Attachment_3_DRAFT_DD254_Continuation_Sheet.pdf

DD FORM 254, DATED 30 MAR 2013

ATTACHMENT 1

DD254

FA5613-13-R-0007

COMMUNICATIONS SECURITY (COMSEC) INFORMATION

UNITED STATES GOVERNMENT FACILITY

(Policy: AFI 33-201—Volume 1, Communications Security; Volume 2, COMSEC User Requirements; Volume

3, Reporting COMSEC Deviations; Volume 4, Cryptographic Access Program, Volume 5, Controlled Cryptographic Information (CCI); and Volume 9, Operational Instruction for Secure Voice Devices, and applicable Air Force Systems Security Instructions (AFSSIs)

FOLLOW-ON/PRIME CONTRACT NUMBER: FA5613-13-R-0007

PRECEDING CONTRACT NUMBER: FA5613-09-D-5000 & 5001

CONTRACT EXPIRATION DATE: 30 APR 2019

Block 13, CONTINUATION:

Ref. Block 10, Item a, COMSEC Information

Access to COMSEC material/information requires a final US security clearance commensurate to the level of material accessed. Contractors are not authorized to receipt for material transferred from CONUS contractor COMSEC accounts; COMSEC material support must come from the servicing base COMSEC manager.

Contractors with access to “Secret Crypto” or higher levels must be briefed into the Cryptographic Access Program via the AFCOMSEC Form 9, Cryptographic Access Certificate, IAW AFI 33-201, Vol. 4.

Contractors must be familiar and comply with the following publications--as applicable--AFI 33-201 Vol.

1, Communications Security; Vol. 2, COMSEC User Requirements; Vol. 3, Reporting COMSEC Deviations; Vol. 4, Cryptographic Access Program; Vol. 5, Controlled Cryptographic Information (CCI);

Vol. 9, Operational Instruction for Secure Voice Devices, and any applicable AF Systems Security Instructions (AFSSIs) that provide additional guidance for cryptographic equipment/CCIs held/keyed.

Current AFSSIs may be obtained from your servicing base COMSEC manager.

Contractors must comply with all instructions provided by the servicing COMSEC manager and must maintain current training to access COMSEC material/information. Additionally, all contractors must immediately report any known or suspected deviations to their COMSEC Responsible Office or COMSEC manager for evaluation and up-channel reporting, if required.

Contact your servicing USAF base COMSEC manager for additional assistance.

DD FORM 254

ATTACHMENT 2

DD254

FA5613-13-R-0007

RESTRICTED DATA INFORMATION

(Policy: DoD 5200.1-R, Information Security Program; DoD Directive 5210.2, Access To and Dissemination of Restricted Data; and Atomic Energy Act of 1954)

CONTRACT EXPIRATION DATE: 30 APR 2019

Block 13, CONTINUATION:

Ref. Block 10, Item b., Restricted Data

Contractor is permitted access to Restricted Data (RD) in performance of this contract.

CONFIDENTIAL security clearance eligibility is not valid for access to Restricted Data. Contractors must comply with all instructions and guidance provided by the servicing AF Activity security manager.

Prior approval of the contracting activity is required for subcontracting.

Definition. Restricted Data (RD) is information which is classified and controlled under the Atomic Energy Act of 1954. It is all data (information) concerning design, manufacture, or utilization of atomic weapons; the production of special nuclear material; or the use of special nuclear material in production of energy. The term does not include data declassified or removed from the Restricted Data category pursuant to section 142 of the Atomic Energy Act of 1954, as amended (reference (b)). (Also see “Formerly Restricted Data.”)

Access. Within and between DoD Components, to include contractor activities, access to Restricted Data (RD) information will be governed by the same procedures and criteria required for access to other classified information:

Require access in performance of official duties.

Have a final US Government security clearance at a level commensurate with the information concerned.

Access requires in-brief by the servicing AF activity security manager, documentation of AF Form 2583, and indoctrination via the Joint Personnel Adjudication System (JPAS). Item 10b of the DD Form 254 will always be marked “YES” when Item 10c (CNWDI) is marked “YES.”

