Atch 7 SOW Supplemental Requirements.docx

(READ AND DELETE: The Contracting Officer will, in conjunction with the COTR/COR (e.g., via answers provided on the ICO Tool), select the applicable additional requirements from the list below, and include this document as a separate attachment to the contract/order. Delete any non-applicable requirements before saving the final document. All language in bold italics throughout this document is instructional text and must also be deleted before saving the final document. Ensure terminology is tailored according. Sequentially number the applicable paragraphs (e.g., 1, 2, 3, etc.); the AFRL conventional SOW paragraph numbering scheme (e.g., 4.0, 4.1, etc.) is not required. Insert the date and attachment number. Just as with any attachment, if this attachment is sent to the Contractor, and then is subsequently modified, be sure to update the date of the attachment so that it is clear that the updated version supersedes any older copies that may be circulating around the Contractor’s facility. Any questions can be addressed to AFRL/PKL.)

Statement of Work (SOW)

(or replace SOW with Performance Work Statement (PWS), if services)

AFRL Supplemental Requirements

Version 26.3

3 June 2026

Contract No. FA___-_________________

1. INTRODUCTION. The following paragraphs are also considered be a part of the SOW (replace with PWS, if services) requirements and the Contractor is responsible for compliance to the same extent as the rest of the SOW (replace with PWS, if services).(If proposal is incorporated by reference replace with the following “The following paragraphs are also considered to be a part of the Contractor’s proposal, incorporated herein by reference and the Contractor is responsible for compliance to the same extent as the rest of the Contractor’s proposal”)

2. PACKAGING AND MARKING. The following requirement should be included when there is delivery of hardware.

PACKAGING AND MARKING

a. All hardware deliverable contract items shall be packaged in accordance with established commercial practices.

b. When special delivery and/or handling instructions are required, all boxes and/or crates must contain the following statement in plain sight and in bold letters:

INSTRUCTION TO RECEIVING OFFICE – DO NOT OPEN; CONTENTS ARE SENSITIVE TO DAMAGE WHEN IMPROPERLY OPENED OR HANDLED. CONTACT THE RESPONSIBLE TECHNICAL PROJECT OFFICER IMMEDIATELY UPON RECEIPT. CONTACT INFORMATION: XXX (insert POC’s name and contact information).

3. COMSEC MONITORING. The following requirement should be included in all contracts.

COMMUNICATIONS SECURITY (COMSEC) MONITORING

All communications with DoW organizations are subject to Communications Security (COMSEC) review. Contractor personnel will be aware that telecommunications networks are continually subject to interception by unfriendly intelligence organizations. The DoW has authorized the military departments to conduct COMSEC monitoring and recording of telephone calls originating from or terminating at DoW organizations. Therefore civilian Contractor personnel are advised that any time they place a call to or receive a call from a USAF organization they are subject to COMSEC procedures. The Contractor will assume the responsibility for ensuring wide and frequent dissemination of the above information to all employees dealing with official DoW information.

4. ACKNOWLEDGMENT OF SPONSORSHIP. DFARS 252.235-7010(a) requires the Contractor to acknowledge the Government’s support of material that is published. Include the following requirement on ALL contracts. May tailor as necessary (e.g., if DARPA funded effort).

ACKNOWLEDGMENT OF SPONSORSHIP

(a) The Contractor agrees that in the release of information relating to this contract such release shall include a statement to the effect that the project or effort depicted was or is sponsored by the Air Force Research Laboratory (AFRL). (add other sponsors here, if applicable, e.g., “and DARPA”).

(b) For the purpose of the clause at DFARS 252.235-7010, "information" includes but is not limited to material presented in news releases articles manuscripts brochures advertisements still and motion pictures speeches presentations meetings conferences symposia etc.

(c) Nothing in the foregoing shall affect compliance with the requirements of the clause (if applicable) of this contract entitled "Security Requirements".

(d) The Contractor further agrees to include this requirement in any subcontracts awarded as a result of this contract.

5. GUARANTEED FINAL REPORT. Use on all AFRL R&D cost reimbursement type contracts (including SBIR/STTRs) unless in the CO's opinion it is not necessary. In lieu of a specific ELIN being referenced in each contract, for simplicity's sake, AFRL Rome includes the Data Item Description ID (DID) number: DI-MISC-80711A, Scientific and Technical Reports. If a different DID is used, revise the language accordingly for your acquisition. If a different Exhibit identifier applies (e.g., Exhibit B), tailor the requirement accordingly.

GUARANTEED FINAL REPORT

If this contract is terminated prior to completion, the Contractor agrees to provide a final report in accordance with Exhibit A, DI-MISC-80711A, Scientific and Technical Reports. During the life of the contract, the Contractor shall continuously reserve sufficient funds from the amount allotted to guarantee the preparation and delivery of said final report.

6. CONTRACTOR SYSTEMS DECLARATION AND TRACKING. Use in all. Required when contractors will be bringing contractor-owned information systems on-site.

