1a._Attch_1 _DD_254_Continuation.docx

DEPARTMENT OF DEFENSE CONTRACT SECURITY PRIME CONTRACT NUMBER

CLASSIFICATION SPECIFICATION (continued)

REVISION NUMBER

13. SECURITY GUIDANCE (continued)

- The following security classification guidance and subsequent revision/changes apply to this contract:

(1) Dedicated Space Surveillance Network Sensors Classification Guide (SCG), 31 December 2005 (or current edition); OPR: HQ AFSPC/XOC

(2) Security Classification Guide for Space Surveillance Operations, dated 15 July 2006 (or current edition); OPR: HQ USSTRATCOM/J33

- Block 8a: Det 1 (Socorro), PO Box W, Socorro, NM 87801; Det 2 (Diego Garci), Diego Garcia BIOT PSC 466 Box 51 FPO 96595-0051; Det 3 (Maui), 535 E. Lipoa Pkwy, Ste 200, Kihei, HI 96753 **** See Continuation Pages for Additional Security Guidance

- Block 8b: Cage: N/A

- Outgoing classified visit requests by the subcontractor, shall be routed "thru"; Need to add after award

- All classified visit requests shall contain information required in Chapter 6 of the NISPOM, and shall not exceed the contract expiration date.

Technical point of contact for Need to add after award

• ref 10.a, COMMUNICATIONS SECURITY (COMSEC) INFORMATION: See Appendix A, COMMUNICATIONS SECURITY (COMSEC) attached.

Ref 10.e(2), INTELLIGENCE INFORMATION, Non-SCI: Air Force Instruction (AFI) 14-303. Release of Intelligence to US Contractors. applies to the contract.

• Ref 10.j, FOR OFFICIAL USE ONLY INFORMATION (FOUO): FOUO information provided under this contract shall be safeguarded as specified in DoDM 5200.01, Volume 4, Enclosure 3 for specific FOUO information.

• Ref 11.a, HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY: Contractor performance is restricted to Det 1 (Socorro), PO Box W, Socorro, NM 87801; Det 2 (Diego Garci), Diego Garcia BIOT PSC 466 Box 51 FPO 96595-0051; Det 3 (Maui), 535 E. Lipoa Pkwy, Ste 200, Kihei, HI 96753. Using activity will provide security classification guidance for performance of this contract.

• Ref. 11.f, HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESIONS AND TRUST TERITORIES: Diego Garcia. BlOT.

• Ref. 11.g, BE AUTHORIZED TO USE THE SERVICES OF OTIC OR OTHER SECONDARY DISTRIBUTION CENTER: The contractor must prepare and process a DO Form 1540 and 2345 for request to utilize the Defense Technical Information Center (OTIC). Reference the NISPOM, Chapter 11, Section 2. for preparation and processing of these forms. CO submits DO 1540 on behalf of the Contractor,

• Ref 11.h, REQUIRE A COMSEC ACCOUNT: See Appendix A. COMMUNICATIONS SECURITY (COMSEC), attached.

• Ref. 11.i, HAVE TEMPEST REQUIREMENTS: See Appendix B, EMISSIONS SECURITY ASSESSMENT REQUEST (ESAR) FOR ALL CLASSIFIED SYSTEMS, attached.

• Ref. 11.j, HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS: See Appendix C, OPERATIONS SECURITY (OPSEC), attached.

Ref. 11.l, OTHER: Computer security (COMPUSEC): Tasks outlined in Performance Work Statement (PWS). Chapter 8, paragraph 8.3.1.1.

14. ADDITIONAL SECURITY REQUIREMENTS (continued):

DoD 5220.22M and as specified by unit directives. The contractor shall execute a VGSA with the government.

• Note 1. The use of Automated Information Systems (AIS) for processing and producing classified information at GEODSS sites is required. Contractor shall assist with information systems accreditation as stated in the PWS.

• Note 2. The Contractor shall comply with security and law enforcement policies and procedures in effect on military installations where contractor performance occurs under this contract The contract is performed within USAF controlled areas (GEODSS sites), Contractor employees are subject to a National Agency Check or have already been issued a final or interim secret clearance for the purpose of access to classified information before being permitted unescorted entry to these controlled areas, Contractor employees not meeting the prerequisite for unescorted entry shall be under the continuous escort by other cleared contractor employees while in controlled areas.

