D1Atch04AppDAdd02.doc

DRAFT Solicitation FA0021-09-R-0004 ## June 2009

ADDENDUM #2

DD FORM 254 (Blocks 10.e.(1) and 10.e.(2) (When item 10.e(1) and/or 10.e.(2) are(is) checked “YES”)

INTELLIGENCE INFORMATION

ITEM 12: (When item 10.e(1) and/or 10.e.(2) are checked “YES”) If either Item 10.e.(1) or Item 10.e.(2) are marked “YES,” (i.e., “SCI” or “Non-SCI Intelligence” is involved in the contract), Item 12 must be marked “THROUGH” and the following additional addressees entered:

HQ AFSOC/A2S

100 Bartley Street 212 South

Hurlburt Field, FL 32544-5273

AF/A2S

240 Luke Avenue

Bolling AFB, DC 20032-5114

In addition, include the following statement in Item 12:

“PUBLIC RELEASE OF SCI AND / OR NON-SCI Intelligence Information IS PROHIBITED.”

ITEM 13: (When item 10.e(1) and/or 10.e.(2) are checked “YES”) Contractor is prohibited from using references to SCI accesses, even by unclassified acronyms, in advertising or recruitment media or on the company website without specific, case-by-case approval by SSO AFSOC. (Refer to DCID 6/1, paragraph 7.1)

When required, the contractor will derivatively classify documents created in the course of this contract using the procedures and criteria defined in Executive Order 12958, Classified National Security Information, (EO 12958) as amended and Information Security Oversight Office Implementing Directive No. 1. Requests for original classification of intelligence information at any classification level or within any compartment will be referred to the AFSOC Special Security Officer (SSO AFSOC) at HQ AFSOC/A2S. Requests for classification not involving SCI or intelligence will be referred to the AFSOC Security Forces office via the Contracting Officer’s Representative (COR).

When the contractor creates a classified document from extant classified documents, the contractor will incorporate into the finished product a list of all sources used and will apply required security classification markings and handling / control / dissemination / declassification caveats to all working, draft and final copies of classified documents in accordance with the following documents:

· Executive Order 12958, as amended;

· Information Security Oversight Office Implementing Directive No. 1 (Effective September 22, 2003)

· The Intelligence Community Classification and Control Markings Implementation Manual, (U/FOUO), with its classified Appendix (CONFIDENTIAL//Rel To USA, AUS, CAN, GBR) as required

· The Authorized Classification and Control Markings Register, (U/FOUO), with its classified Annex (SECRET//Rel To USA, AUS, CAN, GBR) as required

· Air Force Instruction 31-401 Information Security Program Management

· Information Security Program, DoD 5200.1-R

· The National Industrial Security Program Operating Manual (NISPOM) (February 2006), DoD 5220.22-M, its supplement and the Department of Defense Overprint to the NISPOM Supplement, as appropriate.

NOTE: As of 30 May 2006, it is Air Force policy to use the standardized security markings guidelines provided in references 12 and 13 listed below. THIS POLICY APPLIES TO ALL CLASSIFIED MATERIAL (DOCUMENTS, PRESENTATIONS, ETC.) GENERATED IN, BY AND FOR THE AIR FORCE. Contractors are required to comply with this policy change.

Data storage media in any form become the property of the U.S. Government whenever classified information is placed thereon. Erasure, “wiping” of the data or reformatting of the media does not change this requirement and does not declassify the media.

Contractor will not sanitize or decompartment any SCI or intelligence. If the contractor believes fulfillment of this contract requires sanitization of SCI or decompartmentation of intelligence, the information will be forwarded to SSO AFSOC.

Access to, discussion of, use of, handling, maintenance and/or storage of SCI is limited to government-owned or government-controlled Sensitive Compartmented Information Facilities (SCIF) unless approved in writing by SSO AFSOC.

