Atch_6_-_Travel_and_DD254_Forms.pdf

LETTER OF INDEMNIFICATION

I. The above-named Contractor, in consideration of the United States Air Force training of the herein named

Contractor employee on the Air Force installation, whether by contractor or otherwise, hereby agrees:

(1) To indemnify and hold the United States Air Force harmless, whether in tort or in contract, for any and all loss or liability for injury to or death of ……………… in transit to or from or during the period of attendance of any training or school provided by the United States.

(2) To defend, pay or settle every claim or suit against the United States Air Force, its agencies, and United

States personnel, by any employees of the Contractor or persons claiming through them, or by third parties, for any and all loss or liability for injury or death of ……………, in transit to or from or during the period of attendance at any training school provided by the United States.

(3) To pay or settle every claim or death or injury to any person, or for loss or damage to any property whether or not under the control of the United States arising out of the use of any Air Force installation, supplies, or services by the Contractor or its employee, ………………, unless the death, injury, loss or damage results solely from the negligence or willful misconduct of United States Air

Force Personnel.

II. For the purpose of this agreement, the term “United States Air Force Personnel” shall include:

(1) Military and civilian personnel of the United States Air Force acting within the scope of their employment, and

(2) Heirs, successors, executors, administrators, and assignment of such personnel.

X Name

TITLE: Contract or Program Manager

FA3020-17-R-0002

Attachment 6

pg. 1 of 9

Letter of Identification (LOI) for Travel - Official Travel of Government Contractors This letter is the official means of contractor employee travel for travel throughout CONUS/OCONUS. Contractor employees are not authorized to use the City Pairs Program Fares.

Contractor (Name, Address, Telephone & Fax Number) Vendor Code Date

Travel Authorization Number Date

Employee Name SSAN

Destination/Itinerary Purpose of Travel Length of Travel

Use of Commercial Travel Office is Authorized Yes No

Transportation Authorized Yes No

Rail Yes No

Lodging Eligibility Yes No POV Yes No Bus Yes No GS Equivalency Rating

(Lodging Purposes Only) Excess Baggage Authorized

Pieces Weight

Installation Access Authorized Yes No Hours of Access :

Privileges Authorized (Applicable to non-ID Card holders. i.e. Access to Commissary, BX, Medical Care, etc.)

(Note: Contractor employees without ID cards will only receive privileges identified on LOI)

Commissary Base Exchange Medical Services Other _______________________ Contract Number Task Order Number Contract Line Item Number(s) (CLIN(s

Contracting Organization/Address Telephone Number Contract/Task Order Period

Contracting Officer Telephone, Fax, E-Mail

Accounting Appropriation (Include CIC for international travel at government expense)

Estimated Cost Distribution Address any inquiries regarding this LOI (Name) Signature

Telephone Fax E-Mail

Authorizing Authority:

(Resource ADVISOR)

Approving Authority:

(Contracting Officer )

Name Name Joint Travel Regulation (JTR), Vol 2 is available at http://www.dtic.mil/perdiem/.

Section 6311 of title 5, United States Code, authorizes collection of this information. The primary use of this information is for the AF and your employer to obtain information related to your government directed travel.

Where the employee identification number is your Social Security Number, collection of this information is authorized by Executive Order 9397.

Furnishing this information on this form, including your Social Security Number, is voluntary, but failure to do so may result in the disapproval of this request.

FA3020-17-R-0002

pg. 2 of 9

FA3020-17-R-0002

pg. 3 of 9

pg. 4 of 9

pg. 5 of 9

SECTION 13 CONTINUATION SHEET

Block 13 CONTINUED:

The VGSA is a legally binding contractual agreement between the DoD contractor and AF, and must be executed prior to initiation of on-base operations, unless an extension is specifically authorized permitting immediate on-base operational access due to mission requirements. Prime contractors are responsible for ensuring their subcontractors are knowledgeable of and comply with the applicable requirements. Prime must include a provision in each sub-contract that requires subcontractors to contact the installation commander’s designee (82 SFS/S5X at (940) 676-3514), Sheppard AFB Information Protection Office. Subcontractors must execute a separate and/or independent VGSA with the installation when not collocated (i.e., not working at the same military reservation) with the prime contractor. If at the same location, a subcontractor signature indicating acknowledgement of the prime contractor VGSA requirements is acceptable, prior to beginning on-base operations.

