14N_DD254_template.docx

Contract Number: xxxxxxxx

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED Top Secret

b. LEVEL OF SAFEGUARDING REQUIRED n/a

a. PRIME CONTRACT NUMBER

a. ORIGINAL (Complete date in all cases)

DATE (YYYYMMDD)

b. SUBCONTRACT NUMBER

c. FINAL (Complete Item 5 in all cases)

DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT?

YES

NO. If Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254?

YES

NO. If Yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

8. ACTUAL PERFORMANCE

a. LOCATION 17th Training Group (AETC) 170 Griffin Goodfellow AFB, TX 76908

17 SFS/S5X

351 Kearney Blvd, Suite 119A Goodfellow AFB, TX 76908

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Contractors provide Universal Training System Administrators.

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA

b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION

e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI)

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION

h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION

i. HAVE TEMPEST REQUIREMENTS

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

X

j. FOR OFFICIAL USE ONLY INFORMATION

l. OTHER (Specify) Non US Citizens are NOT allowed on SCI Contracts

VGSA

X

k. OTHER (Specify) SIPR and NIPR access permitted

DD FORM 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE. Adobe Professional X

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release Direct Through (Specify) Public release of Sensitive Compartmented Information (SCI) is NOT AUTHORIZED FOR RELEASE AT ANY TIME (See SSO Goodfellow SCI Addendum to DD Form 254). No public release of SCI or Collateral classified materials is authorized. The contractor must not use references to SCI accesses, even by unclassified acronyms, in advertising, promotional efforts, or recruitment of employees.

to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

The National Industrial Security Program Operating Manual (NISPOM), February 2006 and appropriate supplements apply to all classified contract performance.

Expiration Date of Contract: 29 Sep 2018

Contract Monitor (CM): Ms. Pamela Stevens, 170 Griffin Street, St, Goodfellow AFB, TX 76908. (325) 654-3927 DSN: 477-3927 Fax: (325) 654-3928 pamela.stevens@us.af.mil

Security Office/Security Review: Goodfellow Special Security Office (SSO) Chief, Mr. Ray Williams, 17 TRG/SSO, 156 Marauder Street, Goodfellow AFB, TX 76908-4215. (325) 654-5382/5375 Fax: (325) 654-3033 DSN: 477-3033 wemford.williams@us.af.mil

ISPM: Ms. Marsha Hughes, ISPM, 17 SFS/S5X, Goodfellow AFB, TX 76908. (325) 654-3519 DSN: 477-3519 marsha.hughes@us.af.mil

OPSEC: Mr. Chris Hernandez, 17 TRW/XP, 351 Kearney Blvd, Ste 217, Goodfellow AFB, TX 76908. (325) 654-5399 Fax: (325) 654-3945 DSN: 477-5399 christopher.hernandez.23@us.af.mil

No

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

See SSO Goodfellow SCI Addendum to DD Form 254. Ref Block 10e(1): SCI requirements apply. Operations Security (OPSEC) requirements apply to this contract. OPSEC program managers will provide critical information (CI) lists to the contractor under separate cover. Contractors conducting work at Goodfellow AFB will participate in the Installation OPSEC Program. Contractors will receive periodic training along with military and government civilian counterparts.

No

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

The Contractor Cognizant Security Office (CSO) is relieved of security oversight of Sensitive Compartmented Information (SCI) oversight on USAF installations. The 17TRG/SSO assumes oversight of SCI functions on Goodfellow AFB. See SSO Goodfellow SCI Addendum to DD Form 254.

Notification of Government Security Clause 5352.204-9000 (Apr 03) applies. Notification must be submitted to the servicing security office at Goodfellow 30 calendar days before operations begins. At Goodfellow AFB the Servicing Security Activity (SSA) is either 17 TRW/IP or 17 TRG/SSO.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

b. TITLE

Contracting Officer

c. TELEPHONE (Include Area Code)

d. ADDRESS (Include Zip Code) 17th Contracting Squadron 210 Scherz Blvd Goodfellow AFB, TX 76908

17. REQUIRED DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY Goodfellow SSO & 17 TRW/IP

e. SIGNATURE

DD FORM 254 (BACK), DEC 1999

Block 13 Continuation

Access to RD requires final U.S. Government clearance at the appropriate level.

