may not seek reimbursement from the Government for any costs associated with responding to this RFP, RFQ, or Sealed Bid, as a result of a FOCI nonapproval decision.

Requirements for Procurement of Critical Assets

Every effort must be made to ensure that supplies are provided and integrated and services are performed using sound security components, practices, and procedures. Acquisition of supplies or services from concerns under Foreign Ownership, Control, or Influence (FOCI) or of supplies developed, manufactured, maintained, or modified by concerns under FOCI (any or all of which shall be referred to herein as "Use of FOCI source") is of serious concern and must be approved prior to contract award. Approval decisions will be made on a case by case basis after the source or technology has been identified by the Offeror and subjected to a risk assessment.

The risk assessment process will vary depending on the acquisition type and proposed use of a FOCI source, available risk mitigation measures, and the information/justification provided by the Offeror.

Any Offeror responding to this Request for Proposal (RFP), Request for Quotation (RFQ), or Sealed Bid acknowledges the Government's requirements to secure services or equipment from firms which are not under Foreign Ownership, Control, or Influence (FOCI), or where any FOCI, in the opinion of the Government, adversely impacts on National Security or security requirements. The Offeror understands and agrees that the Government retains the right to reject any response to this RFP, RFQ, or Sealed Bid made by the Offeror, without any further recourse by or explanation to the Offeror, if the FOCI for that Offeror is determined by the Government to be an unacceptable security risk.

Risk assessments will be on a case by case basis and will be used to determine whether the use of a FOCI source poses an unacceptable security risk. If an unacceptable security risk is determined, the Government retains the right to reject the use of a FOCI source or to require that certain risk mitigation measures be taken by the Offeror. Similarly, the Government retains the unilateral right to approve the use of a FOCI source when the risk assessment indicates that such use would be in the Governments' best interests. If the use of a FOCI source is not approved, no classified information will be disclosed to the Offeror as part of the Government's rationale for non approval. The Offeror (prime and subs) may not seek reimbursement from the Government for any costs associated with responding to this RFP, RFQ or Sealed Bid, as a result of a FOCI nonapproval decision.

Offerors shall complete the Acquisition Risk Questions and Key Management Personnel Listing (KMPL) for the prime contractor and all proposed subcontractors. Provision of false information shall be cause for default under the Default Clause of this contract.

The information regarding Key Management Personnel, which may identify U.S. persons, is being requested pursuant to the National Security Act of 1947, as amended, Executive Order 12829, National Industrial Security Program, and Director of Central Intelligence Directive 7/6, Community Acquisition Risk Center, or superseding Acts, Orders or Directives. The FBI will use this information to conduct the acquisition risk determination and may share the information internally and externally with members of the Intelligence Community and other U.S. Government entities, if necessary, consistent with appropriate routine uses for its Central Records System (CRS), Justice/FBI-002, last published in full in the Federal Register on February 20, 1998 (63 Fed. Reg. 8671), or any updates thereto. In the absence of proof of death of any of the Key Management Personnel, their consent, or an overriding public interest, the information will not otherwise be disseminated except pursuant to the routine uses for the CRS.

The Government reserves the right to prohibit individuals who are not U.S. citizens from all or certain aspects of the work to be performed under this Contract.

Foreign Ownership, Control, or Influence (FOCI) For purposes of this clause, a U.S. company is considered under FOCI whenever a foreign interest has the power, direct or indirect, and whether or not exercisable through the ownership of the U.S. company's securities, by contractual arrangements or other means, to direct or decide matters affecting the management or operations of that company.

Changed conditions, such as change in ownership, indebtedness, or the foreign intelligence threat, may justify certain adjustments to the security terms under which a company is operating, or, alternatively, that different FOCI mitigation measures be employed. If a changed condition is of sufficient significance, it might also result in a determination that a company is no longer considered to be under FOCI. There is a continuing obligation of the Selected Offeror to advise the Government of such changed conditions. Failure to abide by this obligation shall be cause for default under the Default Clause of this contract.