ATTACHMENT 2

DD254

FA5613-13-R-0007

RESTRICTED DATA INFORMATION (Continued)

Marking. Classified information marking will be in accordance with Air Force-adopted Controlled Access Program Coordination Office (CAPCO) standardized marking guidelines. Additional classified marking guidance (including country trigraph codes) is located on the SIPRNet CAPCO page at http://capco.dssc.sgov.gov .

The below figure for provides an overall marking example for a document containing Secret information, Restricted Data information, and Formerly Restricted Data information:

Contact your servicing AF activity security manager for additional assistance

Proper portion marking examples are (S//RD), (TS//RD), (S//RD/FRD), etc.

http://capco.dssc.sgov.gov/

ATTACHMENT 3

DD254

FA5613-13-R-0007

SENSITIVE COMPARTMENATED INFORMATION (SCI)

CONTRACT EXPIRATION DATE: 30 APR 2019

Block 13, CONTINUATION:

Ref. Block 10, Item e.(1), SCI:

This contract required additional security requirements for Sensitive Compartmented Information (SCI) in accordance with DoD 5105.21-M-1 and AFMAN 14-304. The Senior Intelligence Office, Headquarters, United States Air Forces Europe (USAFE) has exclusive security responsibility for all SCI classified material released to or developed for USAFE unit for this contract. The Senior Intelligence Officer has exclusive security responsibility for all SCI classified material releasted to or developed under this contract.

The following documents, with subsequent versions or changes, will be used for the specific guidance on this contract:

a) DoD Directive 5105.21-M-1, SCI Administrative Security Manual

b) AFMAN 14-304, The Security, Use and Dissemination of Sensitive Compartmented Information

c) ICPG 703.5, Dissemination Controls

d) DCID 6/1, Security Policy for Sensitive Compartmented Information (SCI)

e) ICD 301, National Open Source Enterprise

f) ICD 503, Intelligence Community Informartion Technoloty Systems Security: Risk Management, Certification and Accreditation

g) ICD 704, Personnel Security Standards and Procedures Governing Eligibility for Access to

Sensitive Compartmented Information and Other Controlled Access Program Information

h) ICD 705, Sensitive Compartmented Information Facilities

i) DIAM 50-4, Security of Compartmented Computer Operations

j) Joint DoDIIS/Cryptologic SCI Information Systems Security Standards

k) AFI 14-303, Release of Collateral Intelligence to US Contractors

Current ICDs and DCIDs can be found at the following website http://www.fas.org/irp/dni/icd/index.html.

Inquires pertaining to classified guidance on Sensitive Compartmented Information (SCI) will be directed to the responsible supporting Special Security Officers (SSO) indicated. Any SCI or SCI derived material generated under this contract will be reviewed by the supporting SSO for proper SCI classification prior to final publication and distribution. The responsible Special Security Office designated will provide assistance as required.

http://www.fas.org/irp/dni/icd/icd-301.pdf http://www.fas.org/irp/dni/icd/icd-503.pdf http://www.fas.org/irp/dni/icd/icd-503.pdf http://www.fas.org/irp/dni/icd/icd-704.pdf http://www.fas.org/irp/dni/icd/icd-704.pdf http://www.fas.org/irp/dni/icd/icd-705.pdf http://www.fas.org/irp/doddir/dod/jdcsisss-rev2.doc http://www.fas.org/irp/doddir/usaf/14-303.htm http://www.fas.org/irp/dni/icd/index.html

DD254

FA5613-13-R-0007

SENSITIVE COMPARTMENATED INFORMATION (SCI) (Continued)

SCI data furnished to or generated by the contractor will require special security handling and controls beyond those of the NISPOM. These supplemental instructions will be furnished and/or made available to the contractor through the Contracting Officer Representative (COR) by the supporting SSO.

The names of contractor personnel requiring access to SCI will be submitted to the COR for approval.

Upon written approval by the COR, forms requesting Single Scope Background Investigations will be prepared using E-QIP in accordance with NISPOM and then submitted to the supporting SSO.

The contractor will establish and maintain an access list of those employees working on the contract. A copy of this will be furnished to the COR.

The contractor will advise the COR immediately upon reassignment of personnel to other duties not associated with this contract.