CONTRACTOR SYSTEMS DECLARATION AND TRACKING

Compliance with Air Force Manual (AFMAN) 17-1301 is mandatory. Air Force policy requires that all contractor-owned or operated information systems equipment on-site be tracked for purposes of operational awareness and to locate system owners in the event that such a device is recovered by AFRL/RIOS or another entity. Whenever contractor personnel will be on-site at AFRL/__(insert site acronym) and a contractor-owned or operated system (e.g.; laptop) will be brought into any of the facilities, the Contractor Systems Declaration Template at https://usaf.dps.mil/sites/20708/rios/cybersecurity/requests/sitepages/Home.aspx#contractorsystem must be completed. In the event Contractor personnel have not been issued a Common Access Card (CAC), and therefore cannot complete the template, the Contractor shall provide the required information to the COR/COTR for input into the template.

7. IMPLEMENTATION OF PATENT RIGHTS CLAUSE. Insert one of the following Patent Right Implementation clauses:

(a) For contracts other than IDIQ, insert the following patent rights implementation language:

IMPLEMENTATION OF PATENT RIGHTS CLAUSE

(a) Interim* and final Invention Reports shall be submitted as follows:

(1) Invention Reports stating that there are no subject inventions to disclose (i.e., “negative reports”) shall be sent to the Administrative Contracting Officer (ACO) at the address located on the face of the contract, the Contracting Officer’s Technical Representative (COTR), and the cognizant AFRL/___(insert TD acronym) Branch Office inbox at (insert Branch Office mailbox) within the timeframes specified in the Patent Rights clause of this contract.

(2) Invention Reports that do list subject invention(s) (i.e., “positive reports”) and stating that all subject inventions have been disclosed, shall be sent to the Administrative Contracting Officer (ACO) at the address located on the face of the contract, the Patent Administrator at email: (Insert Patent office mailbox), the COTR, and the cognizant Branch Office inbox specified in paragraph (a)(1) above, within the timeframes specified in the Patent Rights clause of this contract. The AFRL Patent Administrator can be reached at Area Code (insert Patent office phone number).

(3) Please include in the subject line of the e-mail the contract number followed by the words "Invention Reporting." Also include in the body of the e-mail the names of the COTR and his/her office symbol. Contractors are highly encouraged to use DD Form 882, Report of Invention and Subcontracts to submit these reports. The DD Form 882 may also be used for the notification of an award of any subcontract(s) for experimental, developmental or research work which contain a "Patent Rights" clause.

(b) All other notifications (e.g., disclosure of each subject invention to the Contracting Officer within 2 months after the inventor discloses it) shall also be sent to the e-mail addresses in paragraph (a).

Insert the following if other than a small business concern, nonprofit organization or education institution:

(c) This requirement also constitutes the request for the following information for any subject invention for which the contractor has retained ownership: (1) the filing date, (2) serial number and title, (3) a copy of the patent application, (4) patent number and issue date, and (5) a confirmatory instrument securing the Governments rights. Submittal shall be to the Patent Administrator e-mail address listed above, with a courtesy copy (cc:) to the COTR.

*DFARS 252.227-7038 states interim reports are due every twelve (12) months or such longer period as specified by the Contracting Officer. As such, if there are no interim subject inventions to disclose, interim reporting is not required and only a final report is required for submittal. If, at any time during contract performance, the status of subject inventions changes, the Contractor shall submit an interim Invention Report in accordance with paragraph (a).

Insert the following if a small business concern, nonprofit organization or educational institution:

(c) This requirement also constitutes the request for the following information for any subject invention for which the contractor has retained ownership: (1) the filing date, (2) serial number and title, (3) a copy of the patent application, and (4) patent number and issue date. Submittal shall be to the Patent Administrator e-mail address listed above, with a courtesy copy (cc:) to the COTR.

*DFARS 252.227-7039 states interim reports are due every twelve (12) months or such longer period as specified by the Contracting Officer. As such, if there are no interim subject inventions to disclose, interim reporting is not required and only a final report is required for submittal. If, at any time during contract performance, the status of subject inventions changes, the Contractor shall submit an interim Invention Report in accordance with paragraph (a).

(b) For IDIQ contracts, insert the following patent rights implementation language:

IMPLEMENTATION OF PATENT RIGHTS CLAUSE (IDIQ)

(a) Interim* and final Invention Reports shall be submitted as follows FOR EACH ORDER:

(1) Invention Reports stating that there are no subject inventions to disclose (i.e., “negative reports”) shall be sent to the Administrative Contracting Officer (ACO) at the address located on the face of the contract, the Contracting Officer’s Technical Representative (COTR), and the cognizant AFRL/___(insert Office acronym) Branch Office inbox at (insert Branch Office mailbox) within the timeframes specified in the Patent Rights clause of this contract.

(2) Invention Reports that do list subject invention(s) (i.e., “positive reports”) and stating that all subject inventions have been disclosed, shall be sent to the Administrative Contracting Officer (ACO) at the address located on the face of the contract, the Patent Administrator at email: (insert patent office email), the COTR, and the cognizant RIK Branch Office inbox specified in paragraph (a)(1) above, within the timeframes specified in the Patent Rights clause of this contract. The AFRL/___(insert patent office acronym) Patent Administrator can be reached at Area Code (insert patent office phone number).

