Attch_2a_-_MSCC_DD254_Continue_Pgs_-_1_Feb_17.pdf

DRAFT

Attachment 1:

CONTINUATION of DD254 ITEMS

HQ AFSPC/A9XY - FA2517-17-R-7003

AFPD 33-2, Information Assurance. This Air Force Policy Directive implements DoDD 8500.1, Information Assurance, and DoDD 8581.1E, Information Assurance Policy for Space Systems used by the Department of Defense. AFPD 33-2 is the primary guide which all 33-2XX series and ASFSSIs/AFSSMs publications fall under. This publication shall be applied to contractors or other persons through the contract or other legally binding agreement with the Department of the Air Force. Information Assurance consists of Communication Security (COMSEC), Network and Computer Security, and Emission Security.

Ref 8c. In addition to POCs indicated in Block 8C, another Cognizant Security Office is HQ AFSPC/A5, 150 Vandenbert St, Suite 1105, Peterson AFB, Co 80914, Mr. Chris Lambert, christopher.lambert.1@us.af.mil, 719-554-1381

Ref 10a. Contractor Employees will have access to Secure Telephone Equipment and other key-able COMSEC devices and access will be at the place of work identified on DD254, Block 8a. The contractor employees will be in accordance with AFMAN 17-1302, Communication Security (COMSEC) Operations, 3 February 2017. Access to COMSEC material is restricted to US citizens holding final US Government clearances. Such information is not releasable to personnel holding only reciprocal clearances.

Ref 10b. Access to RESTRICTED DATA requires a final US Government clearance at the appropriate level.

Ref 10d. Access to FORMERLY RESTRICTED DATA requires a final US Government clearance at the appropriate level.

Ref 10e. Contractor employee access to SCI and Non-SCI information will be at the place of work identified on DD Form 254, Block 8a. Access to SCI will require the contractor to be assigned to an SCI billet and access will be granted after verification of the individual’s security clearance, a need to know and with government approval. The contractors will be read into and out of the program as directed by the government.

Ref 10f. Special Access information requires a final U.S. Government clearance at the appropriate level. Some work will be performed at the SAP/SAR classification levels and those contractors requiring access to SAP/SAR information as needed will be limited and controlled by the government. The contractors will be read into and out of the program as directed by the government.

Ref 10g. Access to classified NATO information requires a final U.S. Government clearance at the appropriate level. NATO in-briefs are required prior to accessing the SIPRNet and JWICS.

Actual knowledge of, generation, or production of NATO information is required for performance of the contract.

DAVID M. CALLAHAN, DAFC

COMSEC Manager

21 CS/CA623002

(719) 556-9484 / DSN: 834-9484

ATTACHMENT 2a mailto:christopher.lambert.1@us.af.mil

Ref 10h. Access requires a final U.S. Government clearance at the appropriate level.

Ref 10j. FOUO information provided under this contract shall be safeguarded as specified in DoDM 5200.01, Volume 4, Enclosure 3, for specific FOUO information.

Ref 10k. Some work will be performed at the Alternative Compensatory Control Measures (ACCM) classification levels and those contractors requiring access to ACCM information as needed will be limited and controlled by the government. The contractors will be read into and out of the program as directed by the government.

Ref 11a. Contract performance will primarily be at HQ AFSPC/A9XY, 150 Vandenberg Street, Bldg 1; Peterson AFB, CO 80914 and HQ AFSPC/A9XY, 250 S Peterson Blvd, Building 1470, Peterson AFB, CO, 80914. Using activity will provide security classification guidance for performance of this contract.

Ref 11j. Contractor will comply with applicable Operations Security (OPSEC) requirements and information. See OPSEC addendum (Attachment 2).

Ref 13a. Contract Dates: 1 June 2018 to 31 May 2023. The Period of Performance (PoP) is 1 June 2018 through 31 May 2023. This is the date, unless otherwise modified in the contract, is when SCI indoctrinated contractor personnel will be debriefed.

Ref 13b. The SCIF at HQ AFSPC/A9XY (Bldg 1 and 1470) will be used to perform SCI contractual requirements. SCI material released to the contractor under this contract will be separately stored and maintained only in such properly accredited facilities. Non AFSPC SCIFs will be used only when covered by a co-utilization Memorandum of Agreement (MOA) between AFSPC and the sponsor of the facility. The supporting SSO is HQ AFSPC/A2/3/6.

Ref 13c. See Attachment 3 for SAP/SAR and ACCM access.

Ref 13d. Inquiries pertaining to classification guidance on SCI will be directed to the Contract monitor.