Factors: The following factors will be used as the basis for making an acquisition risk determination. If the Offeror, or its proposed subcontractors, meet any of the following factors, they must identify themselves as a potential FOCI company and submit themselves for a Government FOCI evaluation and risk assessment:

(1) Ownership or beneficial ownership, direct or indirect, of 5 percent or more of the Offeror's company's voting securities by a foreign person.

(2) Ownership or beneficial ownership, direct or indirect, of 25 percent or more of any class of the Offeror's company's non- voting securities by a foreign person.

(3) Management positions, such as directors, officers, or executive personnel of the Offeror's company held by non-U.S. citizens.

(4) Foreign person power, direct or indirect, to control the election, appointment, or tenure of directors, officers or executive personnel of the Offeror's company or other decisions or activities of the Offeror's company.

(5) Contracts, agreements, understandings, or arrangements between the Offeror's company and a foreign person.

(6) Loan arrangements between the Offeror's company and a foreign person if the Offeror's company's (the borrower) overall debt to equity ratio is 40:60 or greater; or financial obligations that are subject to the ability of a foreign person to demand repayment.

(7) Annual total revenues or net income in excess of 5 percent from a single foreign person or in excess of 30 percent from foreign persons in the aggregate.

(8) Ten percent or more of any class of the Offeror's voting securities held in "nominee shares", in "street names", or in some other method that does not disclose the beneficial ownership of equitable title.

(9) Interlocking directors with foreign persons and any officer or management official of the Offeror's company who is also employed by a foreign person.

(10) Any other factor that indicates or demonstrates a capability on the part of foreign persons to control or influence the operations or management of the Offeror's company.

(11) Ownership of 10 percent or more of any foreign interest.

Every effort must be made to ensure that supplies are provided and integrated and services are performed using sound security components, practices, and procedures. Acquisition of supplies or services from concerns under Foreign Ownership, Control, or Influence (FOCI) or of supplies developed, manufactured, maintained, or modified by concerns under FOCI (any or all of which shall be referred to herein as "Use of FOCI source") is of serious concern and must be approved prior to contract award and evaluated during contract performance. Approval decisions will be made on a case by case basis after the source or technology has been identified by the Offeror and subjected to a risk assessment.

Any Offeror responding to this Request for Proposal (RFP), Request for Quotation (RFQ), or Sealed Bid acknowledges the Government's requirements to secure services or equipment from firms which are not an acquisition risk; are not under Foreign Ownership, Control, or Influence (FOCI); or where any FOCI, in the opinion of the Government, adversely impacts on National Security or security requirements. The Offeror understands and agrees that the Government retains the right to reject any response to this RFP, RFQ, or Sealed Bid made by the Offeror, without any further recourse by or explanation to the Offeror, if the acquisition risk for that Offeror is determined by the Government to be an unacceptable security risk.

The risk assessment process will vary depending on the acquisition type and proposed use of a FOCI source, available risk mitigation measures, and the information/justification provided by the Offeror.

Risk assessments will be on a case by case basis and will be used to determine whether the use of a FOCI source poses an unacceptable security risk. If an unacceptable security risk is determined, the Government retains the right to reject the use of a FOCI source or to require that certain risk mitigation measures be taken by the contractor. Similarly, the Government retains the unilateral right to approve the use of a FOCI source when the risk assessment indicates that such use would be in the Governments' best interests. If the use of a FOCI source is not approved, no classified information will be disclosed to the Offeror as part of the Government's rationale for non approval. The Offeror (prime and subs) may not seek reimbursement from the Government for any costs associated with responding to this RFP, RFQ, or Sealed Bid, as a result of a FOCI nonapproval decision.

As a member of the Intelligence Community (IC), the Federal Bureau of Investigation (FBI) has a responsibility to protect sources and methods and maintain a strong counterintelligence posture. The FBI’s Acquisition Security Unit (ASU) conducts company threat assessments (CTAs) on vendors with whom the FBI does business for all procurements that involve services requiring access to classified information, information technology hardware and software associated with FISMA or critical asset systems, and select audio visual and telecommunications equipment/systems. The risk of foreign exploitation of IC acquisitions has led to Acquisition Risk Directorate (ARD) Effective March 2010. The administrative control and maintenance of accurate records of contractors has been identified by both the Intelligence Community and FBI Executive Management as a matter of concern. This procurement is expected to result in the acquisition of services involving the assignment of contractor personnel to FBI locations. The Program Management Officer/Contracting Officer's Representative (COR), in coordination with the assigned Chief Security Officer, has determined this contract will require a CTA assessment to be completed for the work that will be performed under this contract. In order to meet these requirements and complete the CTA process as part of the contractor’s security plan all companies are required to submit answers to the Acquisition Risk Questions and a completed Key Management Personnel Listing (KMPL) at the parent and subsidiary levels of an organization. The Acquisition Risk Questions and KMPL format is enclosed below.

