ATTACHMENT_9__DD_FORM_254.docx

DEPARTMENT OF DEFENSE

1. CLEARANCE AND SAFEGUARDING

TOP SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

a. PRIME CONTRACT NUMBER

Date of award

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs) Revision No.

Date (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER

FA2517-15-R-7001

Due Date (YYYYMMDD) To be entered by CO for the RFP due date

|X|

4. IS THIS A FOLLOW-ON CONTRACT?

Classified material received or generated under _______________________________(Preceding Contract Number) is transferred to this follow-on contract

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

7. SUBCONTRACTOR

8. ACTUAL PERFORMANCE

Headquarters NORAD and USNORTHCOM/J6 250 Vandenberg Street, Suite B016 Peterson AFB, CO 80914-3814

250 Vandenberg Street, Suite B016 Peterson AFB, CO 80914-3819

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

The objective of this task is to provide Information Technology Services (Operations and Maintenance) to NORAD and USNORTHCOM. Services include professional, administrative, technical, and management supporting the enterprise IT architecture. Those portions pertaining to SCI cleared personnel and facilities are exclusively the responsibility of HQ N-NC SSO.

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

e. INTELLIGENCE INFORMATION:

k. OTHER Specify)

DD Form 254, DEC 1999 Previous editions are obsolete

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct |X|

Through (Specify):

No public release of SCI is authorized.

Public Release POC: N-NC Public Affairs Office, 719-554-6889 250 Vandenberg St., Bldg 2 Peterson AFB, CO 80914-3809 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance. See Attachment (3): See continuation sheet for Attachment 1, 2, 3, & 4 (attached).

DIRECTORATE / DIVISION Babette C. Whorley, DAFC N-NC/J6, Security Manager N-NC/J68, Acquisition Program Manager

Patty Crossley, DAFC Stephana Sherwood, DAFC N-NC/CSMS, Industrial Security Specialist N-NC/J66, Senior Contracting Officer Representative

Ashley N. Spicer, DAFC Thomas J. Clark N-NC/J66 COMSEC Manager N-NC/J2, Special Security Office

Provide the information requested by AFFARS 5352.204-9000, Notification of Government Security Activity Clause, and AFI 31-601, Industrial Security Program Management, to the Command Security Office (CSMS). Refer to the contract document for these clauses. Shipments of classified or sensitive equipment shall be handled, transported, transmitted and protected IAW NISPOM, DoD 5220.22M and as specified by unit directives. The contractor shall execute a VGSA with the government.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

No

DSS is relieved of inspection responsibility for all classified material that is released to or developed by the contractor while on a military installation. DSS retains inspection responsibility for all non-SCI classified material released to or developed by the contractor and held in the contractors’ facility. The SSO maintains inspection responsibility for all SCI material related to this contract. Local Information Protection Management Evaluations (LIPME) while operating on an Air Force installation shall be conducted by the CSMS. HQ AFSPC/IN retains security cognizance of all Intelligence materials released to the contractor.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

KAREN HOLDERFIELD

b. TITLE

Contracting Officer

c. TELEPHONE (Include Area Code)

719-556-0050

21st Contracting Squadron/LGCCA 135 Dover St, Ste. 2204 Peterson AFB, CO 80914 |X|

a. CONTRACTOR

b. SUBCONTRACTOR

|X|

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

|X|

e. ADMINISTRATIVE CONTRACTING OFFICER

|X|

f. OTHERS AS NECESSARY: HQ NORTHCOM CS

HQ N-NC/J2 SSO

DD Form 254 (BACK), DEC 1999

CONTINUATION – DD FORM 254

Solicitation FA2517-15-R-7001

ITEM 8: Additional Support Locations:

1. Primary support location: Headquarters NORAD and USNORTHCOM, Bldg. 2, Peterson AFB Colorado 80914

2. HQ NORAD and USNORTHCOM Cheyenne Mountain Air Force Station (CMAFS), 1 NORAD Rd. Colorado Springs, CO 80914

3. Washington Office 1400 Defense Pentagon, Rm 2A 872 Washington, DC 20301

4. The contract also requires maintenance support at facilities served by NORAD and USNORTHCOM Enterprise IT Services, to include by not limited to other buildings on Peterson AFB and Colorado Springs, subordinate organizations, other off site and remote locations, and OCONUS locations at the Office of Defense Coordination in Mexico City, Mexico and Bahamas that use NORAD and USNORTHCOM IT Services. (see Table 3 in PWS)

ITEM 10: Remarks:

Ref. 10.a: Access to COMSEC material is restricted to U.S. citizens holding final U.S. Government clearances. Such information is not releasable to personnel holding only reciprocal clearances.

