Attachment J-5 DD 254.pdf

ashfaa Text Box (The requirements of the National Industrial Security Program Operating Manual (NISPOM) apply to all security aspects of this effort.)

ashfaa

FAA AIN SECURITY REVIEW/CERTIFICATION

ashfaa

ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to NISPOM requirements, are established for contract.

13. SECURITY GUIDANCE. (CON’T.)

Solicitation or Contract # Page #

DD FORM 254 (13 CON’T.), MAY 2010

Untitled

991 Sycolin Road, SE Leesburg, VA 20175

800 Independence Ave., SW Washington, DC 20591 13: The following National and FAA security manuals, orders, and requirements apply to this contract:

- NISPOM (DOD 5220.22-M)

- Safeguarding Classified National Security Information (FAA Order 1600.2)

- Protecting Sensitive Unclassified Information (FAA Order 1600.75)

- Communications Security Order (FAA Order 1600.8)

- FAA Acquisition Management System (AMS) security clauses 3.6.2-42; 3.8.2-11; 3.8.2-22; 3.14-1 through 5 inclusive.

Item 6a: Prime contractor must be eligible for and maintain a valid NISP Facility Security Security Clearance and Satisfactory Security Program at contract award and throughout the life of this contract.

Personnel Security Clearances (PCL): Prior to commencing any classified work at an FAA facility, the Primary Contractor listed on the DD 254 (item 6.a.) must forward a Visit Authorization Request (VAR) listing security clearance information on all personnel performing classified work on the contract listed on the DD 254 (item 2.a.) to:

Federal Aviation Administration Attn: Personnel Security Division (PSD) (AIN-400) 800 Independence Ave., SW Suite 308 Washington, DC 20591

The listing may be faxed to the PSD at (202) 267-6518. Additionally, the Primary Contractor must revalidate PCLs on an annual basis and/or when any changes occur to the PCLs for personnel performing classified work on the contract.

See attached annex for information and handling procedures related to items checked YES in Sections 10 and 11.

Homeland Secure Data Network (HSDN)

Text3: Item 10a: Cleared contract personnel performing classified work on this contract at FAA facilities are authorized access to and use of government furnished Controlled Cryptographic Items (CCI) to accomplish the required efforts under this contract. Contract personnel are not authorized access to classified cryptographic keying material. Contract personnel in custody of or using COMSEC equipment must adhere to FAA COMSEC policy (FAA Order 1600.8) and the procedures issued by the EKMS account manager. Subcontracting under this effort requires prior notification and approval from the FAA Office of Security, ATTN: AIN-300.

Item 10e: Cleared contract personnel requiring access to classified intelligence require a Top Secret PCL with SCI access to accomplish the required efforts under this contract. Access to intelligence information requires a final U.S. Government clearance at the appropriate level. The Special Activities and Law Enforcement Support Division (AEO-300) will process SCI adjudication requests in accordance with FAA Order 1600.76. Contract personnel working at FAA facilities will comply with SCI policy and procedures defined in ODNI ICD’s and FAA Order 1600.76. Contract personnel that require access to the Joint Worldwide Intelligence Communications System (JWICS) must apply for a JWICS User account through the Special Activities and Law Enforcement Support Division (AEO-300). Authorized JWICS users must adhere to JWICS User Agreements and procedures. Subcontracting under this effort requires prior notification and approval from the FAA Office of National Security Programs and Incident Response, ATTN: AEO-300.

Item 10j/k: Contract personnel performing work on this contract are authorized access to Sensitive Unclassified Information (SUI) (i.e., For Official Use Only (FOUO), Sensitive Security Information (SSI)). Contract personnel with access to or handling any category of SUI will comply with the safeguarding requirements of FAA Order 1600.75. Contract personnel are not authorized public release authority for SUI and must comply with FAA FOIA policy.

Item 10k: Cleared contract personnel that require access to HSDN must apply for a HSDN User account through the Command Control and Communications Division (AEO-400). Authorized HSDN Users must adhere to DHS HSDN User Agreements and procedures. The primary contractor must ensure contract personnel with HSDN accounts are briefed on how to protect NATO information in the event that they come across it while on the HSDN.

Item 11a: Cleared contract personnel performing classified work on this contract are authorized access to classified threat and incident information for monitoring, response and mitigation of cyber security incidents involving DOT/FAA owned and monitored information systems, including operational NAS infrastructure. The contractor may represent the CSMC SOC at FAA Domestic Event Network (DEN) offices/activities, and the National Security Coordination Division (AEO-300). Contract personnel will not be receiving or generating classified information at the contractor’s own facility to accomplish the FAA tasks associated with the contract listed on the DD 254 (item 2.a.)

Classification Guidance: The following Security Classification Guides apply to this contract:

* DHS HSDN Security Classification Guide (DHS SCG )CSO 01.1 (HSDN), June 2012 (U).

* JWICS Security Classification Guide, Version 1.0, 29JUNE2012. (U)

* Classification guidance for information related to intelligence information (Sensitive Compartmented Information (SCI) and non-SCI) will be provided as required on a case-by-case basis by the Manager, Special Activities and Law Enforcement Support Division (AEO-300) in coordination with the FAA Special Security Office (SSO).