10e (1): SENSITIVE COMPARTMENTED INFORMATION (SCI): All contractor SCI work and access will be at a designated Government SCIF. The contractor must have SCI indoctrinated personnel available to work the contract. All contract personnel requiring access to SCI material must be U.S. citizens, have been granted a final Top Secret security clearance by the U.S. Government, have been approved as meeting DCID 6/4 criteria by a Government Cognizant Security Authority (CSA), and have been indoctrinated for the applicable compartments of SCI accesses prior to being given any access to such information released or generated under this contract. Immigrant aliens, personnel cleared on an interim basis are not eligible for access to intelligence information released or generated under this contract. Classified material released or generated under this contract is not releasable to foreign nationals without the expressed written permission of the 17TRW SSO. Prior approval of the Contracting Officer is required for subcontracting. See attached SCI Release of Intelligence Information for additional security requirements.

Ref Block 10e(2): General Intelligence Material/Foreign Disclosure applies. Prior approval of the contracting activity is required for subcontracting. Access to Intelligence information requires special briefings and a final U.S. Government clearance at the appropriate non-SCI level (Secret or Top Secret). See attachment 1, 2, and 4.

Ref Block 10j: FOUO applies. See attachment 5.

Ref Block 11a: Releasing contractor or government activity will furnish complete classification guidance for the service to be performed.

Ref Block 11e: Actual knowledge of generation, or production of classified information is NOT REQUIRED. This document serves as written notice of the letting of a classified service contract.

Ref Block 11j: OPSEC requirements apply. See attachment 6.

Ref Block 11k: DCS address is HQ Defense Courier System, Building P-830, Fort George G. Meade, MD 20755-5370.

Ref Block 11l: VGSA. Notification of Government Security Clause 5352.204-9000 (Apr 03) applies.

See SSO GOODFELLOW SCI ADDENDUM TO DD FORM 254.

ATTACHMENT 1

INTELLIGENCE INFORMATION:

SENSITIVE COMPARTMENTED INFORMATION (SCI) ADDENDUM

SSO Goodfellow SCI ADDENDUM TO DD FORM 254

____ (1) This contract requires access to Sensitive Compartmented Information (SCI). Per DoD 5105.21-M-1, AFI 31-601, and AETC Supplement 1, SSO Goodfellow, as the Cognizant Security Authority (CSA), has exclusive security responsibility for all SCI contracts issued by contracting organizations and SCI information released to the contractor or developed under the contract and held within the Contractor's SCI Facility (SCIF) or Co-utilization Agreement (CUA) SCIF in support of the Goodfellow mission. SSO Goodfellow is also responsible for supervision and oversight of collateral classified information maintained in SCI storage areas. The manuals, regulations and directives checked below provide the necessary guidance for physical, personnel, and information security for safeguarding SCI, and are part of the security classification specification for this contract:

__X___ DoD 5105.21-V1 – V3, SCI Security Manual, Administrative Security __X___ AFM 14-304, The Security, Use, and Dissemination of Sensitive Compartmented Information __X___ GAFBI 14-301, Personnel and Facility Sensitive Compartmented __X___ ICPG 704.2, Personnel Security Adjudicative Guidelines for Determining Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information __X___ ICD 503 – Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation _____ ICD 705 Sensitive Compartmented Information Facilities _____ ICS 705-1 Physical and Technical Security Standards for Sensitive Compartmented Information Facilities __X___ DoD Intelligence Information Systems (DoDIIS) – Joint Security Implementation Guide (DJSIG) _____ Other

__X___ (2) Contract estimated completion date: 29 Sep 2022 (NOTE: Section “F” of the contract normally provides the Period of Performance. Option years are not to be included as an option is not valid until exercised by the government.)

___X__ (3) The name, telephone number and address of the Contract Monitor (CM/COR/COTR) for the SCI portion of this contract is: (Rank/Title, Name), (Org Ex:17 TRSS, Goodfellow AFB, TX)

__X___ (4) The name, telephone number, address and e-mail of the Contractor/Subcontractor FSO/CSSO for the SCI portion of this contract is: (Rank/Title, Name), address, phone number, and e-mail address.

__X___ (5) All DD Forms 254 prepared for subcontracts involving access to SCI under this contract must be forwarded to the CM for approval and then to SSO Goodfellow for review and concurrence prior to award of the subcontract.

__X___ (6) When a visited location does not use JPAS to validate clearances, the contractor will submit the written request for SCI visit certifications through the CM for approval of the visit.

