SSO_DD254_Attachment.docx

FOR OFFICIAL USE ONLY

ATTACHMENT 1

SPECIAL SECURITY OPERATIONS (SSO) – CONTINUATION

DD FORM 254 BLOCK 13 CONTINUED

CONTRACT NUMBER: FA2550-17-X-XXXX

This continuation addresses individual items on the DD Form 254. The individual items together provide overall Security Guidance required in Items 8 - 15. Document is marked “FOR OFFICIAL USE ONLY” due to the specific references of Special Access Program (SAP) support.

Item 8.a. ACTUAL PERFORMANCE LOCATION. 50 OSS/INS, Room 270, Building 300, Schriever AFB, CO

Item 10.a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION. COMSEC material/information may not be released to DoD contractors without Air Force Cryptological Support Center (AFCSC) approval. Contractor must forward requests for COMSEC material/information to the COMSEC officer through the program office. The contractor is governed by the National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-M in the control and protection of COMSEC material/information and AFMAN 17-1302-O, Communications Security (COMSEC) Operations. Access to COMSEC material by personnel is restricted to US citizens holding final US Government clearances. Such information is not releasable to personnel holding only reciprocal clearances.

Item10.b. RESTRICTED DATA. Access to RESTRICTED DATA requires a final U.S. Government clearance at the appropriate level.

Item 10.d. FORMERLY RESTRICTED DATA. Access to FORMERLY RESTRICTED DATA requires a final U.S. Government clearance at the appropriate level.

Item 10.e. INTELLIGENCE INFORMATION.

1. Sensitive Compartmented Information (SCI) SCI data furnished to or generated by the contractor will require security handling and control beyond those in the National Industrial Security Program Operating Manual (NISPOM). These supplemental instructions will be furnished and or made available to the contractor through the Special Security Representative (SSR) as appointed by Special Security Office (SSO) Schriever Air Force Base (719) 567-4990 or (719) 567-2677.

2. Non-SCI Provisions for the handling of Non-SCI or “Collateral” Intelligence by contractors are governed by Chapter 9, Section 3 of DoD 5220.22-M, the National Industrial Security Program Operating Manual (NISPOM), Feb 2006 incorporating Change 1, March 28, 2013. Particular emphasis is placed on the contractor(s) correctly understanding and heeding intelligence portion markings.

As classified material, collateral intelligence will be afforded the same protections, safeguards and precautions required by any classified material unless special intelligence related handling instructions are additionally imposed. These basic safeguards are found in DoDM 5200.01, Volumes 1-3, Information Security Program and AFI 31-401, Information Security Program Management. The disclosure or release of intelligence derived information, whether its status is collateral or SCI is not authorized without the prior consent of SSO Schriever.

Item 10.f. SPECIAL ACCESS INFORMATION. The contractor will require access to various levels of SAP materials. SAP access is not automatic. The contractor must adhere to the special access requirements or procedures developed by the SAP OPR. SAF/AAZ is the OPR for Special Access Programs and has exclusive security responsibility for all SAP material released or developed under this contract. Defense Security Service (DSS) has no security responsibility or oversight for SAP material. See Attachment X for further guidance.

Item 10.g. NATO INFORMATION. Access to classified NATO information requires a final U.S. Government clearance at the appropriate level. NATO in-briefs are required prior to accessing the SIPRNET. Actual knowledge of, generation, or production of NATO information is not required for performance of the contract.

Item 10.j. FOR OFFICIAL USE ONLY INFORMATION. For Official Use Only (FOUO) is not a classification. Originators mark records when they create them to call attention to FOUO content. An FOUO marking does not mean you must withhold a record under the FOIA. You will need to review requested records. Examine records with and without markings to identify information that needs protection and is exempt from public release or to decide whether discretionary release is appropriate. See DoDM 5200.01, Volume 4, Enclosure 3 for specific FOUO information.

Item 10.k. OTHER. Notification of Government Security Activity is required by FAR 52.204-2. Contact 50 OSS/INS for assistance in SCI billet requirements.

Item 11.a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTORS FACILTY OR A GOVERNMENT ACTIVITY. The contractor requires access to classified source data up to and including TOP SECRET in support of the work effort. Contract performance is restricted to Schriever AFB, CO, Building 300, Room 270. Using activity will provide security classification guidance for performance of this contract. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of Multiple sources on the classified by line necessitates compliance with the NISPOM (or DoDM 5200.01, Vol 2 and AFI 16-1404 if operating on an Air Force installation), and use of bibliography.