SCI will not be released to the contractor employees without the specific consent of the Senior Intelligence Officer or the originator of the material when applicable. This approval will be obtained through the SSO based on prior approval and certification of need-to-know by the COR. SCI documentation, or other material concerning this contract will not be discussed with, released to, any individual, subcontractor, agency (including Federal Government agencies and employees), or contractor employees not working on the contract without prior written approval from the COR and Supporting

SSO.

Any SCI released to or generated by the contractor in support of this contract remains the property of the DoD department, agency, or command that released it. The contractor will release such material to any Special Security Office personnel assigned to HQ USAFE A2S, their command SSO, or DIA upon demand by such personnel. The contractor, upon completion/cancellation of the contract, must return all such material to the supporting SSO. This applies to all data and materials, including working papers and notes.

CORs and Contract Special Security Officers (CSSOs) will comply with all requirements in the CORs Handbook.

The contractor will not reproduce any SCI related to this contract without written permission from the COR and Supporting SSO, IAW DoD-5105-21-M-1 and AFMAN 14-304.

(ONLY USE IF ELECTRONIC PROCESSING OF SCI IS REQUIRED).

The contract requires electronic processing of SCI. In addition to the security provisions outlined in chapter 8 of the NISPOM, additional security provisions of DCID 6/9, ICD 704, AFMAN 14-304, and the Joint DoDIIS/Cryptologic SCI Information Systems Security Standards apply, and are part of this contract. The contractor’s Automatic Data Processing Equipment (ADPE) must be accredited for SCI operations from DIA via the supporting SSO prior to processing any SCI material.

The contractor will not use reference to SCI access, even by unclassified acronyms, in advertising, promotional efforts, or recruitment for employees.

DD254

FA5613-13-R-0007

SENSITIVE COMPARTMENATED INFORMATION (SCI) (Continued)

Contractor must coordinate with the Supporting SSO and obtain the concurrence of the COR prior to subcontracting any portion of the SCI efforts involved in this contract.

The contractor will comply with H 302 clause for AFB visits.

The following activity is designated as the supporting SSO for SCI requirements in accordance with DOD 5105.21-M-l, and AFI 14-303:

HQ USAFE/AFAFRICA/A2S

Unit 3050 Box 80

APO AE 09094

The supporting USAFE Special Security Officer (SSO) is:

Mr. Jackie McHone, DAFC

HQ USAFE/AFAFRICA/A2S

DSN: 314-480-6450

The USAFE Alternate Special Security Officer (ASSO) is:

Mr. Johnathon Edwards, DAFC

HQ USAFE/AFAFRICA/A2S

DSN: 314-480-6732

The AFISRA SSO is:

Mr. John Henderson 693d ISR Group/SO Unit 3065

APO AE 09094

The EUCOM SSO is:

Gil Sanchez, SFPC USEUCOM SAP/STO/Focal Point Security Manager

DSN: 314-430-7392

Comm: +49-(0)711-680-7392 TS VoIP: 988-0162

Contractors working within AFISRA units follow AFISRA command-specific SCI requirements and process SCI requirements in accordance with applicable standards.

Classified information marking will be in accordance with Air Force-adopted Controlled Access Program Coordination Office (CAPCO) standardized marking guidelines. Additional classified marking guidance (including country trigraph codes) is located on the SIPRNet CAPCO page at http://capco.dssc.sgov.gov

ATTACHMENT 4

DD254

FA5613-13-R-0007

NON-SENSITIVE COMPARTMENTED INFORMATION

(Policy: AFI 14-303, Release of Intelligence to US Contractors, and applicable AFI Supplements)

CONTRACT EXPIRATION DATE: 30 APR 2019

BLOCK 13, CONTINUATION:

Ref. Block 10, Item e.(2), Non-SCI:

Special Requirements of Intelligence Information: The contractor will require access to classified intelligence documents in the performance of this contract. In addition to the requirements and controls for classified material in DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), the contractor shall adhere to the following requirements and controls of intelligence, per AFI 14-303 and applicable supplements.

Contact USAFE or supporting SSO for permission to make extra copies of intelligence data required by the contractor if approval has not previously been stipulated above or been stipulated in the release letter.

The COR then maintains accountability of copies and ensures all information is returned to the Air Force upon contract termination/expiration.