The certification request must arrive at SSO Goodfellow at least 3 (three) working days prior to the visit.

__X___ (7) The contractor will not reproduce any SCI related material without prior written permission of the CM.

__X___ (8) Security Classification Guides or extracts (are attached) (will be provided under separate cover) by the User Agency.

__X___ (9) Electronic processing of SCI requires accreditation of the equipment in accordance with DCID 6/3, Dir., Central Intelligence Directive, DIAM 50-4, and JDCSISSS.

_____ (10) This contract requires a contractor SCIF.

___X__ (11) This contract requires ___ (SI) ___ (SI/TK) _3_(SI/TK/G) _3_ (HCS) Accesses (enter approximate #s)

___X__ (12) Names of contractor personnel requiring access to SCI will be submitted on company letterhead by the contractor/subcontractor FSO or CSSO to the CM for approval. Nominated employees must meet stated security clearance and access criteria.

___X__ (13) The contractor will establish and maintain an access list of those employees working on this contract. A copy of this list and all changes will be furnished to the CM.

___X__ (14) The contractor will immediately advise the SSO and CM upon reassignment of contract employees, ineligibility of contract employees for SCI access, ___X__ (15) The contractor will perform SCI work under this contract at Goodfellow AFB, TX.

ATTACHMENT 2

INTELLIGENCE INFORMATION:

NON-SENSITIVE COMPARTMENTED INFORMATION (NON-SCI) ADDENDUM

The DD Form 254, block 10e(2) is marked YES, Intelligence information, NON-SCI, therefore the contractor must comply with the following instructions.

1. Requirements for access to non-SCI:

a. All intelligence material released to the contractor remains the property of the U.S.

Government and may be withdrawn at any time. Contractors must maintain accountability for all classified intelligence released into their custody.

b. The contractor must not reproduce intelligence material without the written permission of the originating agency through the Intelligence Support Office. If permission is granted, each copy shall be controlled in the same manner as the original.

c. The contractor must not destroy any intelligence material without advance approval or as specified by the Contract Monitor (CM). (EXCEPTION: Classified waste shall be destroyed as soon as practicable in accordance with the provisions of the Industrial Security Program).

d. The contractor must restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract with a valid need to know. Further dissemination to other contractors, subcontractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the originating agency through the CM.

e. The contractor must ensure each employee having access to intelligence material is fully aware of the special security requirements for this material and shall maintain records in a manner that will permit the contractor to furnish, on demand, the names of individuals who have had access to this material in their custody.

f. Intelligence material must not be released to foreign nationals or immigrant aliens whether they are consultants, US contractors, or employees of the contractor and regardless of the level of their security clearance, except with advance written permission from the originator. Request for release to foreign nationals shall be initially forwarded to the contract monitor and shall include:

(1) A copy of the proposed disclosure.

(2) Full justification reflecting the benefits to US interests.

(3) Name, nationality, particulars of clearance, and current access authorization of each proposed foreign national recipient.

g. Upon completion or termination of the classified contract, or sooner when the purpose of the release has been served, the contractor will return all classified intelligence (furnished or generated) to the source from which received unless retention or other disposition instructions are authorized in writing by the CM.

h. The contractor must designate an individual who is working on the contract as custodian.

The designated custodian shall be responsible for receipting and accounting for all classified intelligence material received under this contract. This does not mean that the custodian must personally receipt for all classified material. The inner wrapper of all classified material dispatched should be marked for the attention of a designated custodian and must not be opened by anyone not working directly on the contract.

i. Within 30 days after the final product is received and accepted by the procuring agency, classified intelligence materials released to or generated by the contractor, must be returned to the originating agency through the contract monitor unless written instructions authorizing destruction or retention are issued. Requests to retain material shall be directed to the CM for this contract in writing and must clearly indicate the justification for retention and identity of the specific document to be retained.

j. Classification, regarding, or declassification markings of documentation produced by the contractor shall be consistent with that applied to the information or documentation from which the new document was prepared. If a compilation of information or a complete analysis of a subject appears to require a security classification other than that of the source documentation, the contractor shall assign the tentative security classification and request instructions from the contract monitor. Pending final determination, the material shall be safeguarded as required for its assigned proposed classification, whichever is higher, until the classification is changed or otherwise verified.

