(Draft) Exhibit E - HHM402-TBD APR-PD- 129-0098-25-Z Approved Draft SCP IOB.docx

UNCLASSIFIED

Security Continuation Pages Contract Number: HHM402-TBD APR# 129-0098-25-Z Approved Draft IOB

Baseline Security Classification Guidance (SCG): Shall be provided by the COR as required.

1a. The Contractor will be required to possess and maintain a Top Secret Facility clearance granted by the Defense Counterintelligence Security Agency (DCSA) prior to contract implementation and maintained throughout the life of the contract.

2a/7a - SUB-CONTRACT Procedures:

COR shall provide this office the company name and CAGE Code prior to award to validate facility clearance and level of safeguarding, if required. All security requirements levied upon the prime contractor and/or otherwise associated with this contract shall immediately be flowed down from the prime contractor to any sub-contractor (or from sub-contractor to a lower tier sub-contractor (2d Tier), regardless of the scope of any such participation should it require access to classified information or unescorted access to controlled space where classified information (regardless of media) and/or hardware is open-stored, generated or otherwise accessible.

The Notification of Intent (NOI) letter is not required at the time of award of contract when all subcontractors have been identified at the solicitation phase. Prime contractor should notify the COR, when there is a need to modify the original DD254. The COR will create a revision to the prime DD254 and complete the NOI letter. The NOI must include the original subcontractors and any other subcontractor(s) being added/removed. The NOI must be signed by the contracting officer. Upon approval send the DD254, the Security Continuation Pages (SCP) and approved NOI to the Industrial Security Office either by CMS, or group email accounts. Upon approval of the DD254, it will be returned to the COR to distribute to the prime contract company.

8a. /11a. Contract performance and access to classified information and or equipment is restricted to DIA, other IC Agencies and/or other U.S. controlled facilities.

The contractor (TBD) Facility Security Officer (FSO) on file with DCSA is: (TBD) If this information is not correct, the contractor must contact the DCSA Field Office identified in Block 6c, and update contractor information as applicable.

10a. COMSEC is the protective measures taken to deny unauthorized persons information derived from USG telecommunications relating to national security and to ensure the authenticity of such communications. Access to COMSEC material is restricted to US citizens holding a final US Government security clearance. Such information is not releasable to personnel holding only reciprocal clearance. The NOI letter is required from the Government Contracting Agency to grant COMSEC access to a Sub-contractor. Contractor must comply with DIA/CIO guidelines. The NSA Central Office of Record has primary responsibility for COMSEC.

10e. (1) See attached SCI Release of Intelligence Information for additional security requirements. Access to intelligence information requires Sensitive Compartmented Information (SCI) indoctrination and a final Top Secret U.S. Government clearance. Contract personnel will require access to ICD 703 “Protection of Classified National Intelligence up to the SCI. For SCI Requirements: The contractor must provide individuals who are able to achieve and maintain the adjudicative standards set forth in the Intelligence Community Directive (lCD) Number 704 "Personnel Security Standards And Procedures Governing Eligibility For Access to SCI and other Controlled Access Program Information," for continued employment. See DIA Security Requirements paragraph 1.8 for polygraph requirements.

10e. (2) See attached Non-SCI (also known as collateral) Release of Intelligence Information for additional security requirements. Contractor will require access to lCD 710 "Classification and Control Markings System" (11 SEP 2009)'' For Non-SCI Requirements: Secret or Top Secret: All contract personnel assigned under this contract must possess and maintain a current personnel security clearance of Top Secret in accordance with acquisition document (SOW, PWS or SOO). Personnel are required to sign a non-disclosure statement. No polygraph is required for Non-SCI contractors.

10g. Access to NATO material will be required for reference at the Government, or appropriately cleared contractor's facility. Access requires a final U.S. Government security clearance. Contractor personnel who require access to NATO Material, shall be briefed by the Government Contracting Agency. The Prime Contractor must receive approval from the Government Contracting Agency to grant NATO access to a sub-contractor. Contractor personnel shall be debriefed by the Government Cognizant Agency prior to departure from this contract. A NOI letter must be approved for sub-contracting.

10j. Controlled Unclassified Information (CUI): The Contractor is authorized and may have access to UNCLASSIFIED information/material identified as Controlled Unclassified Information (CUI). The contractor is prohibited from further disclosure/dissemination of this information without the expressed written authorization of DIA. CUI provided under this contract shall be safeguarded as specified in NIST Special Publication 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, February 20, 2020", and may be supplemented by DIA. Information marked with legacy CUI markings (e.g., “For Official Use Only” (FOUO)) shall be protected to the same standard as stipulated for CUI at the moderate confidentiality level in the referenced NIST Special Publication. In addition, contractors or sub-contractors must obtain written approval from DIA CO/COR or DIA Office for Congressional and Public Affairs (CP) prior to posting any unclassified information on any web site or the internet. This will also apply to any acknowledgement of association between the contractor/sub-contractor and DIA.

10k. OTHER INFORMATION:

a. All unclassified DOD information in the possession of non-DOD entities on non-DOD information systems shall be protected in accordance with DODI 8582.01.