(3) Please include in the subject line of the e-mail the contract number followed by the words "Invention Reporting." Also include in the body of the e-mail the names of the COTR and his/her office symbol. Contractors are highly encouraged to use DD Form 882, Report of Invention and Subcontracts to submit these reports. The DD Form 882 may also be used for the notification of an award of any subcontract(s) for experimental, developmental or research work which contain a "Patent Rights" clause.

(b) All other notifications (e.g., disclosure of each subject invention to the Contracting Officer within 2 months after the inventor discloses it) shall also be sent to the e-mail address in paragraph (a), with a courtesy copy (cc:) to the COTR.

Insert the following if other than a small business concern, nonprofit organization or education institution:

(c) This requirement also constitutes the request for the following information for any subject invention for which the contractor has retained ownership: (1) the filing date, (2) serial number and title, (3) a copy of the patent application, (4) patent number and issue date, and (5) a confirmatory instrument securing the Governments rights. Submittal shall be to the Patent Administrator e-mail address listed above, with a courtesy copy (cc:) to the COTR.

*DFARS 252.227-7038 states interim reports are due every twelve (12) months or such longer period as specified by the Contracting Officer. As such, if there are no interim subject inventions to disclose, interim reporting is not required and only a final report is required for submittal. If, at any time during contract performance, the status of subject inventions changes, the Contractor shall submit an interim Invention Report in accordance with paragraph (a).

Insert the following if a small business concern, nonprofit organization or educational institution:

(c) This requirement also constitutes the request for the following information for any subject invention for which the contractor has retained ownership: (1) the filing date, (2) serial number and title, (3) a copy of the patent application, and (4) patent number and issue date. Submittal shall be to the Patent Administrator e-mail address listed above, with a courtesy copy (cc:) to the COTR.

*DFARS 252.227-7039 states interim reports are due every twelve (12) months or such longer period as specified by the Contracting Officer. As such, if there are no interim subject inventions to disclose, interim reporting is not required and only a final report is required for submittal. If, at any time during contract performance, the status of subject inventions changes, the Contractor shall submit an interim Invention Report in accordance with paragraph (a).

8. OMBUDSMAN. Formerly DAFFARS 5352.201-9101. Include in all draft and final RFPs and contracts.

OMBUDSMAN

An ombudsman has been appointed to hear and facilitate the resolution of concerns from offerors, potential offerors, and others for this acquisition. When requested, the ombudsman will maintain strict confidentiality as to the source of the concern. The existence of the ombudsman does not affect the authority of the program manager, contracting officer, or source selection official. Further, the ombudsman does not participate in the evaluation of proposals, the source selection process, or the adjudication of protests or formal contract disputes. The ombudsman may refer the interested party to another official who can resolve the concern.

Before consulting with an ombudsman, interested parties must first address their concerns, issues, disagreements, and/or recommendations to the contracting officer for resolution. Consulting an ombudsman does not alter or postpone the timelines for any other processes (e.g., agency level bid protests, GAO bid protests, requests for debriefings, employee-employer actions, contests of OMB Circular A-76 competition performance decisions).

If resolution cannot be made by the contracting officer, the interested party may contact the ombudsman:

Ombudsman: AFRL/PK Technical Director Alternate Ombudsman: AFRL/PK Deputy Director 1864 4th Street

WPAFB OH 45433

Phone: (937) 904-9700

FAX: (937) 656-7321

Email: Afrl.pk.workflow@us.af.mil

Concerns, issues, disagreements, and recommendations that cannot be resolved at the Center/MAJCOM/FLDCOM/DRU ombudsman level, may be brought by the interested party for further consideration to the Department of the Air Force ombudsman, Associate Deputy Assistant Secretary (ADAS) (Contracting), SAF/AQC, 1060 Air Force Pentagon, Washington DC 20330-1060, phone number (571) 256-2395, facsimile number (571) 256-2431.

The ombudsman has no authority to render a decision that binds the agency.

Do not contact the ombudsman to request copies of the solicitation, verify offer due date, or clarify technical requirements. Such inquiries shall be directed to the contracting officer.

9. ELIMINATION OF USE OF CLASS I OZONE DEPLETING SUBSTANCES (ODS). Formerly DAFFARS 5352.223-9000. Include in all unless approval is obtained.

ELIMINATION OF USE OF CLASS I OZONE DEPLETING SUBSTANCES (ODS)

a. Contractors shall not:

1. Provide any service or product with any specification, standard, drawing, or other document that requires the use of a Class I ODS in the test, operation, or maintenance of any system, subsystem, item, component, or process; or

a. Provide any specification, standard, drawing, or other document that establishes a test, operation, or maintenance requirement that can only be met by use of a Class I ODS as part of this contract/order.

2. For the purposes of Department of the Air Force policy, the following products that are pure (i.e., they meet the relevant product specification identified in AFI 32-7086[AR2] ) are Class I ODSs:

a. Halons: 1011, 1202, 1211, 1301, and 2402;

3. Chlorofluorocarbons (CFCs): CFC-11, CFC-12, CFC-13, CFC-111, CFC-112, CFC-113, CFC-114, CFC-115, CFC-211, CFC-212, CFC-213, CFC-214, CFC-215, CFC-216, and CFC-217, and the blends R-500, R-501, R-502, and R-503; and

a. Carbon Tetrachloride, Methyl Chloroform, and Methyl Bromide.