2. Intelligence material carries special markings. The following is a list of the authorized control markings of intelligence material:

a. “Dissemination and Extraction of Information Controlled by Originator (ORCON).” This marking is used, with security classification, to enable a continuing knowledge and supervision by the; originator of the use made of the information involved. This marking may be used on intelligence, which clearly identifies, or would reasonably permit ready identification of an intelligence source or method, which is particularly susceptible to countermeasures that would nullify or measurably reduce its effectiveness. This marking may not be used when an item or information will reasonably be protected by use of other markings specified herein, or by the application of the "need-to-know" principle and the safeguarding procedures of the security classification system.

b. "Authorized for Release to (name of country/ International Organization)." The above is abbreviated REL. This marking must be used when it is necessary to identify classified intelligence material the US government originator has predetermined to be releasable or has been released through established foreign disclosure channels to the indicated country(ies) or organization.

3. The following procedures govern the use of control markings.

a. Any recipient desiring to use intelligence in a manner contrary to restrictions established by the control marking set forth above shall obtain the advance permission of the originating agency through the CM. Such permission applies only to the specific purposes agreed to by the originator and does not automatically apply to all recipients. Originators shall ensure that prompt consideration is given to recipients' requests in these regards, with particular attention to reviewing and editing, if necessary, sanitized or paraphrased versions to derive a text suitable for release subject to lesser or no control markings.

b. The control marking authorized above shall be shown on the title page, front cover, and other applicable pages of documents, incorporated in the text of electrical communications, shown on graphics, and associated (in full or abbreviated form) with data stored or processed in automatic data processing systems. The control marking also shall be indicated by parenthetical use of the marking abbreviations at the beginning or end of the appropriate portions. If the control marking applies to several or all portions, the document must be marked with a statement to this effect rather than marking each portion individually.

c. The control markings shall be individually assigned at the time of preparation of intelligence products and used in conjunction with security classifications and other marking specified by E.O. 12958 and its implementing security directives. The marking shall be carried forward to any new format in which the same information is incorporated including oral and visual presentations.

4. Request for release of intelligence material to a contractor must be prepared by the Contract Monitor (CM) and submitted to the Intelligence Support Office. This should be accomplished as soon as possible after the contract has been awarded. The request will be prepared and accompanied with a letter explaining the requirements and copies of the DD Form 254 and Statement of Work.

ATTACHMENT 3

RELEASE OF INTELLIGENCE INFORMATION ADDENDUM

The DD Form 254, block 10e is marked YES, Intelligence Information, therefore the contractor must comply with the following instructions.

1. Authorized Control Markings of Intelligence Information

a. "Dissemination and Extraction of Information Controlled by Originator (ORCON).” This marking is used only on classified intelligence that clearly identifies or would reasonably permit ready identification of intelligence sources or methods that are particularly susceptible to countermeasures that would nullify or measurably reduce their effectiveness. It is used to enable the originator to maintain continuing knowledge and supervision of the further use of intelligence beyond the original dissemination. This control marking may not be used when an item of information will reasonably be protected by use of any other markings specified herein, or by the application of the "need-to-know" principle and safeguarding procedures of the security classification system.

b. "Not Releasable to Foreign Nationals (NOFORN).” This control marking is used to identify classified intelligence material that may not be released in any form to foreign governments, foreign nationals, or non-US citizens without permission of the US Government originator, and then only when released in compliance with the National Disclosure Policy.

c. "Authorized for Release to (Name of country(s)/international organization.” This marking is used to identify classified intelligence material that the US Government Originator has predetermined to be releasable or has been released through established foreign disclosure channels to the indicated country(s) or organization.

2. Procedures Governing Use of Control Markings

a. Any recipient desiring to use intelligence in a manner contrary to the restrictions established by the control markings set forth above, shall obtain the advanced permission of the originating agency. Such permission applies only to the specific purposes agreed to by the originator and does not automatically apply to all recipients. Originator will ensure that prompt consideration is given to recipients' requests, with particular attention to reviewing and editing if necessary, sanitized or paraphrased versions to derive a text suitable for release subject to lesser or no control markings.

b. The control markings authorized above shall be shown on the title page, front cover, and other applicable pages of documents, incorporated in the text of electrical communications, shown on graphics, and associated (in full or abbreviated form) with data stored or processed in automatic data processing systems. The control markings also shall be indicated by parenthetical use of the markings abbreviations at the beginning or end of the appropriate portions. If the control markings apply to several or all portions, the document may be marked with a statement to this effect rather than marking each portion individually.

c. The control markings in paragraph one (1) shall be individually assigned at the time of preparation of intelligence products and used in conjunction with security classifications and other markings specified by EO 12958 and its implementing ISOO Directive. The markings shall be carried forward to any new format in which the same information is incorporated, including oral and visual presentations.