11j. Operations Security (OPSEC):

a. The contractor will protect DIA information from adversarial exploitation of vulnerabilities identified during implementation of OPSEC Measures. The DOD and DIA policies and procedures described below provide details towards OPSEC Measures, the requirements below provide the minimum standards for OPSEC protection as directed in this contract.

b. The contract Program Manager (PM), Contracting Officer Representative (COR), Facility Security Officer (FSO), and contracted personnel will be familiar with OPSEC as descried in DODD 5205.02E, DODM 5205.02, and DIAD 5800.100. Other policies and procedures may apply if the contracted activity takes place in a Military Service or COCOM environment. Forward conflicts identified between local and DIA guidance to the DIA Element OPSEC Coordinator. The COR will provide updated DIA Element points of contact including OPSEC Coordinators, security, and counterintelligence.

c. OPSEC is a capability that identifies and controls critical information, indicators of friendly force actions attendant to military operations, and incorporates countermeasures to reduce the risk of an adversary exploiting vulnerabilities. The OPSEC process examines administration, acquisitions, and operations to determine exploitable evidence of classified or unclassified sensitive activity. The OPSEC process used in assessments and surveys is an analytical, risk-based process that incorporates five distinct elements detailed below.

· Identify Critical Information

· Conduct Threat Analysis

· Conduct Vulnerability Analysis

· Conduct Risk Assessment

· Apply Countermeasures 11j1. OPSEC Plans: OPSEC Plans provide the contractor and DIA elements a living document used to implement the appropriate countermeasures given the probability and impact of the assessed risk.

11j2. OPSEC Assessments: OPSEC assessments measure the contractors OPSEC posture. Conduct OPSEC assessments on an annual basis incorporating input from subject matter experts, counterintelligence, security, and cyber security personnel to assess threats and potential loss of critical information. Assessments are conducted:

a. Based on the sensitivity of the operation or program.

b. Based on adversarial attempts to gain critical information.

c. Prior to OPSEC program or plan development. The assessment establishes a profile by showing indicators that present exploitable vulnerabilities.

11j3. OPSEC Surveys: OPSEC surveys seek to reproduce the intelligence image in light of the known collection capabilities of adversaries. Surveys require a specialized team to look at an activity from an adversarial perspective to determine disclosure of critical information through normal operations and functions, identify vulnerabilities, and propose countermeasures. Surveys may include telecommunications monitoring, radio frequency monitoring, network and computer systems assessments, and OSINT collection. Survey team members use the same risk analysis criteria found in OPSEC Assessments every 3 years.

11j4. Content Reviews: A content or “OPSEC review” is an evaluation of information intended for release outside of DIA control, including public release. The review seeks to identify and protect DIA unclassified information that may individually or in the aggregate lead to the compromise of classified information and sensitive activities. Updated CIL’s are mandatory for Content Reviews.

11j5. Critical Information Lists (CIL): Critical information is information about administration, acquisitions, and operations that an adversary seeks in order to gain advantage. Such information, if revealed to an adversary, may prevent or degrade mission accomplishment, cause loss of life, or waste critical resources. The Critical Information List (CIL) contains critical information that has been coordinated and approved, and is used by DIA Affiliates to identify information requiring application of OPSEC measures. CIL’s are typically unclassified for widest dissemination. Classified CILs restrict dissemination depending on the sensitivity of the contracted activity.

11j6. Critical Program Information (CPI): CPI is a capability that contributes to DIA’s technical advantage. CPI can be unclassified, classified, and specific to RDT&E funded programs. Record CPI as critical information, protect CPI through OPSEC countermeasures, non-investigative and non-operational CI activities describes in DODI 5240.24, and Anti-Tamper (AT) analysis and protections described in DODI 5200.39 and DODD 5200.47E.

11j7. Supply Chain Risk Management (SCRM): Vulnerabilities to supply chains are susceptible to foreign subversion, exploitation, and sabotage. Record detailed supply chain information as critical information. The OPSEC assessment must incorporate supply chain information to determine vulnerabilities, determine risk to acquisition, and propose countermeasures.

11j8. OPSEC Deliverables:

a. Training. All DIA Affiliates will receive initial and reoccurring (annual) OPSEC training. The contractor will provide training to those with access to DIA information in accordance with DODD 5105.42 and DODD 5205.02E.

b. OPSEC Program Plan. The contractor will complete, implement, and maintain an OPSEC program plan specific to the location the contracted activity will occur at the beginning of the acquisitions process. Maintain and update annually OPSEC program plans detailing the OPSEC countermeasures identified during the OPSEC assessment. Provide a copy of the OPSEC program plan to the DIA element OPSEC coordinators and or DIA Program Manager at the beginning of the acquisition for review.

c. OPSEC Assessment. The contractor will complete, implement, and maintain an OPSEC assessment specific to the acquisition. The OPSEC assessment will meet the criteria established in DODM 5205.02. Route DIA security and counterintelligence support requests through the DIA element OPSEC coordinators and or DIA OPSEC Program Manager. Implement recommendations, OPSEC analysis, and planning materials provided by DIA element OPSEC coordinators and or DIA Program Manager, security and counterintelligence in a timely manner. Maintain a copy of the OPSEC assessment after completion of work for future reference. Provide annual updates to the OPSEC assessment to the DIA element OPSEC coordinators, security, and counterintelligence for review.

d. Public Release. The contractor will notify the DIA element OPSEC coordinators and or DIA Program Manager and seek concurrence prior to public release of any information related to the contracted activity.

