Attachment_2_DD254_VGSA_22Mar17.pdf

wi ll be by means that preclude unauthorized public disclosure. Transmittal documents will ca ll attention to the presence of FOUO attachments.

4. STORAGE: During work ing hours, FOUO in fo rmation shall be placed in an out-of-s ight location if the work area is accessible to persons who do not have a need fo r the information.

During non-working hours. the information shall be stored to preclude unauthorized access.

Filing such material with other unclassified records in unlocked files or desks is adequate when internal building security is prov ided during non-working hours. When such internal security control is not exercised, locked bui ldings or rooms will provide adequate after-hours protection or the material ; can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSPORTATION: FOUO in formation may be sent via first-class mail or parcel post.

Bulky shipments may be sent by fourth class mai l.

6. DISPOSITION & DISCLOSURE: When no longer needed, record copies of FOUO in formation may be disposed of by shredding. Unauthorized disclosure of FOUO in formation does not constitute a securi ty violation, but the re leasing agency must be in fanned of any unauthorized disclosure. Appropriate administrative action will be taken to fix responsibility for unauthorized disclosure whenever feasible, and appropriate disciplinary action w ill be taken against those respons ible. The unauthorized disclosure of FOUO information protected by the Privacy Act may a lso result in c ivil and criminal sanctions.

a. The ·'Official Use Only .. (FOUO)_ marking is assigned to information at the time o f its c reation by a DoD User Agency. lt is not authorized as a substitute for a security c lassification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

b. Use of the above markings does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate purpose is served by withho ld ing the information or portions of it.

VISITOR GROUP SECURITY AGREEMENT (VGSA)

(CLASSfF IED ACCESS & POSSESSION)

I. This agreement. entered into between the Commander, Air Force Technical Applications Center (AFTAC) Patrick AFB. Florida and , is 10 be performed at AFT AC under set provisions of DoD 5220.22-M, National Industrial Security Program, Section I. Part I .

. hereafter referred to as ""visitor group,"' shall be performing on a classified contract. DD Fonn 254, DoD Classified Contract Security Specification. at AFT AC. This Visitor Group Security Agreement (VGSA) prescribes specific actions to be taken by the visitor group and Mrs. Donna Miller (P) and Mr. James D. Mollison (A). (hereafter referred to as program manager); to properly protect classified defense information involved in this on-base contract. Under the terms of this agreement, AFTAC/SO, (herea~er referred to as Servicing Security Activity (SSA), is responsible for providing security program oversight, control, and supervision.

a. All parties, i.e. the commanders concerned, program manager. contracting officer, staff agencies, Air Force sponsor. visitor group, and their subcontractor group (if applicable). and the SSA shall comply with the provisions of this agreement without exception or deviation.

2. Visitor Group Security Supervision:

a. The designated officials exercising securi ty supervision over contract _ ________ and on my behalf are :

AFT AC/SO

I 0989 South Patrick Dri ve Patrick AF B. FL 32925-3002

(32 1) 494-3427/DSN 854-3427

b. The curren1 AFT AC program manager for this contract is:

Mrs. Donna Miller

AFTAC/TTX

I 0989 South Patrick Drive Patrick AFB, FL 32925-3002

(32 1) 494-0546/DSN 854-0546

c. The visitor group's Home Office Facility (HOF) shall provide the SSA and program manager with fomrnl wrinen notice the names of current listing of key on-base management officials or representatives, who will be responsible for visitor group security administration while the activity is located in Building 10989.

3. Standard Practice Procedures (SPP). Compl iance with this agreement normally e liminates the need for an addendum/supplement to the HOF SPP to outl ine security responsibilities at the visitor group's activity operating location. Should the visitor group's personnel determine a need to develop an addendum/supplement to the HOF SPP, a copy shall be provided to the SSA. A copy of the HOF SPP shall be maintained al the visitor group's activity operat ing location.

4. Access to and Accountability of Classified lnfom1ation:

Page I of6

a. All access to and/or possession of classified material by visitor group personnel, including oral and visual access, at the visitor group's activity operating location shall be under AFT AC supervision.

AFT AC maintains accountability. control. and ownership of all classified infonnation involved under the terms of this contract at all times per DoD 5200.1-R. AF! 31-40 I. and A FT AC Center Supplement 3 1- 40 I. The visitor group's access to classified information shall be controlled by AFT AC and limited to "contract specific, need-to-know" infonnation only.

b. The visitor group receives, releases. and disseminates classi fi ed material at AFT AC, Patrick AFB in accordance with DoD 5200. 1-R, Information Security Program. AFPD 31-4, Information Security, and 31-401. Information Security Program Management.

c. Should visitor group personnel, during contract performance discover unancnded classified materia l or an unsecured/unat1ended classified container, they shall immediately secure the classified material and notify the SSA, program manager (or designated official), and security manager. Material shall be released to the SSA; program manager or security manger, for safeguarding if the designated primary or alternate classified safe custodian cannot be contacted. During non-duty hours the visitor group personnel shall notify the Watch Officer at 494-4333. The classified material shall be turned over to the Watch Officer when the designated AFTAC safe custodian cannot be contacted.