The SSO AFSOC is the final authority regarding issues of security, classification, dissemination or any other matter involving SCI or intelligence. Unresolved SCI or intelligence information security issues shall be directed to HQ AFSOC/A2S (SSO AFSOC), phone (850) 884-6689 (DSN 579). Similar issues involving other classified information will be referred to the COR.

A co-utilization agreement as required by DoD 5105.21-M-1, Chapter 5, Paragraph C, will be completed and signed if any Special Access Program material or information is stored within any SCIF. The agreement will comply with the requirements in DoD 5105.21-M-1, Chapter 5.C. and AFM 14-304, Chapter 5. If the SSO with security cognizance over the SCIF concerned is not SSO AFSOC, a copy of the agreement will be provided to SSO AFSOC by the SSO concerned.

References. (If newer editions are published after award of the contract, the contractor will utilize the most recent edition of these documents):

1.

Executive Order 12958, as amended. Classified National Security Information, (March 25, 2003)

2.

Director of Central Intelligence Directive 6/1 Security Policy for Sensitive Compartmented Information and Security Policy Manual (1 March 1995 / 23 December 2002) 3.

Director of Central Intelligence Directive 6/3 Protecting Sensitive Compartmented Information Within Information Systems (May 1, 2003) 4.

Intelligence Community Directive Number 704, Personnel Security Standards and Procedures for Access to Sensitive Compartmented Information and Other Controlled Access Program Information (Replaced DCID 6/4 on 1 October 2008) 5.

Intelligence Community Policy Guidance Number 704.1, Personnel Security Investigative Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information (Replaced DCID 6/4, Annex A on 2 October 2008)

6.

Intelligence Community Policy Guidance Number 704.2, Personnel Security Adjudicative Guidelines for Determining Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information (Replaced DCID 6/4, Annex C on 2 October 2008)

7.

Intelligence Community Policy Guidance Number 704.3, Denial or Revocation of Access to Sensitive Compartmented Information, Other Controlled Access Program Information, and Appeals Processes (Replaced DCID 6/4, Annex D on 2 October 2008) 8.

Director of Central Intelligence Directive 6/5 Policy for Protection of Certain non-SCI Sources and Methods Information (SAMI)(February 12, 2001) 9.

Director of Central Intelligence Directive 6/6 Security Controls on the Dissemination of Intelligence Information (11 July 2001 / 3 May 2002)(Classified SECRET/NOFORN)

10.

Director of Central Intelligence Directive 6/9 Physical Security Standards for Sensitive Compartmented Information Facilities (December 17, 2002) as amended by Intelligence Community Policy Memoranda 2005-700-1, 2006-700-7 and 2007-700-2.

11.

Information Security Oversight Office Implementing Directive No. 1 (Effective September 22, 2003)

12.

The Intelligence Community Classification and Control Markings Implementation Manual, (U/FOUO), with its classified Appendix (CONFIDENTIAL//Rel To USA, AUS, CAN, GBR) as required 13.

The Authorized Classification and Control Markings Register, (U/FOUO), with its classified Annex (SECRET//Rel To USA, AUS, CAN, GBR) as required 14.

Department of Defense Manual 5105.21-M-1 Sensitive Compartmented Information Administrative Security Manual (August 1998) (DoD 5105.21-M-1) (For Official Use Only)

15.

Department of Defense Manual 5220.22-M National Industrial Security Program Operating Manual, February 2006 16.

Joint DoDIIS Cryptologic SCI Information Systems Security Standards (JDCSISSS)(For Official Use Only)

17.

Air Force Instruction 14-302 Control, Protection, And Dissemination Of Sensitive Compartmented Information (18 January 1994)

18.

Air Force Instruction 14-303 Release of Intelligence to U.S. Contractors (1 April 1999)

19.

Air Force Manual 14-304 The Security, Use and Dissemination of Sensitive Compartmented Information (1 May 99) (For Official Use Only)

20.

Signals Intelligence Security Regulation, 26 May 99 (SECRET//COMINT)

21.