11j9. OPSEC Reporting. DIA affiliates, including contractors and sub-contractors will report OPSEC vulnerabilities and violations directly to the DIA element OSPEC coordinators. OPSEC disputes and violations will be resolved at the OPSEC coordinator level. Contractors report OPSEC vulnerabilities that result in the theft, loss, spillage, and compromise of CPI, SCI, and SAP information to DIA’s CI & Security Reporting System (CISRS) found at https://diareporting.Dodiis.ic.gov/SelfReporting/. Contractors may also type “GO CISR” in the JWICS address bar to access CISRS directly

11l. Receive, Store, or Generate Controlled Unclassified Information (CUI). Item 10j (CUI/FOUO) and Item 11i (TEMPEST) only pertain for the protection of any CUI required in the performance of this classified contract. The NISPOM, does not provide specific guidance concerning CUI so the GCA must provide guidance on protection procedures in Item 13.

11m. Contract companies shall provide all cleared employees with security training and briefings commensurate with their involvement with classified information. All contractors’ training shall reinforce the information provided during the initial security briefing and shall keep cleared employees informed of appropriate changes in security regulations. Contractors shall maintain records about the programs offered and employee participation in them. Contractors may obtain defensive security, threat awareness, and other education and training information and material from their CSA or GCA or other sources.

12. Disclosure of any information related to this contract (classified or unclassified) is strictly prohibited without the expressed written consent of the CO/COR, with concurrence from SEC-1. This includes, but is not limited to, use of information in unclassified brochures, promotion sales, literature, reports to stockholders, or similar material.

DIA Security Requirements

1.1. Supply Chain Risk Management (SCRM) Guidance:

0. According to Intelligence Community Directive (ICD) 731, SCRM is the management of risk to the integrity, trustworthiness, and authenticity of products and services within the supply chain. It addresses the activities of foreign intelligence entities (as defined in ICD 750, Counterintelligence Programs) and any other adversarial attempts aimed at compromising the IC supply chain, which may include the introduction of counterfeit or malicious items into the IC supply chain.

b. The industry partner must address supply chain risk associated with the provision of systems, products, and services by employing a comprehensive SCRM plan that identifies supply chain vulnerabilities to information and communications technology (ICT) acquisition and development cycle applicable to this contract. That SCRM plan must be available to Security, SCRM PO, and Counterintelligence offices for review and compliance.

1. All potential and actual threat and vulnerabilities to the industry partner or DIA’s supply chain shall be reported to the Supply Chain Risk Management (SCRM) Program Office (PO) and mitigation strategies adopted.

2. Personnel supporting the contract should receive SCRM Awareness training initially then annually thereafter.

1.2. Antiterrorism Requirements for Contract Requirements in accordance with DOD Antiterrorism Guide: Contract Acquisition Documents shall include the Antiterrorism (AT) requirements listed below:

a. Annual Training. Employees requiring access to DIA facilities or automated information networks must complete Level I AT Awareness Training.

b. Travel Requirements. All persons performing overseas official travel on behalf of DIA shall comply with Department of Defense and DIA travel security requirements. Such persons shall obtain a security travel briefing from the Office of Security within three months prior to initiation of OCONUS travel.

c. Emergencies. While in DIA facilities, contractor personnel shall comply with posted evacuation procedures and instructions provided by facility security and emergency management personnel.

d. Mail and Deliveries. Mail and deliveries to DIA facilities are subject to inspection and shall be routed through the appropriate mail receiving facility.

1.3 Permanent/Visit Certifications

All classified permanent and visit certifications requests must be in support of this contract and requires coordination and authorization with the COR and DIA SSO. Permanent certifications are only processed at one year intervals. Visit requests are not authorized in place of submission of nominations. Contract personnel identified to provide support at the SCI level, shall submit an SCI Nomination.

1.4 Downgrading and Declassification:

Should a contractor believe (a) that information is classified improperly or unnecessarily; or (b) that current security considerations justify downgrading to a lower classification or upgrading to a higher classification; or (c) that the security classification guidance is improper or inadequate, the contractor shall discuss such issues with the CO/COR who will follow the guidance in DIAG 5240-4, “Security Classification Challenges."

1.5 HANDLING and SAFEGUARDING CLASSIFIED INFORMATION:Should not use a duplicate title “Security Requirement” suggest something else, Procedures?