Ref 13e. SCI data furnished to or generated by the Contractor will require security handling and controls beyond those in the National Industrial Security Program Operating Manual (NISPOM).

These supplemental instructions will be furnished and/or made available to the Contractor through the Contract Monitor by the User Agency Special Security Office, SSO AFSPC.

Ref 13f. Names of Contractor personnel requiring access to SCI will be submitted to the SCI Contract Monitor. Forms requesting Special Background Investigations will be prepared in accordance with the NISPOM and submitted to Defense Security Service (DSS).

Ref 13g. The Contractor will establish and maintain a current access list of those employees working on this contract. A copy of this will be furnished to the SCI Contract Monitor. The contractor will advise the SCI Contract Monitor immediately upon reassignment of personnel to other duties not associated with this contract.

Ref 13h. Release of Information. SCI with restrictive caveats (e.g., ORCON, PROPIN, etc.) will be released to contractors only when originator approval has been obtained. The contractor will control SCI, which has been originated or obtained under this contract as follows: The contractor may release such material to any contractor employee working against a billet under this contract only when a need-to-know exists. The contractor will release such material to any Special Security Office personnel assigned to HQ AFSPC or DIA upon demand by such personnel. The contractor may release such material to any other personnel, including contractor and subcontractor employees, and employees of any Federal Government agency, only upon prior written approval from the SCI Contract Monitor. An access certification to an AFSPC contractor-occupied SCIF does not constitute approval to release AFSPC contractual material to these other personnel;

Contract Monitor approval is required. Contract Monitor approval of an AFSPC contractor visit certification or permanent certification to another facility will constitute approval to discuss contractual material at facility to be visited.

Ref 13i. Any SCI released to the contractor in support of this contract remains the property of the DoD department, agency, or command that releases it. The contractor will maintain active control of all SCI released to his/her custody, regardless of whether the release is within a contractor or US Government SCIF. Upon completion/cancellation of the contract, the contractor must return all such material to SSO AFSPC unless a follow-on contract specifies that the material will be transferred to a subsequent contract. SCI inventories will be conducted IAW DIA Manual 50-5 and AFMAN 14-304.

Ref 13m. Contractor will not use references to SCI accesses, even by unclassified acronyms, in advertising, promotional efforts, or recruitment for employees.

Ref 13j. SCI material released to the contractor under this contract will be separately stored and worked on only in facilities accredited through AFSPC or another accredited agency, and properly covered by a co-utilization Memorandum of Agreement (MOA) between AFSPC and the sponsor of the facility. AFSPC sponsored SCIFs will not be co-located for other government agency contracts unless properly covered by an MOA. The supporting SSO is (See SSO AFSPC for information).

Ref 13k. Contractor Special Security Officers (CSSOs) must coordinate with the SCI Contract Monitor and obtain the concurrence of SSO AFSPC prior to subcontracting any portion of SCI efforts involved in this contract.

Ref 13l. No contractor personnel will be granted access to SCI material under this contract unless they are filling a DoD SCI billet. The contractor will coordinate with SCI Contract Monitor to ensure adequate billets are requested under this contract. Multiple contract employees sponsored by the organizations other than Air Force Space Command must be certified to SSO AFSPC for use on the contract.

Ref 13n. The following activity is designated as the User Agency SSO for SCI requirements IAW DoD 5105.21m, Vol 1/2/3; HQ AFSPC/A236Y, Peterson AFB CO 80914.

Ref 15. This contract requires access to SCI. The senior Intelligence Officer, HQ AFSPC/A2/3/6Y, has exclusive security oversight over all classified material produced under this contract. Contractor compliance with these directives is mandatory unless specific provisions are specifically waived. DIA is relieved of responsibility for all SCI material released to the contractor under this contract. Defense Security Service (DSS) is relieved of inspection responsibility for all classified material that is released to or developed by the contractor while on a military installation. Collateral classified Security Evaluations while operating on Air installation, shall be conducted by the IPO.

Ref 17f. Other Organizations: SAF/AAZ through AFOSI PJ

Ref 14. Provide the information requested by AFFARS 5352.204-9000, Notification of Government Security Activity Clause, and AFI 31-601, Industrial Security Program Management, to the Information Security Program Manager (ISPM). Refer to the contract document for these clauses. Shipments of classified or sensitive equipment shall be handled, transported, transmitted and protected IAW NISPOM, DoD 5220.22M and as specified by unit directives. The contractor shall execute a VGSA with the government.