ATTACHMENT 4

FOREIGN GOVERNMENT INFORMATION ADDENDUM

The DD Form 254, block 10h is marked YES, Foreign Government information, therefore the contractor must comply with the following instructions.

1. Special Requirements for General and Foreign Intelligence Material. In addition to the requirements and controls for classified material, the Director, Central Intelligence, sets up additional requirements and controls for intelligence in the possession of contractors. The contractor must:

a. Maintain control of all intelligence materials released in his or her custody in accordance with DoD 5220.22-M, the National Industrial Security Program Operating Manual (NISPOM), February 2006, paragraphs 5-200, 201 and 202 for control. Contractor agrees that all intelligence material released, all reproductions and other material generated (including reproductions) are the property of the US Government.

b. Maintain control of all reproduced intelligence data in the same manner as the original.

c. Destroy intelligence materials in accordance with approved methods identified in the NISPOM.

d. Restrict access to those individuals with a valid need-to-know who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, government agencies, private individuals or organizations is prohibited unless authorized in writing by the Contracting Officer’s Representative (COR) with prior approval of the Unit IN/SIO.

e. Not release intelligence data to foreign nationals or immigrant aliens, regardless of their security clearance or contract status, without advance written permission from the COR, Foreign Disclosure Policy Office and Unit IN/SIO.

f. Ensure that each employee having access to intelligence material is fully aware of the special security requirements for this material.

2. Returning Intelligence to the Air Force. Contractors must return intelligence data to the COR at the termination or completion of a contract unless the COR has provided written approval for the contractor to retain for an additional two years. If retention is required beyond the two year period, the contractor must again request and receive written retention authority from the COR. If the COR grants retention authority, the COR must provide a copy of the written approval to the Unit IN/SIO.

3. Release of Classified and Unclassified Intelligence Information to Foreign Governments and Their Representatives. Any military activity or defense contractor receiving a request from a foreign government or a representative thereof, for intelligence data about this program, shall forward the request to the Unit IN/SIO for coordination with the cognizant foreign disclosure office. Information released under Foreign Military Sales (FMS) must comply with the specific USAF disclosure guidance issued for the specific FMS customer.

ATTACHMENT 5

FOR OFFICIAL USE ONLY (FOUO) ADDENDUM

The DD Form 254, block 10J is marked YES, For Official Use Only Information (FOUO), therefore, the contractor must comply with the following FOUO handling instructions.

1. GENERAL: The following FOUO instructions comply with guidance provided in NSTISSI 4002; and the Privacy Act; the Freedom of Information Act (FOIA); and the Information Security Program.

a. The FOUO marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act.

b. Use of the FOUO marking does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

2. IDENTIFICATION MARKINGS:

a. An unclassified document containing FOUO information will be marked “For Official Use Only” at the bottom of the front cover (if any), on the first page, on each page containing FOUO information, on the back page, and on the outside of the back cover (if any). No portion markings will be shown.

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked, “FOUO.”

c. Any “For Official Use Only” information released to a contractor by a DOD User Agency is required to be marked with the following statement prior to transfer:

This document contains information EXEMPT FROM MANDATORY DISCLOSURE under the FOIA. Exemptions _______ apply.

d. Removal of the FOUO marking can only be accomplished by the originator or other competent authority. When the FOUO status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: Contractors may disseminate “For Official Use Only” information to their employees and subcontractors who have a need for the information in connection with a classified contract.

4. STORAGE: During working hours, “For Official Use Only” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desk is adequate when internal building security is provided during non-working hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: “For Official Use Only” information may be sent via first –class mail or parcel post. Bulky shipments may be sent by fourth-class mail. Electronic transmission of FOUO information, e.g., voice, data or facsimile, e-mail, shall be by approved secure communications systems or systems utilizing access controls such as Public Key Infrastructure (PKI), whenever practical. When sending FOUO records over facsimile equipment, use cover sheets and consider the location of the sending and receiving machines to ensure authorized personnel are available to receive FOUO information. Exercise caution before transmitting personal information over e-mail to ensure it is adequately safeguarded. Some information may be so sensitive and personal that e-mail may not be the proper way to transmit it. When sending personal information over e-mail within DoD, ensure: (1) there is an official need; (2) all addressee(s) (including “cc” addressees) are authorized to receive it under the Privacy Act; and (3) it is protected from unauthorized disclosure, loss, or alteration. Protection methods may include encryption or password protecting the information in a separate Word document. When transmitting personal information over e-mail, add “FOUO” to the beginning of the subject line, followed by the subject, and apply the following statement at the beginning of the e-mail:

“This e-mail contains FOR OFFICIAL USE ONLY (FOUO) information which must be protected under the Privacy Act and AFI 33-332.”