Item 11.j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS. The contractor shall comply with AFI 10-701, Operations Security for the protection of sensitive unclassified information/data.

Item 13.a. Contract Expiration: 31 Aug 17 Contract Period of Performance: 1 Sep 17 – 31 May 22 (4.75 Years) Transition Period: N/A Base Option: 1 Sep 17 – 31 May 18 Option 1: 1 Jun 18 – 31 May 19 Option 2: 1 Jun 19 – 31 May 20 Option 3: 1 Jun 20 – 31 May 21 Option 4: 1 Jun 21 – 31 May 22

Item 13.b. Performance will be accomplished within Bldg 300, Rm 270 SCIF. Contractor SCIF is not required.

Item 13.c. The following documents with subsequent revisions or changes will be used for specific SCI security classification guidance on this contract:

DCID 6/9 - Physical Security (for facilities accredited under 6/9 standards) ICD and ICS/Tech Specs 705 – Physical Security DoD 5105.21 Vl, V2, V3 - SCI Administrative Security Manual(s) AFMAN 14-304 - Security, Use and Dissemination of SCI ICD 503 – Information Systems DIAM 50-4 - Defense Intelligence Agency Manual ICD and ICPGs 704.1/.2/.3 - Personnel Security

Item 13.d. Inquiries pertaining to classification guidance on SCI will be directed to the Contract Officer Representative.

Item 13.e. SCI data furnished to or generated by the contractor will require security handling and controls beyond those in the National Industrial Security Program Operating Manual (NISPOM). These supplemental instructions will be furnished and/or made available to the contractor thru the Contract Monitor by the User Agency Special Security Office, SSO Schriever.

Item 13.f. Names of contractor personnel requiring access to SCI will be submitted to the SCI Contract Monitor. Forms requesting Special Background Investigations will be prepared in accordance with the NISPOM and submitted to Defense Security Service (DSS).

Item 13.g. The contractor will establish and maintain a current access list of those employees working on this contract. A copy of this list will be furnished to the SCI Contract Monitor.

Item 13.h. The contractor will advise the SCI Contract Monitor immediately upon reassignment of personnel to other duties not associated with this contract. Any SCI green badge issued from SSO Schriever must be returned.

Item 13.i. Release of information. SCI with restrictive caveats (e.g. ORCON, PROPIN, etc.) will be released to contractors only when originator approval has been obtained. The contractor will control SCI, which has been originated or obtained under this contract as follows: The contractor may release such material to any contractor employee working against a billet under this contract only when a need-to-know exists. The contractor will release such material to any Special Security Office personnel assigned to HQ AFSPC or Defense Investigative Agency (DIA) upon demand by such personnel. The contractor may release such material to any other personnel, including contractor and subcontractor employees, and employees of any Federal Government agency, only upon prior written approval from the COR. An access certification to an AFSPC contractor-occupies SCIF does not constitute approval to release AFSPC contractual material to these other personnel: COR approval is nevertheless required. COR approval of an AFSPC contractor visit certification or permanent certification to another facility will constitute approval to discuss contractual material at facility to be visited.

Item 13.j. Any SCI released to the contractor in support of this contract remains the property of the Department of Defense (DoD), department, agency, or command that releases it. The contractor will maintain active accountability of all SCI released to his/her custody, regardless of whether the release is within a contractor or US Government SCIF. Upon completion/cancellation of the contract, the contractor must return all such material to the SSO Schriever unless a follow-on contract specifies that the material will be transferred to a subsequent contract. SCI inventories will be conducted IAW DoD 5105.21 Volumes 1/2/3 and AFMAN 14-304.

Item 13.l. This contract will require the use of the Defense Courier system only in support of the SSO Schriever account and not at the contractor facility. If the contractor requires DCS, they shall contact the COR on this contract to initiate.

Item 13.m. Electronic processing of SCI will be accomplished within government furnished SCIF.

Item 13.n. The contractor must coordinate with the SCI Contract Office Representative and obtain the concurrence of the Schriever SSO and SSO AFSPC prior to subcontracting any portion of SCI efforts involved in this contract.

Item 13.o. No contractor personnel will be granted access to SCI material under this contract unless they are filling a DoD SCI billet. The contractor will coordinate with SCI Contract Office Representative to ensure adequate billets are requested under this contract. Multiple contract employees sponsored by the organizations other than Air Force Space Command must be certified to SSO AFSPC for use on the contract.