All contract personnel providing support to the referenced contract are required to adhere to all requirements identified in the acquisition document (SOW/PWS/SOO), DD-254 and Security Continuation pages, applicable Federal, DOD, DIA directives, instructions and standard operating procedures, that includes the proper handling and safeguarding classified and unclassified information. Sponsor rules, regulations, direction, and requirements issued by COR or other authorized personnel for good order, administration, and security will apply to all Contractor personnel who enter the Government’s facilities. The Contractor shall comply with established security procedures for entering a facility and/or any special procedures that may be established for certain restricted areas. All persons granted access to premises in connection with the performance of this contract will be subject to the provisions of criminal or other laws protecting classified or intelligence information, including provisions of the espionage laws (Title 18, United States Code, sections 793, 794 and 798), provisions of the intelligence Identities Protection Act of 1982 (P.L. 97-200, SO U.S.C., 601 et. Seq.), and Title 32, Code of Federal Regulations (CFR), Section 1903. All persons performing work under this contract shall protect and safeguard national security information in accordance with Executive Orders, IC, DOD and DIA directives, instructions, and procedures.

1.6 SECURITY GUIDANCE:

a. Facility Clearance Requirements: The Contractor shall possess and maintain a Top Secret level facility clearance. Performance under the contract may require that the Contractor access data and information sensitive to another government agency, another government contractor, or of such nature that its dissemination or use other than as specified in this contract would be adverse to the interests of the Government or others. Neither the Contractor, nor its contract employees, shall divulge or release any information developed or obtained in the course of contract performance, except upon written approval of the Contract Officer. The Contractor shall not use, disclose or reproduce any sensitive contract information that bears a restrictive legend, other than as specified in this contract. Any question regarding information contained within the SOW, will be addressed to or reported to the Contract Officer. Notify the COR and DIA’s Industrial Security office in addition to DCSA of any change in conditions affecting the Facility Clearance consisting of but not limited to:

(1.) Any change of ownership, including stock transfers that affect control of the company.

(2.) Action to terminate business or operations for any reason, imminent adjudication or reorganization in bankruptcy, or any change that might affect the validity of the FCL. Any information previously reported to DCSA concerning foreign ownership, control or influence (FOCI).

(3.) Changes in Storage Capability. Any change in the storage capability that would raise or lower the level of classified information the facility is approved to safeguard.

(4.) Inability to Safeguard Classified Material. Any emergency situation that renders the facility incapable of safeguarding classified material.

b. SCI Security Requirements: Contract employees shall be United States (U.S.) citizen, possess and maintain a final TS personnel security clearance issued by the Office of Personnel Management (OPM), the Defense Industrial Security Clearance Office (DISCO), or another government agency for contract personnel providing support to referenced contract in accordance with DOD 5200.2-R (DOD Security Program), DOD 5105.21, Vol 1-3 (Sensitive Compartmented Information Administrative Security Program), and Intelligence Community Policy Guidance number 704.1 (Personnel Security investigative Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information). The Facility Security Officer (FSO) or Contract Special Security Officer (CSSO) must ensure that contract personnel who have been nominated to support the referenced contract have completed actions to take an ownership or servicing role within Defense Information Security Service (DISS) under its CAGE Code. The FSO or CSSO is required to verify that the nominated contractor possess a final Top Secret clearance based upon a current Single Scope Background Investigation (SSBI), Periodic Re-investigation (PR) or Phased Periodic Re-investigation (PPR). All nominations must be accompanied by an SF-86C (available through open sources). If the current investigation is out-of-scope, the FSO/CSSO must have initiated a PR, PPR or JVS must indicate enrollment in the Continuous Evaluation (CE) program. The nomination memorandum must be dated no later than 30 days from submission.

1) Interim Clearance: Contractor personnel, who possess an Interim SECRET or TOP SECRET clearance by DISCO or another agency are not authorized for SCI nomination to determine SCI eligibility until the completion of SSBI.

2) Reciprocity: Contract personnel previously granted SCI eligibility within the last 24 months or are currently in SCI access with no deviations, waivers or exceptions shall be reciprocally accepted for SCI eligibility/access.

c. TIER 5 Guidance. Notice of six-year submission window for contractor periodic reinvestigations.

1. Company FSO will submit Tier 5 Periodic Reinvestigations (PRs) to DCSA for industry personnel six years after the date of the previous investigation rather than at the five-year mark to the National Background Investigations Bureau (NBIB) of the Office of Personnel Management. Therefore, industry will no longer submit Tier 5 PRs unless directed by DCSA. This change in Tier 5 PR submission periodicity will keep the Tier 5 PR investigations within the current seven-year reciprocity guidelines, resulting in the continued reduction of the backlog of personnel security investigations and enable DCSA to prioritize initial investigations and improve timeliness for interim determinations. Exceptions will be made for Tier 5 PRs required for Special Access Programs (SAP) as determined by DIA.