10. INSURANCE CLAUSE IMPLEMENTATION. To identify the kind and minimum amounts of insurance required, insert the following implementing language when FAR 52.228-5, Insurance – Work on a Government Installation, and/or FAR 52.228-7, Insurance—Liability to Third Persons, applies:

INSURANCE CLAUSE IMPLEMENTATION

The Contractor shall obtain and maintain the minimum kinds and amounts of insurance during performance of this contract as specified by FAR 28.307-2, Liability, and contemplated by FAR 52.228-5, Insurance--Work on a Government Installation, and/or 52.228-7, Insurance--Liability to Third Persons.

11. INFORMATION REGARDING NON-US CITIZENS ASSIGNED TO THIS PROJECT. Use in ALL contract awards. Please note that paragraph (a) refers to the possibility that the CO may grant a waiver to this requirement; however, the CO can ONLY do so AFTER following the waiver process and obtaining a waiver from either AFRL/CA or AFRL/CZ in accordance with AFRL policy.

INFORMATION REGARDING NON-US CITIZENS ASSIGNED TO THIS PROJECT

(a) Contractor employees requiring access to USAF bases, AFRL facilities, and/or access to U.S. Government Information Technology (IT) networks in connection with the work on this contract must be U.S. citizens. For the purpose of base and network access, possession of a permanent resident card (“Green Card”) does not equate to U.S. citizenship. This requirement does not apply to foreign nationals approved by the U.S. Department of Defense or U.S. State Department under international personnel exchange agreements with foreign governments. It also does not apply to dual citizens who possess US citizenship, to include Naturalized citizens. Any waivers to this requirement must be granted in writing by the Contracting Officer prior to providing access. Specific format for waiver request will be provided upon request to the Contracting Officer. The above requirements are in addition to any other contract requirements related to obtaining a Common Access Card (CAC).

(b) In compliance with the REAL ID Act of 2005 and DoDM 5200.08V3_DAFMAN 31-101V3_DAFGM 2024-01, Installation Perimeter Access Control, effective 7 May 2025, all entrants to a Department of Air Force installation will be required to present REAL ID-compliant identification

(c) For purposes of paragraph (a) above, if an IT network/system does not require AFRL to endorse a contractor’s application to said network/system in order to gain access, the organization operating the IT network/system is responsible for controlling access to its system. If an IT network/system requires an U.S. Government sponsor to endorse the application in order for access to the IT network/system; AFRL will only endorse the following types of applications; consistent with the requirements above:

(1) Contractor employees who are U.S. citizens performing work under this contract.

(2) Contractor employees who are non-U.S. citizens and who have been granted a waiver.

Any additional access restrictions established by the IT network/system owner apply.

12. IMPLEMENTATION OF DISCLOSURE OF INFORMATION.

(a) Include one of the following requirements along with DFARS 252.204-7000 in all actions except if a DD 254 applies or work is for fundamental research (e.g., 6.1 funded contracts or 6.2 funded contracts with universities) per COTR/COR. If used in a services contract/order, replace COTR with COR throughout. The lead-time prior to release can be changed from 10 days to up to 45 days if desired/necessary.

(1) Use the following in non-DARPA funded actions:

IMPLEMENTATION OF DISCLOSURE OF INFORMATION

To comply with DFARS 252.204-7000, Disclosure of Information, the Contractor shall submit two copies of the information to be released to the Air Force Contracting Officer’s Technical Representative (COTR) and Contracting Officer at least X (10 or 50) days prior to the scheduled release date. The COTR will follow the same review process as for in-house authors and will provide the Public Affairs (PA) clearance number and date cleared (or denial reason) to the Contractor upon completion of Security and Policy Review (S&PR).

(2) For DARPA funded work performed under a contract that is NOT fundamental research, include the language that is contained in the BAA announcement, typically under the “Fundamental Research” section. Newer DARPA BAAs include the language at a separate link within the BAA announcement, titled “Additional BAA Content”.

(b) The following guidance is from RRSH 61-205, Management Handbook, paragraph 4.20.1: “Contractor Authors: If an S&PR is required, contractors will submit their unclassified articles, papers, reports, briefings, photos, posters, web pages, etc. that is intended for public dissemination (distribution A) to their government program managers for review in accordance with the terms of their contract. The Government program manager will follow the same review process as for in-house authors and will provide the PA clearance number and date cleared (or denial reason) to the contractor upon completion of S&PR. The government program manager will ensure that the Distribution Statement A (i.e. Approved for Public Release, Distribution Unlimited), PA clearance number, and date cleared are clearly marked on the presentation or publication material.”

(c) Normally, the Disclosure of Information and Export-Controlled Data Restrictions clauses flow down to the subcontractors. AFRL follows DoW policy that Contracted Fundamental Research is exempt from Disclosure of lnformation and Export-Controlled Data Restrictions except in exceptional circumstances. Per advice from the legal advisor at the time, Mr. Carmen Pisano (RIJ), provided at a 10 May 2010 meeting with RIKA and RIG, a Contracting Officer can tailor “Implementation of Disclosure of Information” to authorize the prime contractor not to apply these restrictions to the university partners when those partners are using only public domain information to provide their research results to the performers who may be working with export-controlled information.