Item 13.p. The contractor will designate a Special Security Point of Contact (POC) to SSO Schriever. The POC will be responsible for all personnel and information security transactions between the contractor and SSO Schriever.

Item 13.q. Contractor will not use references to SCI accesses, even by unclassified acronyms, in advertising, promotional efforts, or recruitment for employees.

Item 13.r. The following activity is designated as the User Agency SSO for SCI requirements IAW DIA Manual 50-5: SSO Schriever, 50 OSS/INS, 300 O’Malley Ave Suite 26, Schriever AFB, CO 80912

Item 13.s. The complete name, address, organization, and duty phone of the Contract Monitor will be provided to the SSO.

Item 13.t. Contractor personnel are subject to counterintelligence polygraph.

RELEASE OF SCI/NON - SCI INTELLIGENCE INFORMATION

TO DOD CONTRACTORS

Addendum to DD Form 254, Item 10.e.

RELEASE OF SENSITIVE COMPARTMENTED INFORMATION (SCI) INTELLIGENCE INFORMATION TO U.S. DOD CONTRACTORS

1. Requirements for access to SCI:

a. All SCI will be handled in accordance with special security requirements, which will be furnished by the local supporting/servicing SSO or SSR through 50 OSS/INS (SAFB/SSO). Specific security directives provided by the SSO will be included in Block 13 of the DD Form 254.

b. SCI will not be released to contractor employees without specific release approval of the originator of the material as outlined in governing directives; based on prior approval and certification of "need-to-know" by the designated COR.

c. Names of contractor personnel requiring access to SCI will be submitted to the COR for approval. (The COR is identified on the reverse side of the DD Form 254 or by COR appointment letter.) Upon receipt of written approval from the COR, the company security officer will submit request(s) for special background investigations in accordance with the NISPOM to the Intelligence Support Office. The entire personnel security questionnaire package should not be forwarded to the Intelligence Support Office. The CSSO must follow the instructions provided by the Intelligence Support Office to the CSSO.

d. Inquiries pertaining to classification guidance on SCI will be directed through the CSSO to the responsible COR as indicated on the DD Form 254 or by COR appointment letter.

e. SCI furnished in support of this contract remains the property of the Department of Defense (DoD) department, agency, or command originator. Upon completion or cancellation of the contract, SCI furnished will be returned to the direct custody of the supporting SSO, or destroyed IAW instructions outlined by the COR.

2. The COR will:

a. Monitor the day-to-day activities of DoD SCI contracts and serve as a technical representative. COR serves as a point of contact for CSSO and SAFB SSO.

b. Review the SCI product for contract applicability and determine that the contractor requires the product to complete contractual obligations.

c. Prepare or review contractor access requests to ensure satisfactory justification (need-to-know) and completeness of required information.

d. Prepare and maintain a current SCI employee roster with an information copy to 50 OSS/INS (SSO).

e. Approve and coordinate visits by contractor employees though the local SSO when such visits are conducted as part of the contract effort.

f. Review and forward all contractor requests to process SCI electronically to 50 OSS/INS (SSO) for coordination through appropriate SCI channels.

g. Request for release of intelligence material to a contractor must be prepared by the COR and submitted to 50 OSS/INS (SSO). This should be accomplished as soon as possible after the contract has been awarded. The request will be prepared and accompanied with a letter explaining the requirement and copies of the DD Form 254 and Performance Work Statement (PWS).

RELEASE OF NON-SCI INTELLIGENCE INFORMATION TO U.S. DOD CONTRACTORS

1. Requirements for access to Non-SCI:

a. All intelligence material released to the contractor remains the property of the US Government and may be withdrawn at any time. Contractors must maintain accountability for all classified intelligence released into their custody.

b. The contractor must not reproduce intelligence material without the written permission of the originating agency through the Intelligence Support Office. If permission is granted, each copy shall be controlled in the same manner as the original.

c. The contractor must not destroy any intelligence material without advance approval or as specified by the Contracting Officers Representative (COR).

d. The contractor must restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract with a valid need to know. Further dissemination to other contractors, subcontractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the originating agency through the COR.

e. The contractor must ensure each employee having access to intelligence material is fully aware of the special security requirements for this material and shall maintain records in a manner that will permit the contractor to furnish, on demand, the names of individuals who have had access to this material in their custody.

f. Intelligence material must not be released to foreign nationals or immigrant aliens whether they are consultants, US contractors, or employees of the contractor and regardless of the level of their security clearance, except with advance written permission from the originator. Requests for release to foreign nationals shall be initially forwarded to the COR and shall include:

(1) A copy of the proposed disclosure.