Do not indiscriminately apply this statement to e-mails. Use it only in situations when you are actually transmitting personal information. DoD Regulation 5400.7/AF Supp, Chapter 4, provides additional guidance regarding FOUO information.

6. DISPOSITION: When no longer needed, FOUO information may be disposed of by any means approved for the destruction of classified information, or by tearing each copy into pieces to preclude reconstructing, and placing it in a regular trash container, or as directed by the User Agency.

7. UNAUTHORIZED DISCLOSURE: The unauthorized disclosure of “For Official Use Only” information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions.

ATTACHMENT 6

OPSEC REQUIREMENTS ADDENDUM

The DD Form 254, block 11j is marked YES, HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS; therefore, the contractor must comply with the following OPSEC instructions.

11j: HAVE OPERATION SECURITY (OPSEC) REQUIREMENTS: OPSEC is a structured process that identifies critical information, analyzes friendly actions, integrates threat analysis and risk assessments, then helps personnel apply protective measures to mitigate unacceptable risk. Organizations and personnel supporting 17TH Training Group (AETC) may have OPSEC requirements associated with their activities and support. The contractor will comply 17TH Training Group (AETC) OPSEC Program. The basis for the on-site contractor OPSEC program is AFI 10-701. OPSEC requirements apply. The contractor must comply with special OPSEC requirements contained in the contract or addendum thereto. The following standard expectations are included in all work:

a. The contractor supporting specific event-oriented activities will develop OPSEC Plans/Annexes when directed by the supported program, or comply with the program's OPSEC Plan/Annex.

b. Personnel assigned will receive OPSEC Awareness Education and Duty-Related Training as deemed necessary by the Government or program supported.

c. OPSEC Awareness Education and Training will be provided or coordinated through government channels.

HSPD-12: The contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directives-12 (HSPD-12), Office of Management and Budget (OMB) Guidance M-05-24, Federal Information Processing Standards Publication (FIPS PUB) number 201) and GSA HSPD-12, Standard Operating Procedure (SOP), Personnel Security Process, dated November 18, 2005.

NOTE: The contractor shall insert the following clause in all subcontracts whom the subcontractor is required to have physical access to a federal controlled facility or access to a Federal information system.

Position Sensitivity: In accordance with DOD 5200.2-R, the DoD Personnel Security Program, this contract requires personnel performing work on a sensitive AIS to be: 1) a US Citizen, and 2) assigned to positions which are designated at one of 3 sensitivity levels (IT –I, IT – II, or IT – III). These designations equate to Critical Sensitive and Non-Critical Sensitive positions. The Contractor will ensure individuals assigned to these sensitive positions have completed the appropriate access requests forms.

· IT – Level I – Individuals assigned to positions where damage to DoD networks and development systems can be accomplished and no checks are in place to determine potential destruction of sensitive information. The investigation requirement for these positions is completion of Special Security Background investigation (SSBI) with favorable results.

· IT Level – II and III – Individuals assigned to positions where daily unsupervised access to DoD networks and information systems containing Sensitive but Unclassified or Sensitive Classified up to and including Collateral Secret information is part of their duties. The Investigation requirement for these positions is completion of a Defense National Agency Check with Written Inquires (DNQACI) with favorable results.

· These positions require that investigations be completed prior to assigning individuals to a position of trust. A US Citizens that has a DNACI in process and a successful local records check, can be allowed assignment to the positions before the completion of the investigation, in the best interest of the DoD, at the discretion of the Contracting Officer.

· Foreign nationals may be appointed to Positions IT – II and III if they: 1) possess a unique or unusual skill or expertise that is urgently needed for a specific DoD requirements and for which a suitable US citizen is not available; and 2) approved in writing by HRC. Under no circumstances can these individuals be assigned before completion and favorable adjudication of the appropriate security investigation.