National Geospatial-Intelligence Agency Imagery Policy Series, February 2004 (SECRET//NOFORN).

22. AFSOC Instruction 33-202, Portable Electronic Device (PED) Security ITEM 14: (When item 10.e(1) and/or 10.e.(2) are checked “YES”) Automated Information Systems used to process Sensitive Compartmented Information (SCI) will comply with the Joint DoDIIS/Cryptologic SCI Information Systems Security Standards (JDCSISSS) and the references listed in Appendix A of that document. In no case will the contractor process SCI on non-government-owned AIS or on government-owned AIS without written permission from a government agency authorized to issue approval to operate such equipment. The AFSOC SSO is the final authority regarding questions of AIS security for systems processing SCI and/or intelligence information.

Contractor will / will not require access to the NIPRNET.

Contractor will / will not require access to the SIPRNET.

Contractor will / will not require access to the JDISS/JWICS networks.

The contractor will notify the SSO AFSOC immediately upon receiving “reportable information” or knowledge of reportable information involving any SCI-indoctrinated employees assigned to work on this contract. “Reportable information” is defined as any change in personal status which could affect continuing eligibility for access to SCI. Refer to Paragraph L, Chapter 2 of Department of Defense Manual 5105.21-M-1 Sensitive Compartmented Information Administrative Security Manual (August 1998)(For Official Use Only) and Paragraph 2.7 in Air Force Manual 14-304 The Security, Use and Dissemination of Sensitive Compartmented Information (1 May 99) (For Official Use Only) . Some examples (not all-inclusive) of reportable information are:

· Death, capture or the unexplained absence (over 24 hours) of any SCI-indoctrinated person (military, U.S. Government civilian employee, contractor)

· Intent to marry or cohabit (i.e., establish a “spouse-like” relationship), or marriage to / cohabitation with a US citizen.

· Intent to marry or cohabit (i.e., establish a “spouse-like” relationship) or marriage to / cohabitation with a foreign national

· Divorce of a spouse (US citizen or foreign national)

· Psychiatric referral or psychiatric self-referral.

· Involvement with any civilian or military law enforcement agency (defined as arrest or detention) due to criminal activity (E.g., fraud, black-market activity, theft, assault, driving under the influence/while intoxicated, prostitution, sex offenses, child abuse, domestic violence, use/possession/distribution of illegal drugs or possession of drug paraphernalia, homicide, manslaughter, leaving the scene of an accident, etc.) or any traffic infraction where the fine was $150 or more.

· Illegal procurement/disposition matters (includes misuse of government or corporate credit and/or travel cards).

· Dependent involvement in a criminal offense.

· An SCI-indoctrinated individual declares himself a Conscientious Objector.

· A close personal or business relationship with a foreign national.

· Attempted suicide or a suicidal gesture.

· Recurring incidents of a discreditable nature.

· Financial irresponsibility or significant debt (failure to make court-ordered payments, placement of accounts with a collection agency, liens against property or income, repossession of property, foreclosures, etc.) .

· Sudden affluence. (Defined as receiving $10,000 or more.)

· Employment (paid or volunteer) by a foreign national, by an agent of any foreign interest or with any organization or person (foreign or domestic) involved in intelligence, foreign affairs or defense issues.

· Coworker or supervisory/management doubts about the stability, trustworthiness, reliability, discretion, character, soundness of judgment or the ability to safeguard classified information to include outside activities/employment.

· Security violations (SCI and non-SCI) involving an SCI-indoctrinated person.

· Refusal to sign a security statement (e.g., non-disclosure agreement, security termination statement, etc.).

· Unofficial foreign travel (itinerary required when self-reported).

· Crime or Accident Victim. Report only those incidents that result in medical or mental problems which, in turn, could adversely affect continuing SCI access.

· Any incident not listed occurring outside the United States which is inconsistent with the laws or customs of a country or state and which may result in unfavorable publicity.

