Attachment_06_Security_Requirements_28_Aug_2019.pdf

SECURITY REQUIREMENTS FOR

UNCLASSIFIED CONTRACTS

28 August 2019

The following security requirements should be embedded in Statement of Works (SOWs) and Performance Work Statements (PWSs) when contract work does not involve access to classified information.

1. Listing Of Employees – The contractor shall maintain a current listing of employees. The list shall include the employee's name, social security number and type of investigation if contract work involves unescorted entry to Air Force restricted areas or other sensitive areas designated by the installation commander. The list shall be provided to the Program Manager and sponsoring agency’s Security Manager. An updated listing shall be provided when an employee's status or information changes.

2. Security Training – The contractor ensures all contractor employees receive initial and recurring security education training from the sponsoring agency’s security manager. Training must be conducted IAW DOD 5200.1-M, Information Security Program, Volumes 3, and AFI 31-401, "Information Security Program Management". Contractor personnel who work in Air Force controlled/restricted areas must be trained IAW AFI 31- 101, Integrated Defense.

3. Pass And Identification Items – The contractor shall ensure the pass and identification items required for contract performance are obtained for employees.

4. Background Checks – All contractor employees shall submit to a criminal background check accomplished by Shaw Air Force Base Security Forces prior to the employee being issued base access credentials. Failure to submit requested Contractor Listing of Employees as indicated can result in denial or delay of issuing base access credentials. Processing criminal background checks takes, at a minimum, 7-10 days from time of submission.

5. Federal Investigations Requirements – (If Applicable) Contractor employees requiring initial issuance of a Common Access Card (CAC), Access to Restricted Areas, Use of Government Automated Information Systems/Networks, Child Care positions, or designated Positions of Trust shall complete submission of a National Agency Check with Inquiries (NACI) to the Office of Personnel Management (OPM), or a DoD-determined equivalent investigation. When required, the government (20 FW Information Protection Office) will submit NACI investigations to OPM at no cost to the contractor.

6. Retrieving Identification Media – The contractor shall retrieve all identification media from employees who depart for any reason before the contract expires; e.g. terminated for cause, retirement, etc.

7. Traffic Laws – The contractor and its employees shall comply with base traffic regulations.

8. Weapons, Firearms, and Ammunition – Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately-owned vehicle while on Shaw AFB SC.

9. For Official Use Only (FOUO) – The contractor shall comply with DoD 5400.7-R, Chapter 4, DoD Freedom of Information Act (FOIA) Program, requirements. This regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding FOUO material.

10. Reporting Requirements – Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information. Contractor employees shall be briefed by their

FA480319BA003

Security Requirements

Attachment 06 immediate supervisor upon initial on-base assignment.

11. Physical Security – The contractor shall be responsible for safeguarding all government property and controlled forms provided for contractor use. At the end of each work period, all government facilities, equipment, and materials shall be secured.

12. Controlled/Restricted Areas – (If Applicable) The contractor shall implement local base procedures for entry to Air Force controlled/restricted areas where contractor personnel will work. An AF Form 2586, Unescorted Entry Authorization Certificate, must be completed and signed by the sponsoring agencies Security Manager before a Restricted Area Badge will be issued. Contractor employees must have a completed National Agency Check with Written Inquires (NACI) investigation before receiving a Restricted Area Badge. Interim access can be granted IAW AFI 31-501, Personnel Security Program Management.

13. Key Control – The contractor shall establish and implement methods of making sure all keys issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The contractor shall not duplicate any keys issued by the government.

13.1. The contractor shall immediately report to the Contract Officer’s Representative or Program

Manager any occurrences of lost or duplicated keys.

13.2. In the event keys, other than master keys, are lost or duplicated, the contractor may be required, upon written direction of the contracting officer, to re-key or replace the affected lock or locks without cost to the government. The government may, however, at its option, replace the affected lock or locks or perform re-keying and deduct the cost of such from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the government and the total cost deducted from the monthly payment due the contractor.

13.3. The contractor shall prohibit the use of keys, issued by the government, by any persons other than the contractor’s employees and the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in performance of contract work requirements in those areas.

14. Photography Restrictions – No one is authorized to take any pictures or video recordings of Air Force operational aircraft or restricted areas without the approval of 20 FW/CVN regardless of location while on Shaw AFB. This includes, but is not limited to, personal electronic devices such as blackberries, iPADs, iPODs, cell phones, or any other devices with digital recording capabilities.

14.1. Any contractor requiring pictures or videotape of Shaw’s airfield to support their contract must request and possess written authorization prior entering the airfield area.