· The government retains the right to request removal of contract personnel, regardless of prior clearance or adjudication status, whose actions clearly conflict with the interest of the Government. The reason for removal will be fully documented in writing by the Contracting Officer. When and if such removal occurs, the Contractor will, within 30 working days, assign qualified personnel to any vacancies thus created.

· Where access to classified information is necessary in the performance of the duties called for under this contract, the guidance contained in the DoD 5200.2-R apply. A determination of eligibility for access to classified information or assignment to sensitive duties is a discretionary security decision based on judgments by appropriately trained adjudicative personnel.

ATTACHMENT 7

VISITOR GROUP SECURITY AGREEMENT (VGSA) ADDENDUM

Required with all DD Form 254s. Modify as required.

1. Visitor Group Security Agreement (VGSA). The contractor shall enter into a long-term visitor group security agreement if contract performance is on base. This agreement shall outline how the contractor integrates security requirements for contract operations with the Air Force to ensure effective and economical operation on the installation. The agreement shall include:

a. Security support provided by the Air Force to the contractor shall include storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, base visitor control, investigation of security incidents, base traffic regulations and the use of security forms and conducting inspections required by DoD 5220.22-R, Industrial Security Regulation, Air Force Policy Directive 31-6, Industrial Security, and Air Force Instruction 31-601, Industrial Security Program Management.

b. Security support requiring joint Air Force and contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks and internal security controls for protection of classified material and high-value pilferable property.

c. On base, the long-term visitor group security agreement may take the place of a Standard Practice Procedure (SPP).

d. 17 TRW Information Protection (17 TRW/IP) is designated as the Information Security Program Manager (ISPM). The ISPM acts and signs on the behalf of the 17 TRW commander for industrial security matters.

2. Clearance Requirements. The contractor must possess or obtain an appropriate facility security clearance (Top Secret, Secret, or Confidential) prior to performing work on a classified government contract. If the contractor does not possess a facility clearance the government will request one. The government assumes costs and conducts security investigations for Top Secret, Secret, and Confidential security clearances. The contractor shall request security clearances for personnel requiring access to classified information within 15 days after receiving a facility clearance or, if the contractor is already cleared, within 15 days after contract award. Due to costs involved with security investigations, requests for contractor security clearances shall be kept to an absolute minimum necessary to perform contract requirements. The contractor shall notify the Information Security Program Manager (ISPM) at each operating location 30 days before on-base performance of the contract. The notification shall include:

a. Name, address, and telephone number of company representatives.

d. The location(s) of contract performance and future performance, if known.

e. The date contract performance begins.

f. Any change to information previously provided under this paragraph.

3. Suitability Investigations. Contractor personnel shall successfully complete, as a minimum, a National Agency Check Inquiries (NACI), before operating government furnished workstations that have access to Air Force e-mail systems. These investigations shall be submitted by the government at no additional cost to the contractor. The contractor shall comply with the DoD 5200.2-R, Personnel Security Program, and AFI 33-119, Electronic Mail (E-Mail) Management and Use, requirements.

4. Personnel Security. Contractor personnel requiring unescorted entry to controlled or restricted areas designated by the installation commander, shall comply with base access requirements. These requirements are contained in AFI 31-101 Chapter 7, for installation access and AFI 31-501 Chapter 3, for suitability determinations.

5. Pass and Identification Items. The contractor shall ensure the following pass and identification items required for contract performance are obtained for employees and non-government owned vehicles:

a. DD Form 1172, Application for Uniformed Services Identification Card, (AFI 36-3026, Identification Cards For Members of The Uniformed Services, Their Family Members, and Other Eligible Personnel, and AETC Instruction 36-3001, Issue and Control of AETC Civilian Identification (ID) Cards).

b. AETC Form 58, Civilian Identification Card (AETCI 36-3001).

c. AF Form 2219 (series), Registered Vehicle Expiration Tab (AFI 31-204, Air Force Motor Vehicle Traffic Supervision).

d. DD Form 2220, DoD Registered Vehicle and Installation Tab (AFI 31-204).

e. AF Form 75, Visitor/Vehicle Pass (AFI 31-204).

f. DoD Common Access Card (CAC), (AFI 36-3026).

g. Defense Bio-Metric Identification System (DBIDS). The DBIDS Access Card (DAC) and DBIDS Pass will be issued to control entry for contractors and visitors.