2. As a reminder, the Office of the Undersecretary of Defense for Intelligence signed a memorandum on Dec. 7, 2016, reminding DOD Components that personal security clearances do not expire. Individuals with current eligibility in the DISS should not be denied access based on an out-of-scope investigation. When the system of record shows current adverse information, but eligibility is still valid, access may continue.

d. Personal security clearances are required to be in scope based upon the current: Federal Investigative Standards (FIS) Tier 1(T1); Tier 2 (T2)/(T2R); Tier 4 (T4)/T4R); Tier 3(T3)/(T3R); Tier 3 (T3); Tier 5 (T5)/(T5R) respectively. In the event the contractor’s current investigation is out-of-scope, the FSO or CSSO must initiate a (T2R; T4R; T3R; T5R) respectively which must be reflected in DISS prior to submitting the nomination. Upon successful SCI eligibility determination and completion of the polygraph, the FSO will submit a permanent certification to the DIA Special Security Office via DISS, SMO Code XP124CS or via facsimile @ 202-231-8892. The permanent certification will be valid for the period of performance, however, not to exceed one year and must be renewed upon the exercise of each option period or extension and identifying the COR as the agency POC/Sponsor.

e. SCI Nomination Information: The formatted nomination letter, placed on company letterhead, on the contractor employee for access to this contract is attached at Enclosure 1. Submission of nomination and Form 86c to the DIA COR or Special Security Representative (SSR) facilitates the coordination with the contract employee, FSO/CSSO coordinates the scheduling of a counter-intelligence-scope polygraph (CSP) examination with DIA’s Credibility Assessment office. Contract personnel who possess a current or acceptable polygraph (CI or Lifestyle) will be reciprocally accepted.

1.7 Adverse Information.

a. Contractors shall report any adverse information through their respective FSO and Industrial Security Office. Reports based on rumor or innuendo should not be reported. The subsequent termination of employment of an employee does not preclude the requirement to submit this report. Contract personnel are required to obtain and maintain Top Secret clearance. The company FSO is required too immediately notify DIA of the suspension/revocation of personal security clearances providing contract support.

1. Individuals authorized access to SCI incur a special and continuing security obligation to be aware of the risks associated with foreign intelligence operations and/or possible terrorist activities directed against them in the U.S. and abroad. These individuals also have a responsibility to recognize and avoid personal behaviors and activities that may adversely impact their continued eligibility for access to SCI. Accordingly, these individuals shall report to their DIA, actual or planned involvement in any of the activities listed below prior to participation in such activities or otherwise as soon as possible following the start of their involvement. DIA shall, following an analysis of such reported activities, determine if participation poses a potential threat to the protection of SCI or to the national security and take appropriate action.

2. SCI-indoctrinated individuals are discouraged from unofficial travel to countries when it is determined that such travel presents a threat to their personal safety and/or to SCI. In addition, SCI-indoctrinated individuals are discouraged from visiting the diplomatic or trade missions of these countries, as well as traveling on transportation carriers owned or controlled by these countries.

3. Failure to comply with reporting requirements and resultant determinations made by the DIA or designee may result in administrative action to include, but not limited to, revocation of SCI access and denial of future SCI access approval.

4. DIA may determine that operational and mission needs preclude strict adherence to these reporting requirements. In these instances, equivalent notification, briefing, and reporting shall be accomplished in accordance with DIA requirements.

b. SCI Suspension or Revocation Requirements. The Government reserves the right to suspend or revoke SCI eligibility/access based upon ICD 704, for access to SCI and other Controlled Access Program Information, based upon violation or deviation from established administrative or security procedures by contract personnel, resulting in the revocation of their security clearance or SCI access, removal from the facility, denial of future entry, and possible civil or criminal proceedings. The Contractor and its employees shall cooperate fully in security matters, which may arise relating to this contract. Failure to do so may be interpreted as purposeful non-cooperation and may result in removal from contract, SCI access and security processing and reporting of information to DCSA, impacting facility clearance

c. For reportable activities refer to the following regulations:

1. DODM, DOD 5105.21, Vol 1-3, Sensitive Compartmented Information Administrative Security Program, February 24, 2012

2. Intelligence Community Policy Guidance number 704.1 Personnel Security Investigative Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information

3. DOD 5200.2-R, DOD Security Program

Note:

Contract personnel with access to CI & Security Reporting System (CISRS) shall report adverse information to DIA Security and company FSO. Contract personnel without access to CISRS are required to report adverse information to the Personnel Security Division at Sec.Customer@Dodiis.mil and company FSO.

1.8 Polygraph.

a. Polygraph Requirements: All contractors or employees of contractors identified to perform work for DIA, where contract support requires access to DIA classified information, facilities or systems must successfully complete a CSP examination in accordance with Intelligence Community Policy Guidance 704.6, SEAD 7 and DOD Directive 5210.48 or have a valid polygraph examination displayed in DISS or Scattered Castles from another federal agency to be reviewed to determine reciprocity PRIOR to scheduling and completing the SCI indoctrination process and accessing DIA systems, facilities, or information.

b. SCI Indoctrination and NATO Access Process: The COR will schedule contract personnel for SCI Indoctrination and NATO access with the DIA SSO upon receiving electronic notification that SCI eligibility has been granted by the DIA Central Adjudication Facility SEC3, and successfully completed or validated a current polygraph.

c. Unfavorable SCI Determination or Unsuccessful CI Polygraph: The DIA CAF will advise the COR when an un-favorable SCI determination has been rendered and or un-successful completion of a CI polygraph, resulting in the contractor not being authorized to provide support contracts to DIA associated with classified contracts.