13. REGARDING EXPORT CONTROL. Insert the following only if the COR/COTR indicates that items being delivered are being developed for both civil and military applications (e.g., ICO Tool). Do not include the language if items being developed under the instant contract are for military application ONLY. Per the ITAR, all items developed under our contracts are subject to export control UNLESS the below language is included in the contract. This does not preclude the possibility of another ITAR exception applying.

REGARDING EXPORT CONTROL

The items to be delivered under this contract are being developed for both civil and military applications (reference ITAR, 22 CFR Part 121, Category XI (Military Electronics), (a)(7) Note 1 to Paragraph (a)(7) – sub reference (c). As stated in DFARS 252.225-7048, the Contractor’s responsibility to comply with all applicable laws and regulations regarding export-controlled items exists independent of, and is not established or limited by, the information provided by this requirement.

14. PROTECTING CONTROLLED UNCLASSIFIED INFORMATION (CUI). Include the following requirement in all contracts involving CUI except if a DD 254 applies or the CO has determined that the work is for fundamental research (e.g., 6.1 funded contracts or 6.2 funded contracts with Universities). If a CUI Guide has not been generated for a given effort/program, delete “the applicable CUI Guide titled “_____” dated _____ (hereby incorporated by reference).”

PROTECTING CONTROLLED UNCLASSIFIED INFORMATION (CUI)

(a) Protect CUI received, provided, or generated under this contract from unauthorized disclosure by appropriately marking, safeguarding, disseminating, and destroying such information.

(b) General. Protect CUI in accordance with DoDI 5200.48, the applicable CUI Guide titled “____________________,” dated _________ (hereby incorporated by reference), and the following controls and protective measures:

(1) The “CUI” marking is assigned to information at the time of its creation in a DOW User Agency. It is not authorized as a substitute for a security classification marking but is used on official Government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act.

(2) Other non-security markings, such as “Limited Official Use” and “Official Use Only” are used by non-DOW User Agencies for the same type of information and shall be safeguarded and handled in accordance with instruction received from agencies.

(3) Use of markings does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate Government purpose is served by withholding the information or portions of it.

(c) Identification Markings.

(1) An unclassified document containing CUI information shall be marked “CUI” in bold capitalized black text and centered, in both the header (i.e., the “Banner Marking”) and footer on all pages of the documents. Portion markings are optional on unclassified documents. However, if annotated, they must be applied to all portions, to include subjects, titles, paragraphs, subparagraphs, bullet points, figures, charts, tables, etc.

(2) Any “CUI” information released to a contractor by a DOW User Agency is required to be marked with the following statement prior to transfer:

This document contains information EXEMPT FROM MANDATORY DISCLOSURE under the FOIA. Exemptions _______ apply.

(3) When the CUI status of information is terminated, all known holders shall be notified. Upon notification, holders will remove the CUI markings.

(d) Dissemination. Disseminate “CUI” information only to employees and/or subcontractors who have a need for the information as specific to this effort. Access: No person may have access to information designated as CUI unless that person has been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose.

(e) Storage. During working hours, reasonable steps shall be taken to minimize the risk of access by unauthorized personnel. After working hours, CUI information may be stored in unlocked containers, desks, or cabinets if Government-contract building security is provided.

(f) Transmission. Send “CUI” information only via first-class mail, parcel post, or bulk shipments.

(g) Disposition. CUI information shall be disposed of by tearing each copy into pieces to preclude reconstructing, and placing it in a regular trash container or as directed by the User Agency.

(h) Unauthorized Disclosure. Unauthorized disclosure of “CUI” information does not constitute a security violation but the releasing agency shall be informed of any unauthorized disclosure. Unauthorized disclosure of certain CUI, such as export-controlled technical data, may result in criminal sanctions.

15. NOTIFICATION OF GOVERNMENT SECURITY ACTIVITIES. Formerly DAFFARS 5352.204-9000. Insert if effort includes DD254.

NOTIFICATION OF GOVERNMENT SECURITY ACTIVITIES

This contract contains a DD Form 254, DOW Contract Security Classification Specification, and requires performance at a government location in the U.S. or overseas. Prior to beginning operations involving classified information on an installation identified on the DD Form 254, the contractor shall take the following actions:

(a) At least thirty days prior to beginning operations, notify the Information Protection Office shown in the distribution block of the DD Form 254 as to:

1. The name, address, and telephone number of this contract company’s representative and designated alternate in the U.S. or overseas area, as appropriate;

2. The contract number and military contracting command;

3. The highest classification category of defense information to which contractor employees will have access;

4. The Department of the Air Force installations in the U.S. (in overseas areas, identify only the APO number(s)) where the contract work will be performed;

5. The date contractor operations will begin on base in the U.S. or in the overseas area;

6. The estimated completion date of operations on base in the U.S. or in the overseas area; and,

7. Any changes to information previously provided.

16. SECURITY INCIDENT REPORTING AND PROCEDURES. Formerly DAFFARS 5352.204-9002. Insert if your effort includes a DD254.

SECURITY INCIDENT REPORTING AND PROCEDURES

(a) The contractor shall follow the below guidance when a contract contains a DD Form 254, DOW Contract Security Classification Specification:

1. The contractor shall notify the Government Contracting Activity (GCA) of any security incident involving the potential or actual loss, compromise, or suspected compromise of Top Secret, Secret, and/or Confidential information, referred to as classified information, when the incident is discovered at the contractor’s location.

i. The contractor shall conduct the requisite inquiry(ies) in accordance with 32 CFR Part 117 and Cognizant Security Office (e.g., Defense Counterintelligence and Security Agency) guidance.