Additional Completion Guidance When completing the Acquisition Risk Questions, all positive (yes) answers must be answered completely and in accordance with the instructions for completing the document. The vendor may attach additional pages or documentation as necessary to answer the questions.

Key Management Personnel (KMPs) are identified as the Chairman of the Board; Directors (the members of the Board of Directors); All Corporate Officers, to include but not limited to: President, Chief Executive Officer (CEO), Chief Operating Officer (COO), Chief Technology Officer (CTO), Chief Information Officer (CIO), Corporate Vice Presidents, Secretary, Treasurer/Chief Financial Officer (CFO); other Executive Personnel; and the Facility Security Officer if the company has a facility security clearance. Additionally, if there are any individuals with significant control within the company/entity who are not officers or directors, they should be included on the KMP List as well.

The KMPL must include, full legal names (first, middle, and last names), Position Title, Social Security Number, Date of Birth, Place of Birth (city and state/country), and citizenship (i.e. USA, German, Canadian) are required.

Acquisition Risk Questions

Company Name: _______________________________________________________________ Address: _____________________________________________________________________ Date: ________________________________________________________________________

1. In the aggregate, does any foreign person own, or have any type of ownership of 5 percent or more in your organization in either a direct or indirect way?

If yes, please list all parents, both foreign and domestic, by name and address, through to the ultimate parent, to include percentage of ownership. This should include any and all foreign investments in the entity. Include country of origin. Include any special right or privileges involved in the ownership. Foreign person is defined as any foreign interest and any U.S. Person effectively owned or controlled by a foreign interest. Foreign interest is defined as any foreign government, to include any agency or representatives of that government; or any form of business or legally organized entity chartered or incorporated under the laws of any country other than the U.S. or its possessions; and any person who is not a citizen of the U.S.

2. Does your organization, either directly or indirectly, own 10 percent or more of a foreign interest?

If yes, please list all involved by name, address, and country, with percentage of ownership. Include the names of the personnel running the facilities.

3. Are there any non-U.S. citizens holding a position at the organization as either a corporate officer, member of the Board of Directors (or other similar governing body), or any other position such as executive / senior management personnel, partners, regents, or trustees?

Please list all corporate officers (Chairman of the Board, President, Chief Executive Officer, Vice-Presidents, Secretary, Treasurer, Chief Information Officer, Chief Financial Officer, and General Counsel), executive personnel (Facility Security Officer) and all other Board of Director members by full legal name, title, date and place of birth, Social Security Number, and citizenship.

4. Does any foreign person or entity have direct or indirect ability to influence or control the appointment or tenure of the Board of Directors (or similar governing body); any other management positions; or the direction, control, or decisions of the organization?

Identify the individuals by full legal name, title, and citizenship. Provide a full explanation of the individual’s control or influence.

5. Does the organization have any type of contractual agreement or understanding with any foreign interest?

This would include licenses, distributorships, contracts, purchase orders, sales agreements, etc. For each instance, provide the name of the foreign entity, its country, the percentage of gross income derived, and the nature of the involvement including what type of technology or product is involved, whether the product or service is either defense or nuclear related, whether classified or export controlled information is involved, and whether there is compliance with all U.S. export laws. If not defense or nuclear related, the listing of contracts can be done by listing similar equipment by country and percentage.

6. Does the organization have any indebtedness, liabilities, obligations, or act as a guarantor to any foreign interest?

If yes, give details concerning with whom the debt or guarantee is, where they are located, the conditions or covenants regarding the debt, and what collateral, if any, was pledged. If stock or assets are pledged, provide copies of the pertinent documents. Provide details on procedures for default of the loans. This answer must be answered affirmatively even if the entity holding the loan is a U.S. entity of a foreign institution.