1.9 Debrief Requirements.

a. The contractor must relinquish government issued credentials consisting of IC or DIA Staff Badge, Common Access Card (CAC), Courier Card if applicable, and/or other government issued badges or system access cards immediately upon resignation, removal from contract, termination from company, suspension or revocation of security clearance or SCI access or end performance of contract.

b. Contractor must coordinate with the COR for notification of the DIA SSO to administer an SCI debrief, relinquish badge(s) CAC or courier card as applicable upon ending of contract support with DIA.

c. The FSO/CSSO accesses DISS to ensure contractor completed SCI debrief with DIA SSO. If DISS reflects SCI accesses associated with the respective contract company’s Security Management Office (SMO) Code, contact the COR advising that the contractor did not out-process through the DIA SSO and immediately inform the SSO to initiate administrative debrief actions. The FSO/CSSO should retrieve government issued credentials from the contractor upon discontinuing contract support with DIA.

1.10 BADGE GUIDANCE:

a. Issuance of IC Badge: The IC Badge will be issued to respective contract personnel who have been nominated, favorably adjudicated and briefed by DIA Office of Security into SCI eligibility and access, based upon contract requirements identified within the acquisition document (SOW, PWS or SOO) requiring contract personnel to access other IC agencies (ODNI, Army, Marine, Navy, Air Force, USCG, DoS, Treasury, DOE, DHS, FBI, CIA, NSA, NRO, NGA, and DEA) in support of DIA contractual requirements. The COR is responsible for selecting the appropriate badge category (IC or DIA Staff Badge) on the DIA Form 386.

b. Issuance of DIA Staff Badge: The DIA Staff Badge will be issued to respective contract personnel who have been nominated, favorably adjudicated and briefed by DIA Office of Security into SCI eligibility and access, based upon contract requirements identified within the acquisition document requiring contract personnel to access DIA facilities in support of DIA contractual requirements. The COR is responsible for selecting the appropriate badge category (IC or DIA Staff Badge) on the DIA Form 386.

c. Common Access Card (CAC): The CAC will be issued to respective contract personnel, based upon location of performance at DIA and contract facilities requiring access to DIA’s unclassified systems and access to federal facilities and installations in support of DIA granted contracts.

d. Courier Briefing/Card: The Acquisition document (SOW/PWS/SOO) must identify if contract support requires contract personnel to transport classified information/equipment outside of DIA, government and or contract facilities. Facilities must be accredited to or higher than the classification of information/equipment identified for transport. Information/equipment must meet the security requirements associated with wrapping and markings in accordance with DODM 5105.21-V1, Enclosure 4, paragraph 16 and 32 Code of Federal Regulation (CFR), Part 117, NISPOM, Rule, Section 4, paragraphs 5-402; 5-403 and 5-410. Courier briefing will be administered by DIA’s SSO. The COR is responsible for completing the DIA Form 386 to facilitate issuance of courier briefing/card.

Note:

All DIA issued badges, courier card, and CAC (credentials):

· The SSO must be notified within 24 hours of any lost or stolen credentials.

· Credentials must be returned to the DIA SSO and notification of COR immediately upon discontinuance of contract support.

· Failure to return government issued credentials, could result in security infraction imposed against the individual through DISS.

1.11. Disposition of Government Information and or Equipment: The Contractor shall not release information (including photographs, files, public announcements, statements, denials or confirmations) on any part of the subject matter of this contract, on any phase of any Government program, or regarding any individuals, without the prior written approval of the Contract Officer. The Contractor may provide only the following information regarding this contract in the past performance section of any proposal that it submits in response to any solicitations issued by any local, state, or U.S. Government agency:

The unclassified contract number.

The unclassified contract type.

The unclassified contract award date.

The unclassified contract dollar value.

The unclassified contract periods of performance.

The unclassified contract project title.

The unclassified contract work description summary.

The unclassified contract places of performance.

1.12 Transmitting For Official Use Only/Controlled Unclassified Information (FOUO/CUI):

a. Transmitting FOUO/CUI, routinely occurs when emailing acquisition documents (Statement of Works(SOWs), Statement of Objectives(SOOs), Performance Work Statements(PWS) and Acquisition Purchase Requests (APRs), completed DD-254s, Security Continuation Pages, Notification of Intent to Sub-Contract Memorandums, Co-Utilization Agreements, SCI/Collateral Security Nominations Memorandums, etc… that has classification markings as Unclassified/For Official Use Only or Controlled Unclassified Information, requiring transmission to non .mil and or .gov email addresses. Although this information is not classified it is not for public release and measures must be implemented to prevent the unauthorized receipt of for official use only information.

b. CIO and OPSEC have implemented measures to prevent this from occurring. Information transmitted to non .mil and .gov email addresses are systematically screened to identify PII, FOUO and CUI from being transmitted unencrypted. In the event an email is transmitted that contains PII, FOUO and CUI the installed software on NIPR will prevent the transmission and simultaneously send an electronic OPSEC Violation Notification to the originator of the email and the supervisor.

c. The DOD SAFE application is used to send large files to individuals which would normally be too large to send via email. There are no user accounts for SAFE - authentication is handled via email and CAC. Everyone has access to SAFE, and the application is available for use by anyone. DOD SAFE Link: https://safe.apps,mil/

1. To encrypt unclassified information that is categorized as FOUO/CUI through encryption to minimize the un-authorized receipt of sensitive Security Addendum unclassified information, resulting in an OPSEC Violation, the Department of Defense (DOD) Safe Access File Exchange (SAFE) or the Microsoft Office encryption tool must be used to encrypt the email containing sensitive unclassified information.