Maintain a record of all intelligence materials released for use by the contractor, and ensures all data is returned to the COR within 2 years after final delivery of goods and services or after completion or termination of the classified contract, whichever comes first. If retention is required beyond the 2 year period the contractor must request and receive written authority from the COR.

Contractors must agree that all intelligence data shared with them, all reproductions, and other material generated (including authorized reproductions) is the property of the US Government and will be returned upon request of the sponsoring agency or expiration date of the contract, whichever comes first.

Contractor shall not reproduce intelligence without permission from USAFE or supporting SSO through the COR. If approved, must control each copy in the same manner as the original.

Contractor shall not reproduce intelligence without advance approval from the COR, except for working papers and derivative material produced in the publication process. Working papers and derivative material produced in the publication process do not need destruction approval.

ATTACHMENT 4

DD254

FA5613-13-R-0007

NON-SENSITIVE COMPARTMENTED INFORMATION (Continued)

Contractor shall restrict access to those individuals with a valid need-to-know who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, or other government agencies and private individuals or organizations are prohibited unless authorized in writing by the COR with prior approval of the supporting SSO/contracting activity.

Contractor shall not release intelligence data to foreign nationals or immigrant aliens regardless of their security clearance or contract status without advanced written permission from the COR, USAFE, Foreign Disclosure Policy Office, and HQ USAFE or the organizations’ supporting SSO if not assigned to USAFE.

Contractor shall ensure the each employee having access to intelligence material is fully aware of the special security requirements for this material and maintains records in a manner that permits the contractor to furnish on demand the names of individuals who have access to the material in their custody.

Releasing authority of intelligence documents is HQ USAFE/A2 or the organizations’ supporting SSO.

Any request for intelligence documents will be sent through the COR to the supporting SSO/USAFE designee for HQ USAFE for approval.

HQ USAFE/A2S

Unit 3050 Box 80

APO AE 09094

The supporting USAFE Special Security Officer (SSO) is:

Mr. Barry J. Lynch, DAFC

HQ USAFE/A2S

DSN: 314-480-6450

The USAFE Alternate Special Security Officer (ASSO) is:

Mr. Daniel Rivas, DAFC

HQ USAFE/A2S

DSN: 314-480-2798

The AFISRA SSO is:

Mr. John Henderson 693d ISR Group/SO Unit 3065

APO AE 09094

The EUCOM SSO is:

Gil Sanchez, SFPC USEUCOM SAP/STO/Focal Point Security Manager

DSN: 314-430-7392

Comm: +49-(0)711-680-7392 TS VoIP: 988-0162

ATTACHMENT 5

DD254

FA5613-13-R-0007

SPECIAL ACCESS PROGRAM REQUIREMENTS AND PROCEDURES

Ref. Item 8c, Performance Location (Cognizant Security Office): OL-B, Region 7, AFOSI, is the cognizant security office for all SAPs related to this contract. HQ USAFE/A3TZ is the servicing Program Security Officer. OL-B, Region 7 is located at 204 Dodd Blvd, Suite 150, Langley AFB, VA 23665. HQ USAFE/A3TZ is located at building 201, room A-7, Ramstein Air Base Germany, 09094.

Ref. Item 11j, Operations Security Requirements: The contractor will participate in the host unit OPSEC program. They will ensure they are familiar with the unit OPSEC plan and follow the local PSMs guidance regarding OPSEC.

Ref. Item 12, Public Release: No public release of classified or sensitive SAP information pertaining to this contract is authorized. All requests to release such information must be routed through the local program office to HQ USAFE/A3TZ and OL-B, Region 7, AFOSI.

Ref. Item 13, Security Guidance (Continuation):

1. All SAP work will be performed within approved SAP facilities (SAPF) designated by the local SAP Program Security Manager (PSM).

2. Requests for SAP accesses will be made through the local PSM or Program Manager (PM).

3. Continued contractor access to SAPs requires initial and recurring (annual) SAP security education training. The PM/PSM will conduct the training at the location where the contractor’s program access records are kept.

4. Inquiries regarding SAP classification guidance will be directed to the PSO, PSM, or PM. Any SAP-derived material generated under this contract will be reviewed by the PSO, PSM, or PM for proper classification prior to final publication, distribution, or transmission.