Ref. 10.e (1, 2): SCI requirements apply. Contractor takes its SCI guidance from HQ NORAD and USNORTHCOM J24S, SSO. Contractor will advise SSO of any security issues. Contract will require access to ICD’s 705, 704, and JDCSISSS. Security equipment (fax, telephone, shredders) will be provided by the Government Customer.

Ref. 10.h.: Access requires a final U.S. Government clearance at the appropriate level. (SECRET//REL TO USA, AUS, CAN, GBR, NZL) Ref. 10.j.: See DoDM 5200.01, Volume 4, Enclosure 3 for specific FOUO information.

ITEM 11: Remarks:

Ref. 11.a. Contract performance is restricted to Headquarters NORAD and USNORTHCOM, Bldg. 2, Peterson AFB Colorado 80914, the NORAD and USNORTHCOM General Officer Quarters (GOFO) on Peterson AFB and Cheyenne Mountain Air Force Station, 1 NORAD Road, Colorado Springs, CO 80914 and additional areas listed in table 3 of the PWS. Using activity will provide security classification guidance for performance of this contract.

Ref. 11.e: Contract is for equipment maintenance services on equipment which processes classified information. Actual knowledge of, generation, or production of classified information is not required for performance of the contract. Cleared personnel are required to perform this service because access to classified information cannot be precluded by escorting personnel.

Ref 11.h: A COMSEC account will be established and COMSEC will be protected per DoD 5220.22-S.

**N-NC/J6 COMSEC Officer Coordination in block 13.

Ref. 11.i.: See Attached EMSEC requirements.

NOTE: See AFSSI 7700, Emission Security, for additional guidance and requirements.

Ref. 11.j.: See Attached OPSEC requirements. (Attachment 4)

ITEM 13: Security Guidance Remarks:

The contractor requires access to classified source data up to and including TOP SECRET in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of Multiple sources on the classified by line necessitates compliance with the NISPOM (or DoD 5200.1-R, Amendments identified in SECDEF Memo dated 16 April 2004, “Interim Information Security Guidance” addressing changes made by Executive Order 12958, “Classified National Security Information, and AFI 31-401 if operating on an Air Force installation), and use of bibliography. Applicable Security Classification Guides include the following (as amended):

· DoD 5220.22-M, National Industrial Security Program Operating Manual

· DoDD 5220.22-R, Industrial Security Regulation

· DoD 5220.22-S, COMSEC supplement to the Industrial Security Manual

· DoDD 5230.9 Clearance of DOD Information for Public Release

· DODI S-3600.2 Information Operation Security Classification Guidance

· DoD 5105.21-M-1, Sensitive Compartmented Information Administrative Security Manual, Aug 1998

· DoDD 5200.1, Information Security Program, Jan 1997

· DoDD 5200.2, Personnel Security Program, Jan 1987

· DoDD 5240.1, DoD Intelligence Activities, 25 Apr 1988

· DoDD 5240.2, DoD Counter Intelligence (CI), 22 May 1997

· DoDI 5240.6, Counterintelligence (CI) Awareness and Briefing Program, 16 Jul 1996

· DoDI S-5240.9, Support to DoD Offensive Counterintelligence Operations (OFCO), 28 Nov 89

· DoDI 5240.10, DoD Counterintelligence Support to Unified and Specified Commands, 18 May 1990 w/Change #1, 8 Apr 1992

· DoDD 5105.67, DoD Counterintelligence Field Activity, 19 Feb 2002

· DoDD O-8530.1, Computer Network Defense (CND), 8 Jan 2001

· DoDI O-8530.2, Support to Computer Network Defense (CND), 9 Mar 2001

· CJCS Notice 5114, Implementation of E.O. 12958 – Classified National Security Information

· CJCS Notice 5121, Implementation of E.O. 13142 – Amendment to E.O. 12958 – Classified National Security Information

· CJCSI 3170.01B, Requirements Generation System, 15 Apr 2001

· CJCSM 3213.02A, Joint Staff Focal Point Communications Procedures Manual, 31 Jan 97, CH 1 08 Aug 2003

· EAP CJCS Volume I, Appendix (Security Classification Guide), 1 Sep 04

· CCJCSM 5222.01B, 28 Feb 2005, National Military Command System (NMCS) Security Classification Manual

· CJCSI 3231.01A, 7 Jan 00, Safeguarding the Single Integrated Operational Plan (SIOP), OPR JS-J3

· Air Force Instruction (AFI) 14-303, Release of Collateral Intelligence to U.S. Contractors