This contract requires certain contractor employees to have access to SCI for performance under this contract. This contract requires not more than [enter a number] SCI-indoctrinated person(s) in order to complete work on the deliverables specified in this contract. Contractor will provide SSO AFSOC a list of all persons assigned to work under this contract. The list will include the employees’ full names, Social Security Account Numbers, dates and places of birth, the dates of the latest personnel security investigations and the dates of SCI eligibility determination, if applicable. If a Single-Scope Background Investigation has not been completed, or is out of date, upon approval of billets by SSO AFSOC, the Contractor Special Security Officer (CSSO) or Facility Security Officer (FSO) will submit the necessary forms to the Defense Industrial Security Clearance Office or to the Office of Personnel Management (OPM) for those persons nominated for SCI access in accordance with the National Industrial Security Program Operating Manual (NISPOM). Billet justifications for uncleared persons or for those whose investigations are outdated will include the contract Performance based Work Statement (PWS).

Contractor will comply with the SSO AFSOC policy of requiring the shredding of all waste paper products generated in a SCIF or intelligence facility. AFSOC Instruction 10-701 also requires the shredding of all other paper items. The only exceptions are food wrappings, newspapers, magazines and packing materials. The shredder used must meet the performance requirements of NSA/CSS Specification 02-01, High Security Crosscut Paper Shredders. (See Annex A of this specification, NSA/CSS Evaluated Products list for High Security Crosscut Paper Shredders, for specific equipment meeting these standards.) For information purposes, the performance requirements of NSA/CSS Specification 02-01 are summarized below.

· Maximum Particle Area: Ninety percent (90%) of the shredded particles shall not exceed five square millimeters (5 mm2) and none of the remaining particles shall exceed ten square millimeters (10 mm2).

· Maximum Particle Dimensions: Seventy five percent (75%) of the shredded particles shall have no edge dimension exceeding five millimeters (5 mm) in length. The remaining particles (a maximum of twenty five percent (25%)) may exhibit edge dimensions between five and twelve and one half millimeters (5 - 12.5 mm) in length. No particle shall have an edge dimension greater than twelve and one half millimeters (12.5 mm) in length.

· Durability: Shredder shall operate continuously for one (1) hour, shredding paper at a feed rate prescribed by the manufacturer, and consistently produce particles that meet specification requirements.

Contractor will not destroy any classified document provided by the government for the purpose of performing under the contract without permission from the government.

The HQ AFSOC/A2 is the approval authority for “need-to-know” for SCI and intelligence information. This authority is delegated to SSO AFSOC. For all other information, the COR is the approval for “need-to-know.”

Contractor will return all SCI and non-SCI intelligence material furnished under this contract to the SSO AFSOC upon completion of this contract unless written approval is granted for its retention. All classified information (in any form whatsoever) furnished in support of this contract is and remains the sole property of the United States Government.

Contractor will utilize only appropriately secured local/wide area networks (i.e., SIPRNet or JWICS/JDISS, as appropriate), or another appropriately secured electronic means of transmission approved by SSO AFSOC as the primary method of transmitting SCI and/or intelligence information under this contract. An alternate method of transmitting SCI/intelligence will be the Defense Courier Service. SSO AFSOC will act as the receiving and dispatching point for use of the Defense Courier Service under this contract and contractor will not require a separate Defense Courier Service account. Establishment of a Defense Courier Service account is not authorized.

Contractor will not remove any SCI or intelligence information from a government or government-controlled Sensitive Compartmented Facility (SCIF) supported by this contract without written approval of the Senior Intelligence Officer (AFSOC/A2) and, if removed from a government installation, written courier authority from the SSO AFSOC. Requests to hand-carry SCI or intelligence information via commercial aircraft generally will not be approved. Removal of other classified information requires written permission from the COR.

Contractor will not reproduce classified information (to include SCI and/or intelligence information) without advance approval of SSO AFSOC or the releasing agency. If permission is granted, each copy will be controlled in the same manner as the original.