• Note 3. When performance involves classified information on a military installation where the Contractor does not possess a facility, clearance for that location. the contractor operation is considered a "visitor group" on the installation. As such, the contractor's security procedures will be integrated with those of the installation, The Contractor shall enter into a security agreement (or understanding) with the responsible military commander(s) to formalize:

1. Those security actions which will be performed for the contractor by the military installation. such as providing storage and classified reproduction facilities; guard services; security forms; physical security inspections; classified mail services;

security badging; antiterrorism/force protection training/guidance; visitor control; and investigation security incidents and;

2. Those security actions for which joint action may be required. such as packaging and addressing classified transmittals, security checks, internal security controls, and implementing emergency procedures to protect classified materials.

• Note 4. The Contractor shall provide a visit request in accordance with the Contractor Visitor Group Security Agreement (VGSA) to the Cognizant Security Office (list in Block 8) and the Detachment Commander (Det CC) to permit unescorted entry into military controlled areas and/or access to classified information while on the military installation (DOD 5220.22-M, National Industrial Security Program (NISPOM). Feb 2006, Chapter 6). At Dets 2 and 3, the Contractor shall follow the security requirements of the Host installation. However, this does not relieve the contractor from security oversight of their employees who are long-term visitors at military installations. Verify PCL level as required by the Host. The Department of Defense, acting as a CSA, has designated the Joint Personnel Adjudication System (JPAS) as the 000 system of record for contractor eligibility and access.

• Note 5. The VGSA ensures the national security interests are protected by confirming security support and identifying security procedures unique to each GEODSS site. The military installation's Security Service Agency (SSA), in coordination with the Det CC and Cognizant Security Office (CSO), develops the agreement which is signed by the Det CC.

• Note 6. If after reviewing the VGSA and discussing it with the military commander or representative, the Contractor believes there may be a cost impact. the Contractor will notify the Contracting Officer (CO) courtesy copying the Government Program Manager (PM) in writing. The CO will work closely with the Facility Security Office (FSO) toward an appropriate solution,

• Note 7. The VGSA, when signed by the contractor's security manager, Cognizant Security Office, and the Det CC, may suffice in lieu of a Standard Practice Procedure for long-term visitor contractor performance on a military installation.

15. INSPECTIONS (continued):

shall be conducted by the ISPM unless a Host Tenant Support Agreement (HTSA) relinquishes that responsibility to the host installation. HQ AFSPC/IN retains security cognizance of all Intelligence materials released to the contractor.

The contract effort will be performed on a military installation. The CSO is responsible for industrial security supervision and inspections of the contractor to ensure contractor compliance with DOD 5220.22-M.

National Industrial Security Program (NISPOM). Feb 2006, and DoD 5220 22-R. Industrial Security Regulation. At Det 3. also comply with AFI31-401.

17.f REQUIRED DISTRIBUTION, OTHERS AS NECESSARY:

Defense Security Service Field Office, S41PX (Attn: THOMAS COURTRIGHT, Industrial Security Rep, Tucson) 21 SW/IPV (Attn: EDUARDO PEREZ, Security Administrator, Peterson AFB) 21 SW/IP (Attn: RICHARD K. ELLIN, Information Security Program Manager, Peterson AFB) 21 SW/PMOS (Attn: KENNETH FRIESZ, GEODSS Program Manager) 377 MSGI SCB (CA624520) (Attn: BECKY J GUTIERREZ, COMSEC Responsible Officer) Det 2, 22 SOPS (Attn: MICHAEL FLEENOR, COMSEC Responsible Officer) Det 15, AFRL (Attn: MICHAEL HAGSTON, COM SEC Responsible Officer) 21 CS/SCXS (Attn: ROBERT TORRES, GS-11, EMSEC Subject Matter Expert) 21 OSS/CCS (Attn: NANCY M. HARVEY, Security Manager)

DEPARTMENT OF DEFENSE CONTRACT SECURITY PRIME CONTRACT NUMBER

CLASSIFICATION SPECIFICATION (continued)

REVISION NUMBER

13. SECURITY GUIDANCE (continued)

APPENDIX A

COMMUNICATIONS SECURITY (COMSEC)

(Reference to Item 11h of DD Form 254)

a. Ref 10.a: COMSEC material/information may not be released to DOD contractors without HQ Cryptologic System Group (HQ CPSG) approval. Forward requests for COMSEC material information to the COMSEC officer through the program management office. Control and protect COMSEC material/information as governed by NISPOM, Chapter 9. Access to COMSEC material is restricted to us Citizens holding final US Government clearances. Such information is not releasable to personnel holding only reciprocal clearances.