· AFI 10-1101 Operation Security (OPSEC) Instructions

· AFI 16-1406, Air Force Industrial Security Program, 25 Aug 15

· Air Force Policy Directive (AFPD) 31-6, Industrial Security, 1 Apr 00

· Air Force Handbook (AFH) 31-602, Industrial Security Program, 1 Feb 97

· DCID 1/7, Security Controls on the Dissemination of Intelligence Information, 30 Jun 1998

· DCID 6/1, Security Policy for Sensitive Compartmented Information and Security Policy Manual

· DCID 6/4, Personnel Security Standards and Procedures for Governing Eligibility for Access to Sensitive Compartmented Information (SCI), 13 Oct 1999, including Annexes A-F

· DCID 6/3, Protecting Sensitive Compartmented Information within Information Systems, 5 Jun 1999

· DCID 6/5, Policy for protection of certain non-SCI Sources And Methods Information (SAMI), 12 Feb 2001

· Executive Order 12333, United States Intelligence Activities, 4 Dec 1981, as amended 24 Jan 2003

· Executive Order 12958, Classified National Security Information, 17 Apr 1995, as amended 25 Mar 2003

· Executive Order 12968, Access to Classified Information, 4 Aug 1995

· Executive Order 12972, Amendment to EO 12958, 19 Sep 1995

· Executive Order 13231, Critical Infrastructure Protection in the Information Age, 16 Oct 2001

· PDD-62, Combating Terrorism, 22 May 1998

· PDD-63, Protecting America’s Critical Infrastructure, 22 May 1998

· National Security Strategy

· National Military Strategy

· National Response Plan

· Defense Planning Guidance

· Unified Command Plan, 1 Oct 2002

· Joint Planning Document

· Homeland Security Presidential Directive/HSPD-5, Management of Domestic Incidents, 28 Feb 2003

· USA Patriot Act, 24 Oct 2001

· National Strategy for the Physical Protection of Critical Infrastructure and Key Assets, Feb 2003

· SECDEF message, DoD Intelligence and Law Enforcement Policy to Support the War on Terrorism and Enhanced Domestic Force Protection, 4 Apr 2003

· DEPSECDEF Memorandum, Collection, Reporting and Analysis of Terrorist Threats to DoD within the U.S., 2 May 2003

· DEPSECDEF Memorandum, Implementation Guidance on Restructuring Defense Intelligence-and Related Matters, 8 May 2003

· DCI Memorandum, Homeland Security Information Sharing Memorandum of Understanding, 4 Mar 03

· JP 1, Joint Warfare of the Armed Forces of the United States, 14 Nov 2000

· JP 2-0, Doctrine for Intelligence Support to Joint Operations, 9 Mar 2000

· JP 2-01.2, Joint Doctrine and Tactics, Techniques and Procedures for Counterintelligence Support to Operations, 7 May 2002

· JP 3-0, Doctrine for Joint Operations, 10 Sep 2001

· JP 5-0, Doctrine for Planning Joint Operations, 13 Apr 1995

· Joint DoDIIS / Cryptologic SCI Information Systems Security Standards, 11 Apr 2003

· DIA Manual (DIAM) 50-4, Department of Defense (DoD), Intelligence Information System (DoDIIS), Information Systems Security (INFOSEC) Program, 30 Apr 1997

· DIAM 50-24, Security for Using Communications Equipment in a SCIF, 31 Aug 1990

· USNORTHCOM Ballistic Missile Defense (BMD) Operations Security Classification Guide (SCG), 1 Jan 05

· Missile Defense Agency (MDA) Ground-based Missile Defense (GMD) SCG, 6 Sep 02

· Missile Defense Agency (MDA) Ballistic Missile Defense System (BMDS) SCG, 26 Apr 04

· USSTRATCOM Global Ballistic Missile Defense (GBMD)SCG, dated 18 Oct 04

· NC HOI 10-220,”USNORTHCOM Focal Point Program”

· USNORTHCOM Mobile Consolidated Command Center (MCCC) SCG, 14 Apr 03

· Integrated Tactical Warning System and Attack Assessment (ITW/AA) System SCG, 22 Sep 00. OPR is NORAD J33

Additional SCG guidance will be provided as required

Item 14. Additional Security Requirements: (continued)

Provide the information requested by AFFARS 5352.204-9000, Notification of Government Security Activity Clause, and AFI 16-1406, Air Force Industrial Security Program, to the Information Security Program Manager (ISPM). Refer to the contract document for these clauses. Shipments of classified or sensitive equipment shall be handled, transported, transmitted and protected IAW NISPOM, DoD 5220.22M and as specified by unit directives. The contractor shall execute a VGSA with the government.