10j. Controlled Unclassified Information (CUI) is the term which collectively refers to certain types of unclassified information which also requires application of access and distribution controls and protective measures for a variety of reasons. The attached DoD CONTROLLED UNCLASSIFIED INFORMATION (CUI) ADDENDUM, attachment 2, includes requirements for handling of certain types of information. DoDM 5200.01-V4 also applies.

10k(1). The contractor will comply with the Sheppard AFB OPSEC program. 82 SFS/S5X is the Sheppard AFB installation point of contact. Contractor personnel will know who their organization's OPSEC coordinator is and contact them for questions, concerns, or recommendations for OPSEC or Signature Management (SM) related topics. AFI10-701 OPSEC requirements apply to include being familiar with the organization's critical information and protecting critical and/or sensitive information from disclosure. Contractor personnel will NOT publicly post or publish work-related information that potentially contains critical or sensitive information without explicit approval of their immediate supervisor, security office and/or OPSEC PM/SM/OPSEC coordinator, this includes NOT publicly disseminating, or publishing photographs displaying critical and/or sensitive information, nor publicly referencing, disseminating, or publishing critical and/or sensitive information already compromised. When directed or as part of established Standard Operating Procedures, contractor personnel will destroy (burn, shred, etc.) critical and/or sensitive unclassified information no longer needed to prevent the inadvertent disclosure and/or reconstruction of this material and implement additional protection measures as ordered by the commander, director, or an individual in an equivalent position. Contractor personnel will report attempts by unauthorized personnel to solicit critical and/or sensitive information and treat such attempts as human intelligence (HUMINT) gathering and consider it a HUMINT incident. All contractor personnel who have been involved in or have knowledge of such a possible HUMINT incident will report all facts immediately to the nearest supporting AFOSI office.

10k(2). Notification of Government Security Activity is required by FAR 52.204-2.

10k (3). The contractor shall execute all positions requiring elevated permissions or elevated access to information systems, specifically those described in paras. .1.1/1.2.1.3.1/1.2.1.7/1.5.6.4/1.5.6.5/1.5.6.6/1.5.6.7.3/1.5.6.7.4/1.5.6.8/1.5.6.9/1.5.6.10/ 1.5.6.11/1.5.6.12/1.5.6.13/1.5.6.13.1/1.5.6.15/1.5.6.19 2.1.7.2. of the Performance Work Statement, in accordance with Department of Defense (DOD) Manual 8570.01 and DOD Instruction 8500.2.

11a/e. Contractor performance is restricted to Sheppard AFB, TX. Contract is for receipt, storage and issuance of assets coming through the 82 LRS IAW AFI 23-101, AFMAN 23-122 and AFH 23-123. All incoming assets will be processed using the Enterprise Solution-Supply system. Classified markings on any classified material to be furnished will provide the classification guidance necessary for performance of this contract.

11l. Information Technology (IT)/Automated Information System/s (AIS)/Information Systems (IS)/Local Area Network (LAN): The contractor will require access to the government IT/AIS/IS/LAN to perform their contractual duties.