1. Either of the referenced encryption tools can be used to facilitate the encryption of the transmission of various acquisition and security documents to or from a non .mil or .gov email address between DIA and contract companies.

1. Contract Security personnel will utilize DOD SAFE as a guest user, due to no Common Access Card (CAC) access at contract facilities. Note highlighted information.

d. Microsoft Encryption Tool:

1) The Microsoft encryption tool is another option to utilize for encryption of PII and FOUO unclassified information transmitted to non .mil and .gov email addresses. The tool can be accessed utilizing the following procedures:

2) At the prompt Security setting will not be applied to the document until you have saved the document. You will be able to continue to change security settings document has been closed.

3) Send password protected document in two separate emails.

1.13 Critical Program Information (CPI).

a. CPI Defined. CPI is a capability that contributes to DIA’s technical advantage. Policy requires DOD Component Heads to provide counterintelligence support to RDT&E programs. DIA will assign security, counterintelligence, intelligence, and OPSEC personnel to support the contractor in the identification and protection of CPI as appropriate. Support is contingent upon available resources. Certain requirements may be dependent upon specific conditions and priorities, such as the prevailing threat from foreign intelligence or unique vulnerabilities to the contractor.

b. The contractor will protect all forms of CPI in DIA funded Research, Development, Test, and Evaluation (RDT&E) funded programs. The DOD and DIA policies and procedures described below provide details towards identification and protection of CPI, the requirements below provide the minimum standards for CPI identification and protection as directed in this contract.

c. The contract Program Manager (PM), Contracting Officer Representative (COR), Facility Security Officer (FSO), and contracted personnel will be familiar with CPI as descried in DODI 5200.39, DODD 5240.06, DODI O-5240.24, DODM 5200.01, Volume 1, DODM 5220.22 Volume 2, and DODM 5200.01 Volume 3. Other policies and procedures may apply if the RDT&E activity takes place in a Military Service or COCOM environment.

d. CPI Deliverables.

1. The contractor will perform CPI analysis. CPI analysis is the means by which programs identify, protect, and monitor CPI early and throughout the life cycle of the program. The COR will provide the contractor with a CPI analysis worksheet. The contractor will complete the worksheet at the beginning of the program, maintain, and update as advised by counterintelligence and security personnel.

i) Updates to CPI analysis include, but are not limited to

ii) Discovery of a vulnerability to the RDT&E program

iii) Adversarial attempts to gain access to CPI

iv) Changes to personnel or security classification

2. The contractor will inform counterintelligence and security to the above listed changes and provide contract management, security, and counterintelligence personnel with the completed CPI analysis worksheet after each update. Counterintelligence will play a lead role in the identification and protection of CPI in RDT&E programs per DODI O-5240.24 and DODI 5200.39. The COR will provide updated points of contact for security and counterintelligence. Counterintelligence support is contingent upon available resources.

3. The contractor will respond to queries relating to CPI from DIA security and counterintelligence in an expedited manner and implement recommendations for the protection of CPI to the extent possible.

4. Reporting CPI Loss, Theft or Compromise

i. The contract Program Manager (PM), Contracting Officer Representative (COR), Facility Security Officer (FSO), and contract personnel with access to DIA, CPI, sensitive compartmented information (SCI), and special access program (SAP) information will be familiar with the counterintelligence and security reporting polices described in DODD 5240.06, DIAI 5240.009, DODM 5200.01-V3, DODD 5220.22-R,

ii. DIA Affiliates with access to CPI, including commercial contractors and sub-contractors will report counterintelligence and security incidents immediately to DIA. DIA Affiliates shall report the loss, compromise, or theft of classified CPI or CPI related to classified information, foreign intelligence activities, indicators, and behaviors through the CI & Security Reporting System (CISRS) found at https://diareporting.Dodiis.ic.gov/SelfReporting/. Contractors may also type “GO CISR” while on JWICS to access the CI & Security Incidents feature of CISRS.