14.2. Written authorization letters to photograph or video of the flightline must be signed by the

Maintenance Squadron Commander; a Fighter Squadron Top 3, Director of Operations, or Commander; Logistics Group Commander or Deputy; the Operations Group Commander or Deputy; 20 Operations Support Squadron Commander or Director of Operations or 20 FW/CVN.

FA480319BA003

Security Requirements

ADDITIONAL SECURITY REQUIREMENTS FOR

CLASSIFIED CONTRACTS

The following security requirements should be embedded in Statement of Works (SOW’s) and Performance Work Statements (PWS’s) when contract work involves access to classified information. Paragraph 2 below requires selection of the highest level of classified (highlighted in blue) required in the contract performance.

1. Visitor Group Security Agreement (VGSA) – The contractor shall enter into a long term visitor group security agreement if contract performance is on base for 90 days or more. This agreement shall outline how the contractor integrates security requirements for contract operations with the Air Force to ensure effective and economical operation on the installation. The agreement should address:

1.1. Security support provided by the Air Force to the contractor to include storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, base visitor control, investigation of security incidents, base traffic regulations, the use of security forms, and conducting inspections required by DOD 5220.22-R, Industrial Security Regulation, and Air Force Instruction 31-601, Industrial Security Program Management.

1.2. Security support requiring joint Air Force and contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks, and internal security controls for protection of classified material and high value pilferable property.

1.3. On base, the long term visitor group security agreement may take the place of a Standard

Practice Procedure (SPP).

2. Clearance Requirements – The contractor must possess or obtain a facility security clearance at the classification level of (Choose One: Top Secret, Secret, Confidential) prior to performing contract work. If the contractor does not possess a facility clearance the government (Contracting Office) will request one. The government assumes costs and conducts security investigations for Top Secret, Secret, and Confidential facility security clearances. The contractor shall request security clearances (Submit Clearance information through DISCO to the Office of Personnel Management) for personnel requiring access to classified information within 15 days after receiving a facility clearance or, if the contractor is already cleared, within 15 days after contract award. Due to costs involved with security investigations, requests for contractor security clearances shall be kept to an absolute minimum necessary to perform contract requirements.

3. Notification – The contractor shall notify 20 FW/IP, 524 Nelson Ave, Shaw AFB SC 29152, 30 days before on base performance of the contract. The notification shall include:

3.1. Name, address, and telephone number of company representatives.

3.2. The contract number and contracting agency.

3.3. The highest level of classified information which contractor employees require access to.

3.4. The location(s) of contract performance.

3.5. The date contract performance begins.

4. Listing Of Employees – The contractor shall maintain a current listing of employees. The list shall include the employee's name, social security number and level of security clearance. The list shall be validated and signed by the company Facility Security Officer (FSO) and provided to the Sponsoring Agency Security

FA480319BA003

Security Requirements

Manager. An updated listing shall be provided when an employee's status or information changes. Sending a “Visit Request” through the Joint Personnel Adjudicative System (JPAS) can also fulfill this requirement.

5. Security Manager Appointment – The contractor shall appoint a security manager for the on base Visitor Group. The security manager may be a full time position or an additional duty position. The security manager shall provide employees with training required by DODM 5200.01, DoD Information Security Program, Volumes 3, and AFI 31-401, "Information Security Program Management". The contractor will also provide initial and follow-on training to contractor personnel who work in Air Force controlled/restricted areas. Air Force restricted areas and controlled areas are explained in AFI 31-101, Integrated Defense.

6. Key Control – The contractor shall establish and implement methods of making sure all keys issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The contractor shall not duplicate any keys issued by the government.

6.1. The contractor shall immediately report to the Quality Assurance Evaluator (QAE) or Program Manager any occurrences of lost or duplicated keys.

6.2. In the event keys, other than master keys, are lost or duplicated, the contractor may be required, upon written direction of the contracting officer, to re-key or replace the affected lock or locks without cost to the government. The government may, however, at its option, replace the affected lock or locks or perform re-keying and deduct the cost of such from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the government and the total cost deducted from the monthly payment due the contractor.

6.3. The contractor shall prohibit the use of keys, issued by the government, by any persons other than the contractor’s employees and the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in performance of contract work requirements in those areas.

7. Lock Combinations – The contractor shall control access to all government provided lock combinations to preclude unauthorized entry. The contractor is not authorized to record lock combinations without written approval by the government Program Manager. Records with written combinations to authorized secure storage containers, secure storage rooms, or certified vaults, shall be marked and safeguarded at the highest classification level as the classified material maintained inside the approved containers.

FA480319BA003

Security Requirements