(2) Full justification reflecting the benefits to US interests.

(3) Name, nationality, particulars of clearance, and current access authorization of each proposed foreign national recipient.

g. Upon completion or termination of the classified contract, or sooner when the purpose of the release has been served, the contractor will return all classified intelligence (furnished or generated) to the source from which received unless retention or other disposition instructions (see AFMAN 37-139) are authorized in writing by the COR.

h. The contractor must designate an individual who is working on the contract as custodian. The designated custodian shall be responsible for receipting and accounting for all classified intelligence material received under this contract. This does not mean that the custodian must personally sign for all classified material. The inner wrapper of all classified material dispatched should be marked for the attention of a designated custodian and must not be opened by anyone not working directly on the contract.

i. Within 30 days after the final product is received and accepted by the procuring agency, classified intelligence materials released to or generated by the contractor, must be returned to the originating agency through the COR unless written instructions authorizing destruction or retention are issued. Requests to retain material shall be directed to the COR for this contract in writing and must clearly indicate the justification for retention and identity of the specific document to be retained.

j. Classification, regarding, or declassification markings of documentation produced by the contractor shall be consistent with that applied to the information or documentation from which the new document was prepared. If a compilation of information or a complete analysis of a subject appears to require a security classification other than that of the source documentation, the contractor shall assign the tentative security classification and request instructions from the COR. Pending final determination, the material shall be safeguarded as required for its assigned or proposed classification, whichever is higher, until the classification is changed or otherwise verified.

2. Intelligence material carries special markings. The following is a list of the authorized control markings of intelligence material:

a. "Dissemination and Extraction of Information Controlled by Originator (ORCON)." This marking is used, with a security classification, to enable a continuing knowledge and supervision by the originator of the use made of the information involved. This marking may be used on intelligence, which clearly identifies, or would reasonably permit ready identification of an intelligence source or method, which is particularly susceptible to countermeasures that would nullify or measurably reduce its effectiveness. This marking may not be used when an item or information will reasonably be protected by use of other markings specified herein, or by the application of the "need-to-know" principle and the safeguarding procedures of the security classification system.

b. "Authorized for Release to (Name of Country(ies)/International Organization." The above is abbreviated “REL ." This marking must be used when it is necessary to identify classified intelligence material the US government originator has predetermined to be releasable or has been released through established foreign disclosure channels to the indicated country(ies) or organization.

3. The following procedures govern the use of control markings.

a. Any recipient desiring to use intelligence in a manner contrary to restrictions established by the control marking set forth above shall obtain the advance permission of the originating agency through the COR. Such permission applies only to the specific purposes agreed to by the originator and does not automatically apply to all recipients. Originators shall ensure that prompt consideration is given to recipients' requests in these regards, with particular attention to reviewing and editing, if necessary, sanitized or paraphrased versions to derive a text suitable for release subject to lesser or no control markings.

b. The control marking authorized above shall be shown on the title page, front cover, and other applicable pages of documents, incorporated in the text of electrical communications, shown on graphics, and associated (in full or abbreviated form) with data stored or processed in automatic data processing systems. The control marking also shall be indicated by parenthetical use of the marking abbreviations at the beginning or end of the appropriate portions. If the control marking applies to several or all portions, the document must be marked with a statement to this effect rather than marking each portion individually.

c. The control markings shall be individually assigned at the time of preparation of intelligence products and used in conjunction with security classifications and other marking specified by E.O. 12958 and it’s implementing security directives. The marking shall be carried forward to any new format in which the same information is incorporated including oral and visual presentations.

4. Request for release of intelligence material to a contractor must be prepared by the COR and submitted to 50 OSS/INS (SSO). This should be accomplished as soon as possible after the contract has been awarded. The request will be prepared and accompanied with a letter explaining the requirements and copies of the DD Form 254 and Statement of Work (SOW).

OPERATIONS SECURITY (OPSEC)

Addendum to DD Form 254, Item 11.j.

GENERAL:

1. PURPOSE: This section outlines the requirements and procedures necessary to protect Critical Information for Operations Security (OPSEC).