ATTACHMENT 5

DD254

FA5613-13-R-0007

SPECIAL ACCESS PROGRAM REQUIREMENTS AND PROCEDURES (Contined)

5. SAP information furnished or generated in support of this contract remains the property of the government and will be returned to the servicing program office upon completion of this contract.

6. All procedures, equipment, and devices used for data processing or data transfer of SAP information must be accredited (approved) by the PSO or PSM before any processing is permitted. Any subsequent configuration or procedural changes must also be approved prior to use.

7. The contractor will produce classified material and have access to classified data/areas listed in Item 8a only. The PSM will provide daily security oversight of this contract unless delegated in writing by the PSO to another activity.

8. The security clearance requirements for this contract is a final (circle appropriate clearance) Secret/Top Secret clearance based on a (circle appropriate clearance) NACLC/SSBI investigation within the last five years.

9. The Government will provide adequate classified storage capability. Only properly accessed (program briefed) personnel will have access to security containers and classified media containing SAP information.

Ref Item 14, Additional Security Requirements:

1. The contractor will follow all applicable security guidance related to the protection of SAP information. Baseline guidance includes the National Industrial Security Program Operating Manual (NISPOM), NISPOM Supplement (NISPOMSUP), DOD Overprint to the NISPOMSUP, Joint Air Force, Army, Navy Manual (JAFAN)6/3 and 6/4, applicable Program Security Directives (PSDs) and Security Classification Guides (SCGs), and local Standard Operating Procedures. The PSM will provide a copy of applicable guidance to the contractor.

Ref Item 15, Inspections: AFOSI Region 7 OL-B, or designated representative, will conduct security reviews of all SAP facilities, material, and operations related to this contract. DSS or local SF oversight over SAP portions of this contract is carved-out.

For additional assistance and information, OL-B, Region 7 can be reached at DSN 574-6470, COM 757- 764-6470. HQ USAFE/A3TZ can be reached at 480-6568.

ATTACHMENT 6

DD254

FA5613-13-R-0007

NORTH ATLANTIC TREATY ORGANIZATION (NATO) INFORMATION

(Policy: AFI 31-406, Applying North Atlantic Treaty Organization (NATO) Protection Standards, applicable

USAFE Supplements, and USSAN 1-07)

CONTRACT EXPIRATION DATE: 30 APR 2019

Block 13, CONTINUATION:

Ref. Block 10, Item g., NATO Information

Access. Access to NATO information requires final US security clearance eligibility at the appropriate level and a NATO Indoctrination briefing provided by the Air Force activity security manager.

The contractor is permitted access to NATO information in performance of the contract. Access to NATO information requires interim, or final USA government clearance at the appropriate level and indoctrination into NATO. The individual’s company security officer or commander of the AF program, project, or active responsible for the contract, delivery, order, etc, may conduct the indoctrination.

Interim security clearance is not valid for access to NATO Atomal information.

SIPRNet Access. Access to the USAFE Secret Internet Protocol Router Network (SIPRNet) requires NATO indoctrination by the Air Force activity security manager. The Air Force activity security manager will brief the contractor into the appropriate level of NATO. The contractor signs a non-disclosure statement for CTSA and high side material.

Check (X) “YES” if the contract requires access to information or documents belonging to NATO. If USAFE SIPRNet access is required, annotate in block 10, Item k.: “Be authorized USAFE SIPRNet access” and check (X) “YES.”

Prior approval of the government contracting activity is required for subcontracting.

The Prime contractor must receive prior approval from the Government Contracting Agency (GCA) to grant NATO access to a subcontractor. (The same procedures as above apply for NATO indoctrination by the Air Force activity security manager.)

Contact your servicing NATO Sub-Registry for additional assistance.

Marking.

Classified information marking will be in accordance with Air Force-adopted Controlled Access Program Coordination Office (CAPCO) standardized marking guidelines. Additional classified marking guidance (including country trigraph codes) is located on the SIPRNet CAPCO page at http://capco.dssc.sgov.gov .