Item 15. Inspections: (Continued)

DSS is relieved of inspection responsibility for all classified material that is released to or developed by the contractor while on a military installation. DSS retains inspection responsibility for all non-SCI classified material released to or developed by the contractor and held in the contractors' facility. The SSO maintains inspection responsibility for all SCI material related to this contract. Local Information Protection Management Evaluations (LIPME) while operating on an Air Force installation shall be conducted by the HQ NORAD and NORTHCOM CSMS. HQ AFSPC/IN retains security cognizance of all Intelligence materials released to the contractor.

ATTACHMENT 2

NORAD and USNORTHCOM SPECIAL SECURITY OFFICE (SSO) - SCI SUPPLEMENT

ITEM 13a: Contract Expiration date (TBD)

ITEM 13b: The SCIFs at HQ NORAD-USNORTHCOM will be used to perform SCI contractual requirements. SCI material released to the contractor under this contract will be separately stored and maintained only in such properly accredited facilities. Non NORAD-USNORTHCOM SCIFs will be used only when covered by a co-utilization Memorandum of Agreement (MOA) between HQ NORAD-USNORTHCOM and the sponsor of the facility. The supporting SSO is HQ NORAD-USNORTHCOM SSO.

ITEM 13c: The following documents with subsequent revisions or changes will be used for specific SCI security classification guidance on this contract:

AFMAN 14-304

DoD 5105.21-M-1 Signals Intelligence Security Regulation (SISR). DCID 6/9, DCID 6/3, DCID 6/4 Joint DoDIIS / Cryptologic SCI Information Systems Security Standards (JDCSISSS)

ITEM 13d: Inquires pertaining to classification guidance on SCI will be directed to the Contract Monitor.

ITEM 13e: SCI data furnished to or generated by the contractor will require security handling and controls beyond those in the National Industrial Security Program Operating Manual (NISPOM). These supplemental instructions will be furnished and/or made available to the contractor through the Contract Monitor by the User Agency Special Security Office, HQ NORAD-USNORTHCOM SSO.

ITEM 13f: Names of contractor personnel requiring access to SCI will be submitted to the SCI Control Monitor (CM). The contractor will provide HQ NORAD-USNORTHCOM SSO an SCI manpower list showing job description of each SCI position, levels of access required per position, and statement of work justifying SCI-level clearances through the COR.

ITEM 13g: The contractor will establish and maintain a current access list of those employees (by position) working on this contract. A copy of this list will be provided to the SCI Contract Monitor (CM).

ITEM 13h: The contractor will advise the SCI Contract Monitor (CM) immediately upon reassignment of personnel to other duties not associated with this contract. The COR and unit Security Manager will ensure that HQ NORAD and USNORTHCOM SSO is notified and the individual is debriefed from SCI access by HQ NORAD and USNORTHCOM SSO.

ITEM 13i: Release of Information. SCI with restrictive caveats (e.g. ORCON, PROPIN, etc) will be released to contractors only when originator approval has been obtained. The contractor will control SCI which has been originated or obtained under this contract as follows: The contractor may release such material to any contractor employee working against a position under this contract only when need-to-know exists. The contractor will release such material to any Special Security Office personnel assigned to HQ NORAD-USNORTHCOM or DIA upon demand by such personnel. The contractor may release such material to any other personnel, including contractor and subcontractor employees, and employees of any Federal Government agency, only upon prior written approval from the SCI Contract Monitor. An access certification to a NORAD-USNORTHCOM contractor-occupied SCIF does not constitute approval to release NORAD-USNORTHCOM contractual material to these other personnel; Contract Monitor approval is nevertheless required. Contract Monitor approval of a NORAD-USNORTHCOM contractor visit certification or permanent certification to another facility will constitute approval to discuss contractual material at the facility to be visited.

ITEM 13j: Any SCI release to the contractor in support of this contract remains the property of the DoD department, agency, or command that releases it. The contractor will maintain active accountability of all SCI released to his custody, regardless of whether the release is within a contractor or US Government SCIF. Upon completion/cancellation of the contract, the contractor must return all such material to HQ NORAD-USNORTHCOM SSO unless a follow-on contract specifies that material will be transferred to a subsequent contract. SCI inventories will be conducted IAW DIA Manual 50-14.