Contractors requiring access to government IT/AIS/IS/LAN must meet authorized user access control, training, reporting and other requirements specified by the host installation and as contained in AFMAN33-282, which includes being

pg. 6 of 9 determined to be trustworthy by a designated government official prior to LAN access being granted. At no time will individual personally owned computer systems be used to support government operations without prior DAA C&A approval. At no time will foreign nationals or foreign government personnel be granted access to any information systems with official government information associated with the contract (either processing or with data at rest) without specific prior approval from GCA and DAA C&A. Ensure all users are warned and provided with appropriate privacy and security notices that the systems they are entering are DoD systems, and thus subject to monitoring, recording and auditing by authorized personnel. In addition, in accordance with HSPD-12, any new applicant for the Common Access Card (CAC) will require an appropriate background investigation prior to issuance of the CAC.

pg. 7 of 9

ADDENDUM - PROTECTION FOR CONTROLLED UNCLASSIFIED INFORMATION

General: There are types of information that are not classified, but which require protective measures which restrict its distribution for a variety of reasons. This information is known as "controlled unclassified information (CUI)." The types of information considered CUI for the program are information marked "For Official Use Only” by the U.S.

Government and Technical Data. When handling CUI material, all personnel are to comply with these requirements and follow their company policy and/or applicable Proprietary Information Agreements (PIAs) concerning the protection of proprietary information in situations not clearly stated herein.

Technical Data Description: Any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process or to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media, such as computer software, drawings or photographs, text in specifications, or related performance or design documents, or computer printouts. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation.

For Official Use Only Information (FOUO) Description: FOUO is a dissemination control applied by the Department of Defense to unclassified information when disclosure to the public of that particular record, or portion thereof, would reasonably be expected to cause a foreseeable harm to an interest protected by one or more of Freedom of Information Act (FOIA) Exemptions 2 through 9. "For Official Use Only (FOUO)" is a Government designation that is applied to unclassified information that may be exempt from mandatory release to the public under the FOIA. FOUO information includes information identified as such in the Security Classification Guide or information from a government document marked FOUO.

CUI Markings

FOUO documents shall be marked in accordance with DoD Manual 5200.01, Volume 4, DoD Information Program Controlled Unclassified Information (CUI). FOUO information extracted from an FOUO document will carry the FOUO marking until formally reviewed by the government.

Unclassified Technical Data shall be marked in accordance with DoD Directive 5230.24, Distribution Statements on Technical Documents, and will, at a minimum include the statements listed below. This does not preclude additional mandated markings required by the contract such as Competition Sensitive Information.

Export Warning Statement: Technical Data contained in documents not approved for export shall display the appropriate export control caveat on the front cover or title page, as follows:

“WARNING - This document contains technical data whose export may be restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq) or the Export Administration Act of 1979, as amended (Title 50, U.S.C., App. 2401 et seq). Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.”

Protection of CUI Information

Access: Program CUI is restricted to personnel with a valid need to know, unless public release authorization has been obtained. Information, in any media format may only be disseminated on a need to know basis. The need to know restricts the use or dissemination of CUI data to those individuals or organizations with direct affiliation with the given program or project. Further dissemination of such information will be at the discretion of the government Security Manager.

Personnel no longer requiring access to CUI must delete or surrender any in their possession and terminate future access to it.

Storing/Handling: During working hours, reasonable steps should be taken to minimize risk of access to CUI by unauthorized personnel. After working hours, CUI information shall be stored in locked desks, file cabinets, bookcases, locked rooms, or similar facilities. CUI may not be displayed in public places, such as airports, airplanes, restaurants, etc. Computers used for storing or processing CUI do not need to be accredited for classified use. Do not process DoD information on public computers (e.g. those available for use by the general public in kiosks, hotel business centers or the like) or computers that do not have access control. Personally owned computers are not authorized for storing or

pg. 8 of 9 processing CUI. Program CUI stored electronically on all devices such as company issued laptops, Personal Digital Assistants (PDA), and removable media, are to be physically protected or protected using cryptographic products that are either NIST approved or comply with FIPS 140-2. Protect CUI by at least one physical or electronic barrier when not under direct individual control.