ATTACHMENT 6

DD254

FA5613-13-R-0007

NORTH ATLANTIC TREATY ORGANIZATION (NATO) INFORMATION (Continued)

ALL e-mails and documents on the SIPRNet will be marked with the appropriate classification markings, regardless of whether they are classified or unclassified.

SIPRNet Emails

Contact your servicing NATO Sub-Registry and USAF base Information Security Program Manager (ISPM) for additional assistance.

The header and footer of the e-mail text will be the overall classification of the e-mail.

Remember, even if your e-mail is unclassified, if your attachment is classified, the overall classification will be the same as the attachment.

The first marking in the Subject line will be the classification of the e-mail Subject, using the abbreviated symbol.

All paragraphs and subparagraphs will be marked with the appropriate classification.

All attachments will be marked with the portion marking and the overall classification.

ATTACHMENT 7

DD254

FA5613-13-R-0007

FOR OFFICIAL USE ONLY (FOUO) INFORMATION

(Policy: DOD 5400.7-R, and AIR FORCE SUPPLEMENT)

CONTRACT EXPIRATION DATE: 30 APR 2019

Block 13, CONTINUATION:

Ref. Block 10, Item j., FOUO

FOUO is not a classification. Originators mark records when they create them to call attention to FOUO content. An FOUO marking does not mean you must withhold a record under the FOIA. You still need to review requested records. Examine records with and without markings to identify information that needs protection and is exempt from public release or to decide whether discretionary release is appropriate.

FOUO information provided under this contract shall be safeguarded as specified in DoD 5200.1.R.

Information in a technical document that requires a distribution statement per AFI 61-204, Disseminating Scientific and Technical Information, must show that statement. The originator may also mark the information FOUO, if appropriate.

Mark an unclassified document containing FOUO information “For Official Use Only” at the bottom, on the outside of the front cover (if any), on each page containing FOUO information, on the back page, and on the outside of the back cover (if any).

In unclassified documents, the originator may also mark individual paragraphs that contain FOUO information to alert users and assist in review.

In a classified document, mark: An individual paragraph that contains FOUO, but not classified information, by placing “(FOUO)” at the beginning of the paragraph.

The top and bottom of each page that has both FOUO and classified information, with the highest security classification of information on that page.

“FOUO” at the bottom of each page that has FOUO but not classified information.

DD254

FA5613-13-R-0007

FOR OFFICIAL USE ONLY (FOUO) INFORMATION (Continued)

If a classified document also contains FOUO information or if the classified material becomes FOUO when declassified, place the following statement on the bottom of the cover or the first page, under the classification marking:

“NOTE: If declassified, review the document to make sure material is not FOUO and not exempt under DoD 5400.7, AF Supplement before public release.”

Mark other records, such as computer printouts, photographs, films, tapes, or slides, “For Official Use Only” or “FOUO” so the receiver or viewer knows the record contains FOUO information.

Mark FOUO material sent to authorized persons outside the DoD with an explanation typed or stamped on the document.

Transmitting FOUO:

DoD components, officials of DoD components, and authorized DoD contractor’s consultants, and grantees send FOUO information to each other to conduct official DoD business. Tell recipients the status of such information, and send the material in a way that prevents unauthorized public disclosure.

Make sure documents that transmit FOUO material call attention to any FOUO attachments. Normally, you may send FOUO records over facsimile equipment. When deciding whether to send FOUO records over facsimile equipment, balance the sensitivity of the records against the risk of disclosure. To prevent unauthorized disclosure, consider attaching special cover sheets (i.e. AF Form 3227, Privacy Act Cover Sheet, for Privacy Act Information), the location of sending and receiving machines, and ensure authorized personnel are available to receive FOUO information as soon as it is transmitted. FOUO information may be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Mark the records “For Official Use Only,” and tell the recipient the information is exempt from public disclosure under the FOIA and whether it needs special handling.

Electronically and Facsimile Transmitted Messages. Each part of electronically and facsimile transmitted messages containing FOUO information shall be marked appropriately. Unclassified messages containing FOUO information shall contain the abbreviation “FOUO” before the beginning of the text.