7. In the last fiscal year, did the organization derive 5 percent or more of its income from one single foreign source, and/or more than 30 percent aggregately from numerous foreign sources?

If yes to either portion, please identify the sources from which the income is derived, to include name of entity, country, and percentage. Identify whether classified or export controlled information or technology is involved. If so, attach copies of licenses.

8. Is 10 percent or more of the organization’s securities held in any manner that does not disclose the beneficial owner, such as “nominee shares” or “street names”?

If yes, identify the foreign institutional investors by name, address, and percentage of securities owned. Indicate whether there have been any attempts to exert control or influence over management or policies of the organization. If available, include SEC Schedules 13D or 13H.

9. Do any corporate officers (Chairman of the Board, President, Chief Executive Officer, Vice-Presidents, Secretary, Treasurer, Chief Information Officer, Chief Financial Officer, and General Counsel), executive personnel (Facility Security Officer) and all other Board of Director members) also hold any type of position with a foreign interest?

Identify by name, title, citizenship or immigration status, whether the individual holds a personnel security clearance or is excluded from access, each individual meeting this criteria. Also, identify the name and address of each organization with which the individual holds a position, and in what capacity.

10. Are there any other factors or issues that may indicate or show the possibility of foreign influence or control over the management of the organization that have not already been addressed?

If yes, please describe in detail the involvement of the foreign entity, as well as why it is not reportable in accordance with the previous questions.

Key Management Personnel Listing (KMPL)

Information Security Requirements

a. All FBI information made available to or generated by this task shall, at a minimum, be considered FBI sensitive. This includes, but is not limited to: all notes, documents, test data, databases, reports, magnetic media, reports, data deliverables, electronic mail, et cetera. All FBI sensitive information shall be protected from unauthorized access and shall be disposed of in accordance with FBI security.

b. All Contractor equipment, networks, personal computers, digital assistants, or other devices are not authorized unless otherwise noted to store FBI information. The FBI reserves the right to procure, retain, or destroy any device not successfully sanitized of FBI information.

c. At the direction of the FBI COR, Contractor personnel not upholding the FBI standards of conduct, or if creating conflicts with the FBI's interests, shall be removed from all activities on this effort.

Information Technology Security Requirements

a. The Contractor shall present all software and hardware to the FBI for virus scanning prior to entering FBI space and/or use on FBI IT systems. Software use shall be in compliance with software licenses. The use of shareware shall be controlled and/or supplied by the FBI. Under no circumstances shall the Contractor introduce software and/or hardware into an FBI IT system without authorization.

b. Test software and vendor diagnostic software used on any FBI IT system shall not be removed from FBI control. Test and vendor diagnostic software shall be scanned, write-protected, and retained by the FBI. Only this copy of the software shall be used on FBI IT systems.

c. Within FBI facilities, under no circumstances shall personally-owned or Contractor-owned equipment or media be used to process FBI information. Government-furnished equipment (GFE), as specified in a contract or statement of work, will be utilized.

d. The Contractor shall turn over all failed electronic storage and memory devices to designated FBI personnel. The Contractor shall not remove any electronic and memory devices that have been connected to, or have processed data on an FBI IT system. The FBI reserves the right to procure and to retain any media that has not been successfully sanitized prior to release back to a vendor/contractor.

e. Storage media and systems with non-removable storage media shall only be transferred through maintenance channels approved by the FBI. Only storage media and systems that have been sanitized and declassified (if necessary) will be released from FBI control for maintenance.

f. To the extent possible, information shall be stored on FBI-owned storage media. Provisions shall be made which allow for FBI retention of non-removable, nonvolatile storage devices (e.g., microcomputer hard drives) if the device cannot be successfully sanitized through disk methodologies approved by the FBI Security Division at the completion of the tasking.

g. Each Contractor-owned device or media (e.g., personal digital assistants, laptops, floppy disks, compact disks, universal serial bus (USB) storage devices, etc.) brought into FBI facilities, regardless of source and prior to use, will be virus scanned. Each device or media that cannot be properly scanned will not be permitted in the facility.