2. Security incidents occurring at government performance locations where the contractor is categorized as a visitor will be processed and reported in accordance with government host security procedures.

3. Security incidents involving the potential or actual loss, compromise, or suspected compromise of Special Access Program and/or Sensitive Compartmented Information is under the jurisdiction of the GCA and the contractor shall follow GCA guidance in lieu of this requirement.

4. This requirement does not relieve the contractor from reporting requirements set forth in 32 CFR Part 117, DFARS 252.204-7012, or as otherwise directed by contract requirements and/or its Cognizant Security Office (e.g., Defense Counterintelligence and Security Agency).

5. This requirement does not relieve the contractor from adhering to security incident guidance set forth by its Cognizant Security Office (e.g., Defense Counterintelligence and Security Agency).

6. The contractor is responsible for ensuring all applicable subcontracts include these security incident reporting requirements.

7. If the lost or compromised information is beyond the jurisdiction of the U.S. Government and cannot be recovered (e.g., media leak, public website posting, or loss in a foreign country), the notification and location of the compromise (e.g., geographic location of unrecoverable equipment) shall be classified commensurate with the classification level of the compromised material to prevent further unauthorized disclosure in accordance with DoDM5200.01 Volume 3, Enclosure 6. The contractor will contact the GCA for instructions on how to communicate the notification prior to submission in all cases where lost or compromised information is beyond the jurisdiction of the U.S. Government and cannot be recovered.

8. The contractor shall ensure all notifications determined to contain classified information are properly transmitted and marked in accordance with derivative classification and overarching marking guidelines in accordance with 32 CFR Part 117.

(b) Initial Notification of Security Incident

1. The contractor shall provide an initial notification of security incident to the GCA within 72 hours of discovery of any incident where classified information may have been subjected to loss, compromise, or suspected compromise for all security incidents involving the contractor’s location unless otherwise directed by contract requirements.

2. The initial notification to the GCA is considered Controlled Unclassified Information (CUI) [CUI category OPSEC, FEDCON Distribution/Dissemination Control] unless otherwise determined by the GCA, marked in accordance with DoDI5200.48, and shall be transmitted to the GCA through authorized means (e.g., encrypted email or DoD SAFE).

3. If the initial notification contains classified information either by content or through classification through compilation, the contractor will contact the GCA for submission guidance and ensure the notification is properly marked in accordance with derivative classification and overarching marking guidelines in accordance with 32 CFR Part 117.

4. The initial notification shall contain the following information, as available at the time of report:

i. Prime contract number associated with the security incident.

ii. Date of security incident occurrence.

iii. Date of security incident discovery if different from date of occurrence.

iv. Security Classification Guide (SCG) or guidance used to validate classification level of information involved (unclassified title/date); if SCG title is either classified or if listing SCG information will cause the notification to be classified by compilation, do not include and indicate as such in the initial notification.

v. Classification level of information involved (e.g., Top Secret, Secret, or Confidential)

vi. Brief description of incident prompting initial notification. If incident directly or indirectly involved government personnel, include government personnel name(s), email address(s), and office information.

vii. Communicate whether it is possible for the contractor to properly retain and/or provide the suspected information in question for GCA classification review and/or damage assessment.

(c) Final Notification of Security Incident

1. The contractor shall provide a final notification to the GCA 10 business days from date of initial notification. If the final notification cannot be made 10 business days from the date of the initial notification, the contractor shall request an extension and receive approval in writing from the GCA.

2. The final notification to the GCA does not relieve the contractor from reporting requirements set forth by 32 CFR Part 117, DFARS 252.204-7012, or as otherwise directed by contract requirements and/or its Cognizant Security Office (e.g., Defense Counterintelligence and Security Agency).

3. The final notification will be considered CUI [CUI category OPSEC, FEDCON Distribution/Dissemination Control] unless otherwise determined by the GCA, marked in accordance with DoDI5200.48, and sent through authorized means (e.g., encrypted email or DoD SAFE).

4. If the final notification contains classified information either by content or through classification through compilation, the contractor is required to contact the GCA for submission guidance and ensure the notification is properly marked in accordance with derivative classification and overarching marking guidelines in accordance with 32 CFR Part 117.