ITEM 13k: A SCIF must be established and maintained by the contractor. SCI material released to the contractor under this contract will be separately stored and worked on only in facilities either accredited through HQ NORAD-USNORTHCOM, or another accredited agency or properly covered by a co-utilization Memorandum of Agreement (MOA) between HQ NORAD-USNORTHCOM and the sponsor of the facility. NORAD-USNORTHCOM sponsored SCIFs will not be co-utilized for other Government agency contracts unless properly covered by a MOA. The supporting SSO is HQ NORAD-USNORTHCOM SSO.

ITEM 13l: Defense Courier Service is not required under this contract.

ITEM 13m: Electronic processing of SCI is not permitted.

ITEM 13n: Contractor Special Security Officers (CSSOs) must coordinate with the SCI Contract Monitor, and obtain the concurrence of HQ NORAD-USNORTHCOM SSO prior to subcontracting any portion of SCI efforts involved in this contract.

ITEM 13o: No contractor personnel will be granted access to SCI material under this contract unless they are filling a DoD SCI position. The contractor will coordinate with the SCI Contract Monitor to ensure adequate positions are requested under this contract. Multiple contract employees sponsored by organizations other than NORAD-USNORTHCOM must be certified to HQ NORAD-USNORTHCOM for use on this contract.

ITEM 13p: The contractor will nominate a CSSO to HQ NORAD-USNORTHCOM SSO. HQ NORAD-USNORTHCOM SSO will submit nominations for appointment by NORAD-USNORTHCOM. The contractor will designate a Special Security Point of Contact (POC) to HQ NORAD-USNORTHCOM SSO. The POC will be responsible for all personnel and information security transactions between the contractor and HQ NORAD-USNORTHCOM SSO.

ITEM 13q: Contractor will not use references to SCI accesses, even by unclassified acronyms, in advertising, promotional efforts, or recruitment for employees.

ITEM 13r: The following activity is designated as the User Agency SSO for SCI requirements IAW DIA Manual 50-14: HQ NORAD-USNORTHCOM, Special Security Office, Peterson AFB, CO 80914.

Signature Blocks:

SSO: _________________________________________ Contract Monitor: _________________________________

ATTACHMENT 3

EMSEC Requirements (Addendum to DD Form 254, Block 11i)

Certification and Accreditation (C&A) Process For All Classified Systems

The Emission Security (EMSEC) Process. An important part of IA is the certification and accreditation (C&A) process. The C&A process addresses vulnerabilities and threats with the goal of reducing the risk to an acceptable level. EMSEC is part of the C&A process.

Below are the major steps and where they fit into the C&A process.

- The user contacts the wing IA office whenever they intend to process classified information. The user must do this before selecting the operational facility or room, beginning architectural engineering and facility design, procuring information systems, beginning engineering and installation, or processing classified information.

- The wing IA office determines required IA countermeasures and makes the EMSEC assessments to determine the need for EMSEC countermeasures. When needed, the wing IA office makes the EMSEC Countermeasures reviews to determine specific EMSEC Countermeasures based on the threat for that location. This is the EMSEC portion of determining the security policy for the C&A of the information system.

- The selection of EMSEC countermeasures is validated by the Air Force CTTA.

- The required countermeasures are given to the user for application or implementation.

- The wing IA office inspects the application of countermeasures for correctness and effectiveness. The inspection is made during the security test and evaluation task of the C&A.

- The wing IA office certifies the information system meets EMSEC requirements as part of the certification phase of the C&A.

Processing classified information without complying with the requirements of AFSSI 7700 is a reportable security incident under AFI 31-401, Information Security Program Management, except as allowed for by waiver in AFSSI 7700.

FA2517-15-R-7001

ATTACHMENT 9 – DD FORM 254

ATTACHMENT 4

OPERATIONS SECURITY (OPSEC)

Addendum to DD Form 254, Item 11.j.

GENERAL:

1. PURPOSE: This section outlines the requirements and procedures necessary to protect Critical Information for Operations Security (OPSEC).

2. MISSION: To maintain a continuing awareness of adversary interest in center actions and adversary intelligence collection capabilities. To understand the need to identify and protect classified and unclassified indicators, which occur, reveal sensitive information. To evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

3. DEFINITION: OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

a. Identify those actions that can be observed by adversary intelligence systems.

b. Determine indicators hostile intelligence systems might obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

c. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

4. OBJECTIVES:

a. To protect planned operational center activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

b. To preserve secrecy concerning specific scenario events and a NORAD response to these events.

c. To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. TASKS: Task requirements are outlined in the Statement of Work for this effort and at a minimum must include:

a. Release of the organizations Critical Information List to the contractor.

b. Threat information available (Threat Working Group Minutes).

c. Contractor receiving OPSEC training from the sponsoring organization.

d. Specific OPSEC countermeasures as needed.