Contractor employees will wear a SCIF identification badge (issued by SSO AFSOC or other appropriate government authority) at all times while within a SCIF under Government control. The badge must be prominently displayed on top of the outer garment and above the wearer’s waist. This requirement is in addition to that mandating wear of the contractor-issued contractor identification badge.

Contractor will comply with HQ AFSOC policies concerning the use and/or possession of Portable Electronic Devices (PED) within any AFSOC facility. AFSOC prohibits all non-government PEDs and limits use of government PEDs within AFSOC buildings. Refer to AFSOC Instruction 33-202 (Portable Electronic Device (PED) Security) for definitions of PEDs.

· SSO AFSOC prohibits the possession or use of all cameras, video recorders, audio recorders, cellular phones, hand-held radios, two-way pagers and all devices containing an Radio Frequency transmitter in any AFSOC SCIF.

· Contractor will comply with the SSO AFSOC policies which prohibit the possession or use of memory/storage devices variously described as Flash Memory, Memory Stics, Smart Media, Thumb Drives and/or Jump Drives, inter alia, in AFSOC SCIFs. Such items present unacceptable security hazards.

· Briefings/presentations will be sent to / brought into AFSOC-operated SCIFs via secure e-mail at the appropriate classification level or on CD-ROM (Read only) or on DVD (Read only). Use of “thumb drives,” “flash drives,” “jump drives” or similar type USB storage devices to transfer briefings/presentations is prohibited.

The contractor is prohibited from:

· Connecting any media storage device to any government computer without permission from the Information Assurance Officer for the location in question.

· Connecting any non-government computer to any government computer or computer network without permission from the Information Assurance Officer for the location in question.

AFSOC/A2S (SSO AFSOC) (or its designee) conducts random searches of persons (military, government civilians, contractors and other persons) entering and leaving SCIFs. These searches are to ensure prohibited items do not enter SCIFS and to ensure that only authorized items are removed from SCIFs. Prohibited items will be seized and destroyed if discovered in any AFSOC SCIF and the incident reported to the Defense Security Service and the contractor’s Facility Security Office/Contractor Special Security Office. Contractor employees assigned to work under this contract must consent to search. (Authority: Section 21 Internal Security Act of 1950; 50 U.S.C. 797)

Contractor employees performing under this contract will participate in all periodic SCI security awareness education and training provided by AFSOC/A2S (SSO AFSOC).

Contract expiration date: [ enter date contract expires ] COR/Contract Monitors (CM) (Primary and Alternate) (Names, office symbols, and phone numbers): [ enter data requested ] Places where contract will be performed (list physical addresses & locations) if not listed in Block 8.a.: [ enter data requested if applicable ] ITEM 15: (When item 10.e(1) and/or 10.e.(2) are(is) checked “YES”) HQ AFSOC/A2S (SSO AFSOC), Hurlburt Field, Florida has exclusive security responsibility for all intelligence information and/or SCI material provided, released or developed under this contract. The Defense Intelligence Agency and HQ AFSOC/A2S (SSO AFSOC) have inspection authority for all intelligence-related and/or SCI-related matters under this contract.

The SSA has security oversight of all information and/or material released or developed under this contract with the exception of Intelligence (SCI and non-SCI) and SAP material. Long Term Visitor Groups will be inspected as part of the supported organization’s annual Information Security Program Review, conducted by the SSA, while operating on an Air Force installation. The contractor will comply with the Visitor Group Security Agreement which must be signed before start of work is authorized at Hurlburt Field.

ITEM 17: (When item 10.e(1) and/or 10.e.(2) are(is) checked “YES”( Add HQ AFSOC/A2S to Required Distribution.

The responsible office for this information is AFSOC/A2S.

The information is current as of 7 January 2009.

Earlier versions of this document should not be used to prepare new contracts.

Addendum #2 to DD254, Attachment 4, Appendix D