h. FBI IT policies prohibit access for remote maintenance and diagnostics by non-FBI personnel. Exceptions can only be negotiated with, and granted by, the FBI Security Division, and are to be obtained in consultation with the COR and CO.

i. All connections to non-FBI networks will be approved on a case-by-case basis by the FBI Security Division and are to be obtained in consultation the COR and CO. As part of this approval process, supporting documentation must be provided to the FBI.

j. The exchange of data between Contractor and/or Subcontractor sites or between the Contractor/Subcontractor and the FBI will be approved on a case-by-base basis by the FBI Security Division in consultation COR and CO.

k. All maintenance work performed at an FBI site will be supervised by FBI personnel knowledgeable in the operation of the IT system regardless of the classification of the system or its associated media. All Contractor on-site maintenance personnel shall meet the personnel security requirements.

l. For security reasons, placement and removal of computers and related media to operational environments where classified information is processed shall be approved by the FBI Task Order (TO) COR.

m. All non-FBI portable devices are prohibited from connectivity to any FBI IT system.

n. Any person who knowingly, willingly, or negligently discloses any FBI information (to include, but not limited to data, systems configurations, facilities, personnel, and procedures) to unauthorized persons without prior written FBI approval shall be subject to the appropriate penalties and sanctions under the law (i.e., Privacy Act, Computer Fraud and Abuse Act, National Security Act, or appropriate espionage statutes).

o. Non-FBI employees who violate FBI security policy are subject to having their clearance revoked and access to FBI IT systems and facilities terminated.

Consent for Warrantless Searches

a. All cleared personnel accessing information within FBI controlled space are required to execute and comply with FBI Form FD 1001 Consent for Warrantless Searches of Department of Justice (DOJ) Workplaces as a condition of working at FBI facilities. The Contractor shall incorporate verbiage requiring personnel to sign and/or comply with said form. The contractor shall require personnel to acknowledge their understanding for compliance with the Warrantless Searches requirement. The Director, FBI, implemented the Attorney General's policy subjecting employees to warrantless physical searches of their offices or immediate workplaces within DOJ premises when authorized by the Attorney General (AG) or the Deputy Attorney General (DAG) based upon a determination that:

1) Information the Department deems credible indicates that the employee is, or may be, disclosing classified information in an unauthorized manner;

2) Information the Department deems credible indicates that the employee has incurred excessive indebtedness or has acquired a level of affluence can not be reasonably explained by other information;

3) Information the Department deems credible indicates that the employee had the capability and opportunity to disclose classified information that is believed to have been lost or compromised to a foreign power or an agent of a foreign power; or

4) Information the Department deems credible indicates that the employee has repeatedly or significantly mishandled or improperly stored classified information.

b. The search may extend to the entire office or workplace and anything within it that might hold classified information, including locked containers (such as briefcases) and electronic storage media (such as computer disk and handheld computers), whether owned by the government, by the employee, or by a third party. The search may be conducted by appropriate FBI personnel and/or law enforcement officers, on an announced or unannounced basis, during the workday or after hours. If discovered during a search, evidence of misconduct - whether related to storage or classified information, storage of sensitive but unclassified information, or a crime - will be collected and reported to appropriate authorities.

c. All forms will be retained by the FBI during the period the individual is providing services and two years after that individual's departure before final disposition is taken.

Non-Disclosure of Information Contractor personnel assigned under this contract may have access to sensitive information dealing with both national security and competition sensitive information. The Contractor shall be responsible for any disclosure of information outside the FBI that has not been previously approved. Furthermore, the Contractor shall ensure that personnel supporting the FBI shall not provide sensitive information to others within their company. The Contractor shall immediately report to the CO and COTR any unauthorized disclosures. Because of the sensitivity of work performed at the FBI, all Contractor personnel shall be required to sign Non-Disclosure Agreement(s) provided by the Government in order to perform their work.