2. MISSION: To maintain a continuing awareness of adversary interest in center actions and adversary intelligence collection capabilities. To understand the need to identify and protect classified and unclassified indicators, which occur, reveal sensitive information. To evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

3. DEFINITION: OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

a. Identify those actions that can be observed by adversary intelligence systems.

b. Determine indicators hostile intelligence systems might obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

c. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

4. OBJECTIVES:

a. To protect planned operational center activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

b. To preserve secrecy concerning specific scenario events and a NORAD response to these events.

c. To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. TASKS: Task requirements are outlined in the Statement of Work for this effort and at a minimum must include:

a. Release of the organizations Critical Information List to the contractor.

b. Threat information available (Threat Working Group Minutes).

c. Contractor receiving OPSEC training from the sponsoring organization.

d. Specific OPSEC countermeasures as needed.

ATTACHMENT X

Addendum to DD Form 254, Item 10.f.

Special Access Program (SAP) Addendum for FA2550-17-X-XXXX

Item 8.a. All SAP performance will be conducted within approved SAP Facilities (SAPF) designated by the 50th Space Wing (50 SW) Government Special Security Officer (GSSO). Daily SAP performance is authorized at the following location:

300 O’Malley Ave, Ste 26 Schriever AFB, CO 80912

150 Vandenberg St, Ste 1105 Peterson AFB, CO 80912

-----------------------------------------------------ONE FACILITY ONLY--------------------------------------------------

Security oversight functions in support of 50 SW units may require site visits to those facilities under their authority.

Item 8.c. HQ AFOSI PJ/OL-D is the cognizant security office for all SAPs related to this contract. Address is 150 Vandenberg St, Ste 1105, Peterson AFB, CO 80912. Telephone contact is 719-554-9028.

Item 12. Public release of SAP data is NOT authorized without prior coordination through the AFOSI PJ Security Director and the subsequent approval of the Original Classification Authority and the Air Force Special Access Program Central Office (SAPCO). Submit all proposed public disclosures related to SAP data to the Government Program Manager (HQ AFSPC/A2/3/6) and the AFOSI PJ PSO.

Item 13. Contractor will abide by all applicable security regulations, procedures, and requirements while performing in facility #1 listed above.

Item 14. The latest versions of the following documents provide guidance for SAP contracts w/o performance at the contractor’s location:

DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM) DoD Directive 5205.07, SAP Policy DoD Manual 5205.07, SAP Security Manual, Vols 1-4 DoD Instruction (DoDI) 5205.11, Management, Administration, and Oversight of DoD SAPs DoD Manual 5200.01, DoD Information Security Program, Volumes 1-4 AF Policy Directive (AFPD) 16-7, Special Access Programs AFI 16-701, Management, Administration and Oversight of SAPs Risk Management Framework (RMF) using the Joint SAP Implementation Guide (JSIG) DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology SAF/AAZ Implementation Memorandum, dated 7 November 2013, and United States Air Force Security Marking Guide for SAPs, dated 1 July 2011, Revision 1, dated 16 October 2013, will serve as the marking guide(s) for all SAP materials generated under AF cognizance.

Supersession of any of the above documents will not require an immediate revision to this DD Form 254. The updated document will be deemed to be on contract as of the date of supersession. Additional costs incurred due to updated guidance will be brought to the attention of the GCO immediately.

DFARS clause 252.204-7012 is required in both SAP, classified, and unclassified contracts. Contractor SAP networks are not subject to this clause, as these networks are governed by the DoD Joint Special Access Program Implementation Guide (JSIG), as required by DODI 5205.07 Volume 2, Enclosure 6. However, contractors operating under a classified/SAP contract are still subject to DFARS clause 252.204-7012 for their unclassified networks, as clarified by DAR Case 2013-D018. AFOSI(PJ) and SAF/AAZ concur with this interpretation.

Item 15. DSS is carved out of inspection responsibility for the SAP portions of this contract by the DepSecDef. Inspection responsibility is retained by SAF/AAZ and is executed per policy by AFOSI PJ.

APPROVAL SIGNATURE BLOCKS FOR DD 254

SPECIAL SECURITY OPERATIONS (SSO)

CONTRACT NUMBER: FA2550-17-X-XXXX

Approve/Disapprove

MICHAEL A. KREIFELS

Contracting Officers Representative (COR)

50 OSS/INS

DOUGLAS L. PEACOCK, DAFC

Industrial Security Specialist

50 SW/IP

MICHAEL A. KREIFELS

Chief, Schriever Special Security Office

50 OSS/INS

DEAN R. MALONEY

Program Security Officer

AFOSI PJ/OL-D

FOR OFFICIAL USE ONLY