Attachment 2:

OPERATIONS SECURITY (OPSEC)

Addendum to DD Form 254, Item 11.j.

GENERAL:

1. PURPOSE: This section outlines the requirements and procedures necessary to protect Critical Information for Operations Security (OPSEC).

2. MISSION: To maintain a continuing awareness of adversary interest in center actions and adversary intelligence collection capabilities. To understand the need to identify and protect classified and unclassified indicators, which occur, reveal sensitive information. To evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

3. DEFINITION: OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

a. Identify those actions that can be observed by adversary intelligence systems.

b. Determine indicators hostile intelligence systems might obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

c. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

4. OBJECTIVES:

a. To protect planned operational center activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

b. To preserve secrecy concerning specific scenario events and a NORAD response to these events.

c. To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. TASKS: Task requirements are outlined in the Statement of Work for this effort and at a minimum must include:

a. Release of the organizations Critical Information List to the contractor.

b. Threat information available (Threat Working Group Minutes).

c. Contractor receiving OPSEC training from the sponsoring organization.

d. Specific OPSEC countermeasures as needed.

FOR OFFICIAL USE ONLY (When Filled In)

Attachment 3

Special Access Program Addendum

For FA2517-17-R-7003, DD254, Original

FOR OFFICIAL USE ONLY (When Filled In)

Item 12: Public release of Special Access Program (SAP) data is NOT authorized without prior coordination through the AFOSI PJ Security Director and the subsequent approval of the Original Classification Authority and the Air Force Special Access Program Central Office (SAPCO).

Submit all proposed public disclosures related to SAP data to the Government Program Manager (AFSPC/A9XY, Mr. Charles Schwarz) and the AFOSI PJ PSO.

Item 13: Contractor will abide by all applicable secrity regulations, procedures, and requirements while performing in the host facility, HQ AFSPC/A9XY, Bldg 1; Peterson AFB, CO 80914. The Cognizant Security Office is HQ AFSPC/A5, 150 Vandenberg St, Suite 1105, Peterson AFB, CO 80914, Mr. Chris Lambert, christopher.lambert.1@us.af.mil, 719-554-1381.

Identification of the specific Special Access Programs and their corresponding Security Classification Guides or extracts will be provided under seperate cover.

- Block 14: The latest versions of the following documents provide guidance for SAP contracts without performance at the contractor’s location:

a. DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM)

b. DoD Directive 5205.07, Special Access Program (SAP) Policy c.

d.

DoD Manual (DoDM) 5205.07, Vol 1, Special Access Program (SAP) Security Manual:

General Procedures e.

DoDM 5205.07, Vol 2, SAP Security Manual: Personnel Security f.

DoDM 5200.01, Vol 1, 2, 3, & 4, DoD Information Security Program: Overview, Classification and Declassification g.

h.

AF Policy Directive 16-7, Special Access Programs

AF Instruction 16-701, Management, Administration and Oversight of Special Access

Programs

SAF/AAZ Memorandum, “Implementation of DoD Manual 5205.07, DoD Special

Access Program (SAP) Security Manual, Volumes 1-4” (4 April 2016) (Attached)

- Block 8a-c: SAP performance is authorized ONLY at the following locations (continued):

# Location (St. Address) CAGE Code SAP Cognizant Security Office (St. Address)

HQ AFSPC/A3Z & A9XY

150 Vandenberg St, Ste 1105

Peterson AFB, CO 80914

AFOSI PJ/OL-D

150 Vandenberg St., Ste. 3402

Colorado Springs, CO 80914

------------------------------------------ONE FACILITY ONLY------------------------------------------

The following websites may be used to obtain the most up to date versions of the issuances listed above:

DoD Issuances website: http://www.dtic.mil.whs.directives/

Air Force e-Publications website: http://www.e-publishing.af.mil/

Supersession of any of the above documents will not require an immediate revision to this DD

Form 254. The updated document will be deemed to be on contract as of the date of supersession.

Additional costs incurred due to updated guidance will be brought to the attention of the GCO immediately.

- Block 15: The Defense Security Service has been relieved of inspection oversight responsibilities for the SAP portions of this contract. The Air Force is identified as the Cognizant Security

Authority with AFOSI PJ fulfilling the execution role for all contractor inspections under the purview of SAF/AAZ.

FOR OFFICIAL USE ONLY (When Filled In)

Attachment 3 (Con't)

Special Access Program Addendum For FA8771-12-D-1009-SX04, DD254, Original

FOR OFFICIAL USE ONLY (When Filled In)

MS&A DD254 SAP Addendum - 3 Oct 16