Publications

a. The Federal Bureau of Investigation (FBI) specifically requires that Contractors shall not divulge, publish, or disclose information or produce material acquired as or derived from the performance of their duties.

b. For purposes of this Clause, "Information" shall include but not be limited to: in any media or all media including on the web or web sites; publications, studies, books, theses, photographs, films, public announcements, or press releases describing any part of the subject matter of this contract or any phase of any program hereunder, except to the extent such is:

c. No release of information shall be made without the prior written consent of the Office of Public Affairs and the Contracting Officer. The contractor and author are warned that disclosure is not without potential consequences. The FBI will make every effort to review proposed publications in a timely manner to accommodate theses and other publications.

d. Where appropriate, in accordance with established academic publishing practices, the FBI reserves the right to author/co-author any publication derived from this contract.

e. These obligations do not cease upon completion of the contract.

Personnel Security

a. All Contractor personnel granted FBI site access shall comply with all FBI security policies and procedures, to include all personnel access policies, system access policies, information security and information technology security requirements.

b. The FBI will maintain a listing of cleared Contractor employees who have been authorized to work on this task. The Contractor shall provide personnel from this list to perform required services. The Contractor shall immediately notify the FBI of any information on authorized Contractor personnel in its possession that may reflect on an individual’s suitability to continue working on this effort (e.g., bankruptcy, law enforcement contact, criminal arrests, civil proceedings, unfavorable tax matters, and failure to honor legitimate debts).

c. The Contractor is advised that, upon awarding of the contract, their personnel will be processed in accordance with the FBI’s Industrial Security Program.

d. The Contractor is advised that FBI decisions concerning granting of access to FBI assets are made on a case-by-case basis and access/clearance will be granted only where such access is clearly consistent with the mission and of the FBI. If for any reason an individual is denied access/clearance by the FBI, the FBI will not disclose the reason for denial and will only make such disclosure to the affected party pursuant to the provisions of the Freedom of Information or Privacy Act. The FBI will not be liable for any expense in the replacement of a denied individual or any costs incurred by the Contractor as a result of such denial.

e. The Contractor is advised that Contractor personnel with criminal histories, such as arrest records, may be denied access. The Contractor is advised that personnel that are illegal and/or undocumented aliens shall be excluded from this effort and if proposed, their identities may be referred to other cognizant law enforcement agencies for appropriate action.

f. The Contractor is advised that the FBI reserves the right to reinvestigate/recheck Contractor personnel on a periodic basis or when facts or information indicates access may no longer be clearly consistent with FBI’s mission and responsibilities.

g. The Contractor is advised that the FBI reserves the right to revoke any Contractor employee’s access to its facilities or property where such access is no longer clearly consistent with the FBI’s missions and responsibilities. The Contractor agrees to immediately remove that individual from the FBI facility in such circumstances.

h. The Contractor is advised that regardless of a Contractor’s clearance and access level, the FBI reserves the right to provide an FBI escort, knowledgeable in the tasking area, in situations where contracted services may affect the integrity of existing protection measures (e.g., information technology system maintenance activities).

i. The Contractor is advised that in determining eligibility for access, the FBI may investigate and consider any matter that relates to the determination of access is clearly consistent with the interests of national security. This includes random controlled substance testing and, warrantless search and polygraph examinations if dictated by FBI or DOJ security policy directives. Failure of any part in the background investigation or periodic review will result in further evaluation and any doubt will be resolved in favor of the national security.

j. The Contractor is advised that as part of the clearance process, Contractor personnel will be interviewed by the FBI (or FBI contract investigators) regarding foreign travel, associates, residences, or other matter of concern to the FBI in deciding whether to grant access to its information, facilities, or property. During the period of performance of this contract, future FBI or DOJ security policy may dictate that individuals be requested to undergo a polygraph examination to fully resolve any security concerns. Refusal or failure to accurately complete the forms, to be interviewed, or to undergo a polygraph examination could cause denial of access/clearance to FBI information, facilities, or property.

k. The Department of Justice does not permit the use of non-U.S. citizens in the performance of this contract or commitment for any position that involves access to or development of any DOJ IT system. By signing the contract or commitment document, the contractor agrees to this restriction. This requirement shall be flowed down to all subcontractors and to all vendors, where applicable.

l. All Contractor personnel performing services under this contract within the United States shall meet the Department of Justice Residency Requirement.