5. Storage of Classified Material.

a. The visitor group is not authorized to store classified material independently. The visitor group is authorized to store and handle classified material in accordance with DoD 5200.1-R, AF I 31-40 I and AFT AC Center Instructions. All classified information shared with the visitor group must be stored in GSA approved security storage containers, per DoD 5220.22-M. Chapter 5, Section 3. Storage containers will be provided by the program manager's organization; providing the contract calls for Government Furnished Equipment (GFE). All classified material will be returned and secured in the designated government security container at the end of the duty day.

b. Government furnished storage containers will remain under the control of the program manager·s organization. The responsibility for setting storage container combination(s) rests with AFTAC. Each container will have a government safe custodian appointed. SF 700, Security Container Information, will be used to identify persons having knowledge of the combination(s), and may include military or civilian personnel designated by the program manager who have a need-to-know for the classi tied material in the container(s). This form will be posted inside the locking drawer of each storage container for emergency notification purposes.

c. Automated Information System (AIS). If the contractor must process classified information on an AIS, the AFTAC Government Program Manager (GPM) has the responsibility of getting the system approved for classified processing and outlining conditions for use. security managers and physical safeguarding procedures. Contractors performing Information Assurance (IA) functions, described in DOD 8570.01-M, must meet certification requirements mandated by DOD prior to performing work. The contractor shall use only government AIS systems inside any facilities with Government oversight. The contractor must complete all AIS awareness training and be briefed on access authorizations prior to receiving an account. The AFT AC GPM must authorize specific use for the system and all other access is denied. The contractor must comply with all Air Force, DoD and local guidance. The contractor shall have the access and the need to know. Jn addition, the GPM will insure contractors are properly trained prior to using the equipment. The AFTAC Government Program Manager shall prepare the designated approving authority (DAA) package in accordance with procedures in place at SSO Patrick/AFTAC Facilities. NOTE: AIS is any equipment used to capture. create, store, process or distribute information, including, but not limited to. stand alone computers (including network computers used in the stand alone

Page 2 of6 mode), word processors, laptop computers, Palm Pilots, Data Diaries, micro-computers, memory typewriters and memory calculators.

6. Transmission of Classified Material.

a. The visitor group is not authorized for direct receipt or dispatch of classified material at Patrick AFB through U.S. postal channels or commercial carriers.

b. Classified material is to be transmitted via U.S. Postal channels directly from AFT AC and shall be prepared in accordance with DoD 5200.1-R, AFl 31-401, and processed through the classified control system of Patrick AFB. SCI material will be sent from SSO Patrick using the Defense Courier Service.

c. Classified material may be handcarried onto or off Patrick AFB by an appropriately cleared and briefed visitor group courier, provided the employee is so designated in writing from the Program Manager and has a DD Form 250 I signed by AFT AC/SO, contractor will s ign and acknowledge their responsibility IAW DoD 5200.1-R and AFI 31-401. The Special Security Officer must authorize SCI material to be couried.

7. Disposition of Classified Material. The v1s1tor group shall return to the program manager or designated government classified custodian all classified material furnished by the government; to include, surrendering all classified material developed by the visitor group in connection with the contract at the end of contract performance or when no longer required, unless retention is granted by the contracting officer. Other methods of disposition shall be coordinated with the program manager and approved by the contracting officer prior to alternate disposition. Any missing classified material will be reported to the AFT AC/SO or Defense Security Service and a security incident conducted.

8. Reproduction of Classified Material. Only AF approved and controlled reproduction equipment shall be used by the visitor group, when so authorized, per DoD 5200.1-R and AFI 31-40 I. The visitor group is not authorized to reproduce classified material without the consent and/or approval of the program manager.

9. Security Education. Per Center Instruction 31-40 I, all contractors that have an AFT AC picture badge are required to attend AFT AC security refresher training once a year. Contractors who start after I Jan 2005 are required to attend the AFT AC Initial security training that lasts 16 hours. Contractor Facility Security Officers (FSO) can provide any additional training required by the NISPOM.