Attachment 1

RELEASE OF SENSITIVE COMPARTMENTED INFORMATION (SCI) INTELLIGENCE

INFORMATION TO US CONTRACTORS

The Director, DIA has exclusive security responsibility for all Sensitive Compartmented Information (SCI); classified material released to or developed under this contract and held within the Contractor SCI Facility (SCIF), if applicable. Contractor will comply with all regulations/manuals/directives stated therein which provide the necessary security & classification guidance for personnel, information, physical, AIS, and technical security measures and is a part of the SCI security specifications for the contract. Inquiries pertaining to SCI classification guidance determination or interpretations shall be directed to the Contracting Officer /Contracting Officer Representative (CO/COR) identified in Block 12 of the attached DD254.

a. Executive Order 13526, Classified National Security Information,” December 29, 2009

b. DODM 5105.21-V1, (Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Information and Information Systems Security),

c. DODM 5105.21-V2, (Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Physical Security, Visitor Control, and Technical Security),

d. DODM 5105.21-V3, (Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Personnel Security, Industrial Security, and Special Activities),

e. ICD 403, Foreign Disclosure and Release of Classified National Intelligence

f. ICD 503, Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation,

g. ICD 700, Protection of National Intelligence

h. ICD 703, Protection of Classified National Intelligence,

i. ICD 704, 'Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information (SCI)

j. ICD 705, Sensitive Compartmented Information Facilities

k. 32 Code of Federal Regulation (CFR), Part 117, National Industrial Security Program Operating Manual (NISPOM) Rule

1. Access to SCI:

a. SCI will be handled in accordance with special security requirements, which will be furnished by DIA Special Security Office (SSO).

b. Names of contract personnel requiring access to SCI must be submitted to the contracting officer's representative (COR) for approval. Upon written approval from the COR, the company security officer will submit request(s) for special background investigations in accordance with the 32 Code of Federal Regulation (CFR), Part 117, NISPOM, Rule to the DCSA. Inquiries pertaining to classification guidance on SCI will be directed through the CSSO to the responsible COR as indicated in box 12 on the DD Form 254.

c. SCI furnished in support of this contract remains the property of the Department of Defense (DOD) department, agency, or command originator. Upon completion or cancellation of the contract, SCI furnished will be returned to the direct custody of the supporting SSO, or destroyed IAW instructions outlined by the COR.

d. SCI will be stored and maintained only in accredited facilities.

e. DIA SSO will recognize the expiration date as completion date for the contract. DIA COR will initiate action to debrief contractor personnel with access to this contract upon receipt of the MyHR form.

f. The contractor is governed by ICD 704, 'Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information (SCI) and Other Controlled Access Program Information. Although contractor personnel may be eligible for access to SCI or currently possess an SCI personnel security clearance with another non-DIA agency, contractor personnel performing on this contract must be adjudicated by DIA/SEC3 prior to having access to DIA’s Information, facilities, or systems. The contractor will submit a Nomination Letter for each contractor and submit to the COR. The CO/COR will enter the information into TITAN then forward a copy to DIA/SEC3 for adjudication. Each nomination letter should include a copy of the contractor’s SF 86C. This documentation will be marked and protected under the Privacy Act of 1974.

g. Cellular telephones, cameras, pocket scanners, voice recorders, pagers, and computers are not authorized within any DIA SCIFs without written approval by the SSO of the SCIF.

h. Transport of SCI on commercial aircraft is on a case by case basis and requires notification of the SSO at least 30 days prior to plan event.

2. The contractor is authorized direct communications with the designated CO/COR and DIA on all matters pertaining to SCI requirements. The CO/COR identified in Block 12 will receive a copy of any correspondence, which may have an impact upon the contractor's ability to perform under this contract.

3. On receipt of impacts to the contract, the contractor will inform the COR, who, in turn, will notify the Contracting Officer/ Activity prior to expending additional funds.

4. Contractors who possess a TOP SECRET with SCI access and a need-to-know are authorized unescorted access to a government facility, including Government Owned/Contractor Operated facilities. Appropriately cleared contractors are permitted to work alone inside the facility without the requirement for the presence of a U.S. Government employed representative provided ORCON, CNWDI, Law Enforcement Sensitive (LES) and other special program materials are secured to preclude unauthorized access to the aforementioned material. In the event contract personnel inadvertently access information that he/she is not briefed for, a security incident report is required to be initiated, and a non-disclosure form is signed by the contractor(s) in coordination with the originating agency.

5. Electronic processing of SCI must be accomplished on equipment accredited in accordance with DODM 5105.21-V1 and ICD 503.

Attachment 2

RELEASE OF NON-SENSITIVE COMPARTMENTED INFORMATION (SCI) INTELLIGENCE

INFORMATION TO DOD CONTRACTORS

1. Requirements for access to non-SCI, (Collateral):

a. Any collateral classified and/or sensitive information obtained by contractors on behalf of DIA’s mission, will only be discussed or processed in facilities approved by CO/COR. At no time, will such information be discussed or shared with unauthorized contractors. DIA contractor employees will be required to sign a Non-Disclosure Agreement stating the same.

b. All intelligence material released to the contractor remains the property of the US Government and may be withdrawn at any time.

c. The contractor must not destroy intelligence material without advance approval or as specified by the contracting officer's representative (COR). (EXCEPTION: Classified waste shall be destroyed as soon as practicable.

e. The contractor must restrict access to those individuals who possess the necessary security clearance and who are providing services under the contract with a valid need to know. Further dissemination to sub-contractors must be approved through a Notice of Intent letter created by the COR and signed/approved by the contracting officer.

f. The contractor must ensure each employee, having access to intelligence material, is fully aware of the special security requirements for this material.

g. Intelligence material must not be released to foreign nationals or immigrant aliens whether they are consultants, US contractors, or employees of the contractor and regardless of the level of their security clearance, except with advance written…