Such messages and facsimiles shall be transmitted in accordance with communications security procedures whenever practicable.*

Transporting FOUO:

Records containing FOUO information shall be transported in a manner that prevents disclosure of the contents. When not commingled with classified information, FOUO information may be sent via first-class mail or parcel post. Bulky shipments, such as distributions of FOUO Directives to testing materials, that otherwise qualify under postal regulations may be sent by fourth-class mail.

Mark each part of a message that contains FOUO information. Unclassified messages containing FOUO information must show the abbreviation “FOUO” before the text begins.

DD254

FA5613-13-R-0007

FOR OFFICIAL USE ONLY (FOUO) INFORMATION (Continued)

Safeguarding FOUO Information:

During normal duty hours: During normal working hours, records determined to be FOUO shall be placed in an out-of-sight location if the work area is accessible to non-government personnel.

During Non-duty Hours: At the close of business, FOUO records shall be stored so as to prevent unauthorized access. Filing such material with other unclassified records in unlocked files or desks, etc., is adequate when normal U.S. Government or Government-contractor internal building security is provided during non-duty hours. When such internal security control is not exercised, locked buildings or rooms normally provide adequate after-hours protection. If such protection is not considered adequate, FOUO material shall be stored in locked receptacles such as file cabinets, desks, or bookcases. FOUO records that are subject to the provisions of the National Security Act of 1959 (reference (aa)) shall meet the safeguards outlined for that group of records.

Termination, Disposal and Unauthorized Disclosures:

Termination: The originator or other competent authority; e.g., initial denial and appellate authorities, shall terminate “For Official Use Only” markings or status when circumstances indicate that the information no longer requires protection from public disclosure. When FOUO status is terminated, all known holders shall be notified, to the extent practical. Upon notification, holders shall efface or remove the “For Official Use only” markings, but records in file or storage need not be retrieved solely for that purpose.

Disposal: Non-record copies of FOUO materials may be destroyed by tearing each copy into pieces to prevent reconstructing, and placing them in regular trash containers. When local circumstances or experience indicates that this destruction method is not sufficiently protective of FOUO information, local authorities may direct other methods but must give due consideration to the additional expense balanced against the degree of sensitivity of the type of FOUO information contained in the records.

Record copies of FOUO documents shall be disposed of in accordance with the disposal standards established under 44 U.S.C. 3301-3314 (reference (ab)), as implemented by DoD Component instructions concerning records disposal.

Unauthorized disclosure: The unauthorized disclosure of FOUO records does not constitute an unauthorized disclosure of DoD information classified for security purposes. Appropriate administrative action shall be taken, however, to fix responsibility for unauthorized disclosure whenever feasible, and appropriate disciplinary action shall be taken against those responsible. Unauthorized disclosure of FOUO information that is protected by the Privacy Act (reference (d) may also result in civil and criminal sanctions against responsible persons. The DoD Component that originated the FOUO information shall be informed of its unauthorized disclosure.

For additional assistance and information, contact your servicing base FOIA office.

ATTACHMENT 8

DD254

FA5613-13-R-0007

SECURE INTERNET PROTOCOL ROUTER NETWORK (SIPRNET)

INFORMATION

Ref. Block 10, Item k., Other: SIPRNet Access

At the direction of the Activity or Project manager, contractor may need access to SIPRNet as needed to render services. At a minimum, access to SIPRNet requires a SECRET clearnance.

ATTACHMENT 9

DD254

FA5613-13-R-0007

OPERATIONS SECURITY (OPSEC) INFORMATION

Ref. Block 11, Item j. OPSEC Requirements

GENERAL:

1. PURPOSE: This section outlines the requirements and procedures necessary to protect Critical Information for Operations Security (OPSEC).

2. MISSION: To maintain a continuing awareness of adversary interest in center actions and adversary intelligence collection capabilities. To understand the need to identify and protect classified and unclassified indicators, which occur, reveal sensitive information. To evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

3. DEFINITION: OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

a. Identify those actions that can be observed by adversary intelligence systems.

b. Determine indicators hostile intelligence systems might obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

c. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

4. OBJECTIVES:

a. To protect planned operational center activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

b. To preserve secrecy concerning specific scenario events and a response to these events.

c. To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. TASKS: Task requirements are outlined in the Statement of Work for this effort.

Contact your servicing USAF base OPSEC manager for additional assistance.