b. The 377th Communication Squadron, Kirtland AFB, NM, conducts COMSEC inspections for Det 1. Det 2 is a sub-COMSEC account holder and is inspected by its parent account holder, Det 2, 22 SOPS. Det 15/AFRL (MSSC) conducts COMSEC inspections for Det 3.

c. Ref 11.h. Access to and retention/storage of Communications Security (COMSEC) and cryptographic information by the contractor employees will be in accordance with AFKAG-1 , AFKAG-2, and specialized COMSEC documents. Certain contractor employees (See AFI 33-201) engaged in operating or maintaining COMSEC equipment, or having access to COM SEC documents or keying material at the SECRET level, must consent to a periodic counterintelligence scope polygraph examination administered by the Government Contractor personnel who refuse to take the polygraph examination will not be selected for this assignment.

d. Ref 11.k, At Det 1, Contractor transports COMSEC materials from Kirtland AFB to the site. At Dets 2 and 3, COMSEC material shipped to the site comes through the Defense Courier Service (DCS).

e. Task requirements are outlined in the PWS, Chapter 8, paragraphs 8.3.3 through 8.3.3.2 for this effort.

Appendix A-1

DEPARTMENT OF DEFENSE CONTRACT SECURITY PRIME CONTRACT NUMBER

CLASSIFICATION SPECIFICATION (continued)

APPENDIX C

EMISSIONS SECURITY ASSESSMENT REQUEST (ESAR)

FOR ALL CLASSIFIED SYSTEMS

(Reference DO Form 254, Block 11.i)

a. The contractor shall ensure that compromising emanations (EMSEC) conditions related to this contract are minimized.

b. The contractor shall provide countermeasures assessment data to the Host Information Assurance (IA) office in the form of a EMSEC Security Assessment Request (ESAR). The ESAR shall provide only specific responses to the data required in paragraph c below. The contractor's standard security plan shall NOT be based as a "stand-alone" ESAR response. The contractor shall NOT submit a detailed facility analysis/assessment The ESAR information will be used to complete an EMSEC Countermeasures Assessment Review of the contractor's facility to be performed by the government EMSEC authority using current Air Force EMSEC directives. EMSEC is applied on a case-by-case basis and further information may be required to complete the review; should this be the case, the contractor shall provide this information to the CO courtesy copying the Government PM when requested. After the evaluation of the ESAR by the government EMSEC authority. additional EMSEC requirements may be necessary.

c. *ESAR contents shall include, as a minimum, the following information (NISPOM, para 11-101c):

(1) The specific classification and special categories of material to be processed/handled by electronic means.

(2) The percentage of information being processed. Identify the approximate percentage for each level of information processed including unclassified.

(3) The specific location where classified processing will be performed.

(3) The name, address. title, and contact information (telephone numb.er) for a point-of-contact at the facility where processing will occur.

NOTE: If the facility is physically relocated to another geographical location, the information requested in paragraph "c" above MUST be furnished to the Host IA office and CO courtesy copying the Government PM.

"NOTE: A copy of your Automated Information System Security Plan(s) (AISSP) will suffice.

d. The prime contractor shall ensure that all subcontractors and/or vendors comply with EMSEC requirements when performing classified processing related to this contract They will provide the above documentation through their prime to the CO to complete the ESAR.

e. Task requirements are outlined In PWS for this effort.

Appendix C-1

DEPARTMENT OF DEFENSE CONTRACT SECURITY PRIME CONTRACT NUMBER

CLASSIFICATION SPECIFICATION (continued)

APPENDIX D

OPERATIONS SECURITY (OPSEC)

(Reference DO Form 254, Item 11.j)

1. PURPOSE: This section outlines the requirements and procedures necessary to protect Critical Information for Operations Security (OPSEC).

2. MISSION: To maintain a continuing awareness of adversary interest in center actions and adversary intelligence collection capabilities. To understand the need to identify and protect classified and unclassified indicators, which occur, reveal sensitive information. To evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

3. DEFINITION: OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

a. Identify those actions that can be observed by adversary intelligence systems.

b. Determine indicators hostile intelligence systems might obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

c. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

4. OBJECTIVES:

a. To protect planned operational center activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

b. To preserve secrecy concerning specific scenario events and a NORAD response to these events.

c. To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. TASKS: Task requirements are outlined in the Statement of Work for this effort and at a minimum must include:

a. Release of the organizations Critical Information List to the contractor.

b. Threat information available (Threat Working Group Minutes).

c. Contractor receiving OPSEC training from the sponsoring organization.

d. Specific OPSEC countermeasures as needed.

Appendix D·1