5. The final notification shall contain the following information:

i. Prime contract number associated with the security incident.

ii. Date of security incident occurrence.

iii. Date of security incident discovery if different from date of occurrence.

iv. Security Classification Guide (SCG) or guidance used to validate classification level of information involved (unclassified title/date); if SCG title is either classified or if listing SCG information will cause the report to be classified by compilation, do not include this information, and indicate as such in the final notification.

v. Classification level of information involved (e.g., Top Secret, Secret, or Confidential)

vi. Detailed description of incident and include the following:

Sequence of events: When, where, and how did the incident occur?

What persons, situations, and/or conditions caused or contributed to the incident?

If incident originated with government personnel, include government personnel name(s), email address(s), and office information.

Include the name(s), email address(s), and office information of all government personnel involved, either directly or indirectly, as appropriate If classified information is alleged to have been physically lost (e.g., lost classified document), what steps were taken to locate the material?

If security incident was categorized as a data spill, include measures taken to properly sanitize all impacted assets.

vii. Corrective actions taken to prevent future occurrences

viii. Result of inquiry (e.g., loss, compromise, suspected compromise, or no compromise)

ix. A copy of the supporting DD Form 254(s) associated with prime contract. If DD Form 254 cannot be provided, the contractor shall indicate the reasons why in the final report.

(d) Definitions “32 CFR Part 117” means National Industrial Security Program Operating Manual. “Business days” means days that do not include federal holidays or weekends.

“Classified information” means information the government designates as requiring protection against unauthorized disclosure in the interest of national security, pursuant to E.O. 13526, Classified National Security Information, or any predecessor order, and the Atomic Energy Act of 1954, as amended. Classified information includes national security information (NSI), restricted data (RD), and formerly restricted data (FRD), regardless of its physical form or characteristics (including tangible items other than documents).

“Cognizant security agencies (CSAs)” means agencies E.O. 12829, sec. 202, designates as having National Industrial Security Program implementation and security responsibilities for its own agencies (including component agencies) and any entities and non-CSA agencies under their cognizance. The CSAs are: Department of War (DoW); Department of Energy (DOE); Nuclear Regulatory Commission (NRC); Office of the Director of National Intelligence (ODNI); and Department of Homeland Security (DHS).

“Cognizant Security Office” means an organizational unit to which the head of a CSA delegates authority to administer industrial security services on behalf of the CSA.

“Compromise” means an unauthorized disclosure of classified information.

“Data spill” means electronic transmission of classified information via unsecure means such as classified information transmitted over an unclassified network.

“DD Form 254” means the Department of Defense Contract Security Classification Specification.

“Derivative classification” means incorporating, paraphrasing, restating, or generating in new form information that is already classified, and marking the newly developed material consistent with the classification markings that apply to the source information. Includes the classification of information based on classification guidance. The duplication or reproduction of existing classified information is not derivative classification.

“Final Notification of Security Incident” means contractor (or subcontractor) notification to the Government Contracting Activity communicating the results of the inquiry conducted.

“Government Contracting Activity” means an element of a Component designated and delegated by the Component head or designee with broad authority regarding acquisition functions to include the appropriate resources and personnel (e.g., contracting officers or their designees, program managers, program offices, and security personnel) as defined in DoDM 5220.32, Volume 1.

“Initial Notification of Security Incident” means the contractor’s (or subcontractor) notification to the Government Contracting Activity of a security incident occurrence and surrounding details of occurrence.

“Inquiry” means the initial fact-finding and analysis process to determine the facts of any security incident and conducted to determine whether or not there was a loss of classified information or whether or not unauthorized personnel had, or could have had, access to the information.

“Loss” means the inability to physically locate or account for classified information.

“Security classification guide” means a documentary form of classification guidance issued by an Original Classification Authority that identifies the elements of information regarding a specific subject that must be classified and establishes the level and duration of classification for each such element.

“Security Incident” means an incident that results from the mishandling of classified information.

“Suspected Compromise” means when a result of no loss or compromise of classified information cannot be determined with certainty.

17. CONTRACTED FUNDAMENTAL RESEARCH DETERMINATION

Include the following language when the Contracting Officer has made the determination that the work to be done is contracted Fundamental Research, in accordance with DFARS PGI 240.372-2(2). A written determination shall also be included in the contract file.

CONTRACTED FUNDAMENTAL RESEARCH DETERMINATION

This effort has been determined to be contracted fundamental research in accordance with National Security Decision Directive 189, National Policy on the Transfer of Scientific, Technical and Engineering Information, in effect on the date of contract award and the Under Secretary of Defense (Acquisition, Technology, and Logistics) memoranda on Fundamental Research, dated 24 MAY 2010. The fundamental research is applicable to Statement of Work section(s)/task(s) XXX (insert applicable SOW paragraph number(s)), only as long as the work remains in the public domain or is considered fundamental research and not sensitive or inappropriate for public release. Any time work progresses to the non-public domain, exceeds the scope of fundamental research, or the Contractor has reason to believe the work has become sensitive or inappropriate for release to the public, then exception at DFARS 252.204-7000(a)(3) no longer applies.