Dissemination: Printed CUI documents and material may be transmitted through mail channels or hand carried without formal courier orders. Use secure communications whenever possible; however, land-line communications for telephone conversations are more secure than cellular and should be utilized whenever available for program CUI discussions. Voice and fax transmissions will be transmitted only when the sender has a reasonable assurance that only authorized recipients will have access to the transmission. For digital transmission, the following guidelines apply:

• Collaborative suites may be used by personnel not located on a government backbone (i.e., NIPRNET) without Government Security Office approval provided all of the following requirements apply:

Use only NIST approved cryptographic vendors and algorithms. The latest validation lists may be obtained at: http://csrc.nist.gov/cryptval/ and, Use an internally hosted service (does not use third-party collaborative suite service provider) and, (excluding currently approved collaborative tools pending final Government determination).

Notify the Government Security Office, in writing, of the collaborative suite and version.

• Personnel with access to NIPRNET require local Designated Approving Authority (DAA) approval prior to participation in any collaborative suite that requires installation of mobile code on the local NIPRNET connected system.

• All computers containing program CUI must be protected by either physical isolation from all personnel without a valid need for the information or protected using cryptographic products that are either NIST approved or comply with FIPS 140-2. Discretionary access control measures must be used to preclude access to CUI data by authorized users but who are not authorized access to CUI information. After working hours, when not in physical possession of the owner, all electronic assets containing program CUI must be afforded a reasonable degree of physical protection to prevent theft of program information i.e. locking up laptops or cable locking them to a stationary base.

• Whenever practical, electronic transmission of CUI (e.g., data, website, or e-mail) shall be by approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure (PKI) or transport layer security (e.g., https)..

• CUI may NOT be posted to publicly-accessible Internet sites and may NOT be posted to sites whose access is controlled only by domain (e.g., limited to .mil and/or .gov) as such restricted access can easily be circumvented. At a minimum, posting CUI to a website requires certificate-based (e.g., common access card) or password and ID access as well as encrypted transmission using hypertext transfer protocol secure (https) or similar technology. CUI other than FOUO may have additional posting restrictions.

• External transmission/dissemination of CUI (i.e. email and file transfers) to or from a DoD computer shall be encrypted by use of a DoD approved Public Key Infrastructure Certification. These are available from:

http://iase.disa.mil/pki/eca/.

• As new technologies become available in the electronics arena care should be given to providing a reasonable degree of protection to program information from known vulnerabilities.

• Internet shall be equated with “Public Access”. Therefore, CUI must be reviewed and officially approved for public release before placing on the Internet. This is not applicable when the internet is used for e-mail transmissions and encryption is used as noted above.

Disposal: CUI documents shall be destroyed by cross-cut shredding or equivalent tearing into pieces so as not to be easily reconstructed. CUI on removable media and computing devices must be cleared (e.g., overwriting memory locations, degaussed) before being disposed of or transferred to another program. Removable media and computing devices may also be disposed of by providing them to a company’s internal organization responsible for destruction.

Sanitize CUI with a three-time overwrite before sale, transfer, or reassignment to those not authorized and requiring access to data stored thereon.

http://csrc.nist.gov/cryptval/ http://iase.disa.mil/pki/eca/

pg. 9 of 9

Report of Loss of CUI: Contractors will notify government Security Manager of any loss of CUI. Intrusions or incidents involving the potential compromise, exfiltration, or other loss of CUI on a contractor information system shall be reported.

Electronic initial reports shall be made as expeditiously as possible in all cases within 72 hours of discovery. Initial report content shall include the following information as available.

• Applicable dates, including dates of compromise and dates of discovery

• Threat methodology, including all known resources used (e.g. IP addresses, domain names, software tools)

• Account of what actions the threat(s) may have taken on victim system/network

• What information may have been compromised exfiltrated or lost and its potential impact on government programs

Report of Cyber Intrusions: As soon as Contractors learn of them, report cyber intrusions and other compromises of Defense Program Information (DPI) to their supporting counterintelligence office, which will inform the DoD-DIB Common Information Sharing Environment (DCISE). The Contractor will also notify the government Security Manager of any incidents.

cecilia.murray@us.af.mil