6. Listing of Employees. The contractor shall maintain a current listing of employees. The list shall include employee's name, social security number, and level of security clearance. The list shall be validated and signed by the company Facility Security Officer (FSO) and provided to the contracting officer and ISPM prior to the contract start date. Updated listings shall be provided when an employee's status or information changes.

7. Security Manager Appointment. The contractor shall appoint a security manager for the on base long term visitor group. The security manager may be a full-time position or an additional duty position. The security manager shall provide employees with training required by DoD 5200.1-R, Industrial Security Program Regulation, Chapter 10, AFPD 31-4, Information Security, and AFI 31-401, Information Security Program Management, supplements thereto, and the sponsoring unit’s Security Operating Instructions (SOIs), plans and/or procedures. Compliance with this agreement is in lieu of publication of Standard Practice Procedures. The designated ISPM is responsible for providing security oversight and sponsoring unit is responsible for implementing and managing the security program per DoD 5200.1-R. The contractor shall provide initial and follow-on training to contractor personnel who work in Air Force controlled areas. Air Force controlled areas are explained in AFI 31-101, The Air Force Installation Security Program.

8. Additional Security Requirements. In accordance with DoD 5200.1-R and AFI 31-401, the contractor shall comply with AFI 33-202, Computer Security; AFI 33-203, Emission Security (EMSEC) Program; AFI 33-204, Information Protection Security Awareness, Training, and Education (SATE) Program; applicable AFKAGs, AFIs, and AFSSIs for Communications Security (COMSEC); and AFI 10-1101, Operations Security (OPSEC) Instructions.

9. Freedom of Information Act Program (FOIA). The contractor shall comply with DoD Regulation 5400.7/Air Force Supplement, DoD Freedom of Information Act Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding For Official Use Only (FOUO) material. The contractor shall comply with AFI 33-332, Air Force Privacy Act Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, Section 8013. The contractor shall remove or destroy official records only in accordance with AFMAN 37-139, Disposition of Records—Standards, or other directives authorized in AFI 37-138, Records Disposition—Procedures and Responsibilities.

10. Reporting Requirements. The contractor shall comply with AFI 71-101, Volume-1, Criminal Investigations, and Volume-2 Protective Service Matters, requirements. The visitor group must immediately submit, in writing, through the sponsoring unit’s Security Manager to the ISPM reports of adverse information required under DoD 5200.1-R and/or D0D 5220.22M. The ISPM reports security violations committed by visiting group employees to the appropriate Defense Security Office (DSS) Cognizant Security Office (CSO), base contracting office, and the visitor group’s HOF, when appropriate. The visitor group must keep the sponsoring unit’s Security Manager and the ISPM advised of any reports submitted per 17 TRG instructions. Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information. Contractor employees shall be briefed by their immediate supervisor upon initial on-base assignment and as required thereafter.

(1) The sponsoring unit’s commander appoints the inquiry official or investigation officers.

(2) The visitor group’s security focal point will ensure employees have been briefed and completed the Standard Form (SF) 312, Classified Information Nondisclosure Agreement. Disposition of the SF 312 will be in accordance with the NISPOM.

11. Physical Security. Areas controlled by contractor employees shall comply with base Operations Plans/instructions for FPCON procedures, Random Antiterrorism Measures (RAMS) and local search/identification requirements. The contractor shall safeguard all government property including controlled forms provided for contractor use. At the close of each work period, government training equipment, ground aerospace vehicles, facilities, support equipment, and other valuable materials shall be secured.

12. Operating Instructions. The contractor shall develop an Operating Instruction (OI) for internal circulation control, protection of resources and to regulate entry into Air Force controlled areas during normal, simulated and actual emergency operations. The OI shall be written in accordance with AFI 31-101, the local base Installation Defense Plan and AFI 10-245, Antiterrorism (AT), and coordinated through the ISPM.

a. Access to and Accountability of Classified Material: All access to and/or possession of (oral and visual) classified material by visitor group personnel will be under the sponsoring units’ supervision. The sponsoring unit will maintain accountability, control, and ownership of all said classified information at all times per DoD 5200.1-R. The visitor group’s access to classified information will be controlled by the sponsoring unit and limited to “contract-specific”, need-to-know information only, unless mission requirements dictate otherwise. 17 TRG /SSO will provide guidance for Sensitive Compartmented Information (SCI). If contractor personnel during contract performance, discover unattended classified material or an insecure/unattended security container they will immediately secure the classified materials and notify the FAC.