18. VISIT REQUESTS. Include the following requirement in all classified contracts to implement the requirements in 32 CFR 117.16

VISIT REQUESTS

All requests for Government certification of Contractor employees' need-to-know and visit authorizations to other Government installations or Contractor facilities shall be forwarded for approval to the Contracting Officer’s Technical Representative (COTR) (change COTR to Contracting Officer’s Representative (COR), if services), whose mailing address is:

ATTN: (Insert COTR/COR's Name) Air Force Research Laboratory/(Insert COTR/COR's Office Symbol) (Insert COTR/COR's Street Address) (Insert COTR/COR's Zip Code)

In compliance with the REAL ID Act of 2005 and DoDM 5200.08V3_DAFMAN 31-101V3_DAFGM 2024-01, Installation Perimeter Access Control, effective 7 May 2025, all entrants to a Department of Air Force installation will be required to present REAL ID-compliant identification.

19. PRINCIPAL INVESTIGATOR. Use the following requirement when it is desired to identify the Principal Investigator (required for all SBIR/STTR Phase I and II awards; NOT required for Phase IIIs):

PRINCIPAL INVESTIGATOR

The (insert Contractor) Principal Investigator(s) for this effort is (are) (insert names). No substitution shall be made without the prior written approval of the Air Force Procuring Contracting Officer (PCO).

20. BASE SUPPORT.

(a) When the Contractor will use Government property available at a Government facility, it is considered Base Support since title and accountability remains with the Government. When considered necessary for contract performance of work on site at Air Force installations, include the following suggested language. In paragraph (f), include specific details of the extent of base support to be provided, including but not limited to whether a Common Access Card (CAC) is required; whether access will be on a non-interference basis, the maximum number of hours of use, the frequency of use (daily, weekly, etc), the duration of use and use pattern (1 hour each time, 5 hours per week, etc.), time of access (0800-1700, 1700-2400, weekdays, weekends, etc.), storage requirements and desired configuration, etc. Sample language is contained in the Base Support letter on the AFRL Sharepoint under “Initial Memorandums and Preliminary Documents.”

BASE SUPPORT

Base support will be provided by the Government to the Contractor in accordance with this requirement. Failure by the Contractor to comply with this requirement shall release the Government, without prejudice, from its obligation to provide base support by the date(s) required. If warranted, and if the Contractor has complied with the requirements of this requirement, an equitable adjustment shall be made if the Government fails to provide base support by the date(s) required.

(a) The Contractor will require use of base support on a rent-free, non-interference basis, to include Government-controlled working space, material, equipment, services (including automatic data processing), or other support (excluding use of the Defense Switched Network (DSN)) which the Government determines can be made available at, or through, any Air Force installation where this contract shall be performed.

(b) Unless otherwise stipulated in the contract schedule, the Contractor will use base support on a no-charge-for-use basis and the value shall be a part of the Government's contract consideration.

(c) The Contractor shall immediately report (with a copy to the cognizant CAO) inadequacies, defective base support, or nonavailability of support stipulated in this SOW requirement, together with a recommended plan for obtaining the required support. Facilities shall not be purchased under this contract by the Contractor. Additionally, the Contractor (or authorized representative) shall not purchase, or otherwise furnish any base support requirement provided by this SOW (or authorize others to do so), without prior written approval of the Contracting Officer regarding the price, terms, and conditions of the proposed purchase, or approval of other arrangements.

(d) In compliance with the REAL ID Act of 2005 and DoDM 5200.08V3_DAFMAN 31-101V3_DAFGM 2024-01, Installation Perimeter Access Control, effective 7 May 2025, all entrants to a Department of Air Force installation will be required to present REAL ID-compliant identification.

(e) Following are installations where base support will be provided:

(READ AND DELETE: Insert list of installations. Provided below are 2 examples. Modify as appropriate for your effort.)

Air Force Research Laboratory, Building, Address

(f) The base support to be furnished under this contract is as follows:

(READ AND DELETE: Insert list of support items as stated in the Base Support letter. Provided below are 2 examples. Modify as appropriate for your effort.)

Example 1

(i) Office space for (insert number of contractor personnel) personnel.

(ii) Use of computers, hardware, software, databases, documentation, and other related material necessary to accomplish the contract requirements.

(iii) Parking for personal vehicles. Access will be provided for the duration of the contract during normal work hours (0800-1700), Monday through Friday, excluding Federal holidays (New Year's Day, Dr. Martin Luther King, Jr. Day, President's Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veteran's Day, Thanksgiving, Christmas). Other times and days are available only upon coordination and approval by the cognizant COTR/COR, (insert name and contact information). Contractor personnel working within the facility are required to have Common Access Cards (CAC).

Example 2

(i) Access to the Computer Science and Technical Facility and use of the SUN Workstations and PC/Macintosh computers located therein for periodic installation and demonstration of experimental software on a non-interference basis.

(ii) These facilities will be available to the Contractor and Subcontractors for a period of two days prior to each installation and demonstration.

(iii) Access to the Facility will be provided during normal work hours (0800-1700), Monday through Friday, excluding Federal holidays (New Year's Day, Dr. Martin Luther King, Jr. Day, President's Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veteran's Day, Thanksgiving, Christmas.) A formal request for laboratory access is required by letter or email at least thirty (30) days in advance. The request shall state the number and type of equipment (including preinstalled software) necessary for demonstration; estimation of setup and demonstration time; and the number of people who will require access to equipment.