I 0. Personnel Security Clearances (PCLs). The visitor group's HOF shall submit visit requests annually either using Joint Personnel Automated System (JPAS), or using company letter head for visitor group's activity operating location personnel to appropriate Directorate securi ty manager and SSA in conformance with Chapter 6, NISPOM. A copy of the visit request will be retained at the visitor group's activity operating location. The program manager serves as sponsor for the visit. The HOF shall notify the security manager and SSA promptly of changes, additions and/or deletions of visitor group's activity operating location personnel requiring classified access. Expired or superseded visit requests shall be retained by the visitor group's activity operating location for one inspection cycle following their inspection.

11. Reports. The visitor group shall subm it immediately, in writing, to the SSA, reports required by the NISPOM. The vis itor group shall submit to the Defense Security Service Operating Center, Columbus Ohio, other reports required IA W para 1-302, NISPOM. The visitor group shall also keep

., the program manager, and SSA advised of any reports made in accordance

Page3of6 with para 1-304 requirements of the NISPOM and the contractor must meet requirements in CENI 31- 101.

a. The AFTAC Commander or designee appoints inquiry or investigation officials. Inquiry or investigation officials coordinate findings and reports with the appointing official and SSA.

b. The visitor group's HOF shall advise the SSA and the program manager of any changes in management, location, address or contractual perfonnance requirements.

12. USAF Controlled Area Badge: In accordance with AFT AC Center Instruction 3 1-10 I. visitor group employees shall use the automated entry control system badge to gain unescorted entry into USAF Controlled Area(s) within AFT AC. Controlled area badges will be issued only upon the request of the program manager or designated representative. A copy of the AF Form 2586, Unescorted Entry a ll personnel will receive controlled area training prior to issue of badge Authorization Certificate, will be filed and maintained by the requesting sponsor activity and controlled area training conducted yearly. A valid Visitor Authorization Letter (VAL) shall support request for badge issue. Once the need for unescorted access is no longer needed the AFT AC Badge must be turned into AFT AC/SO. The HOF shall establish out processing procedures to ensure badge turn-in and debriefings occurred.

13. Security Checks. The visitor group shall perform checks within work areas comprising the visitor groups activity operating location. These checks shall ensure at all times security precautions are taken to protect classified material in the possession of the visitor group. The visitor group shall designate an individual(s) to make room and area checks at shift changes and at the close of each working day to ensure:

a. All classi lied material has been properly scored.

b. Wastebaskets, routing baskets, typewriters, computers, desks, desk surface litter, and any other work surfaces are void of classified material.

c. Bags or boxes used to segregate classified waste are properly stored in an approved container.

d. Ensure all classified containers have been secured properly by the assigned government safe custodian. If found unsecured follow the steps in 4c of this agreement.

c. Checks of the area and security container(s) will be recorded on SF 701. Activity Security Checklist.

14. Emergency Protection. In the event of a natural disaster, major accident, or civil disturbance, the visitor group will comply with A FT A C's Emergency Action Plan. If unable to properly secure classi lied information, the visitor group shall maintain constant survei llance of the classified storage container(s) if possible. If the work area is evacuated and/or the container(s) are abandoned, the visitor group shall.

upon tennination of the emergency condition. examine classified holdings to verify no compromise or loss of material occurred. In the event of missing material or possible compromise, the discovering visitor group employee shall immediately notify the program manager, - - --- ------and the SSA.

15. Protection of Government Resources. The visitor group shall comply with AFT AC physical security and resource protection requirements, directives, and/or procedures. Contractor-maintained files will comply with governing Air Force records management rules (AF I 33-322, Records Management Program) and fall under the government file plan within the branch where the contractor is assigned.

Page 4 of6

Additionally, tile series containing classified records will be maintained in accordance AFMAN 37-123, Management of Records. The respective government program managers are responsible for providing the necessary training and procedures to ensure compliance.

16. Clarification of Security Requirements. When considered necessary, the visitor group shall request interpretations of security requirements as follows:

a. Visitor group will use the Center Form I 02, to request clarification of security classification guidance. Their contact program manager handles issues dealing with interpretation or security requirements.

b. Visitor group requests for clarification of security requirements of the NISPOM, shall be submitted through the SSA to the Defense Security Service Cognizant Security Office.

17. Contract and Associated DD Form 254. The visitor group shall maintain a copy of all contracting documents, any associated DD Form 254 and this (VGSA) at the visitor group's activity operating location.

18. Foreign Involvement. Under the terms of this agreement, the visitor group is required to notify the program manager. contracting office and the SSA, prior to any foreign involvement, regardless of access requirements or the sensitivity of infom1ation to be disclosed (classified or unclassified).

19. Inspections:

a. Staff Assistance Visits (SA Vs), Information Security Program Reviews (PRs). or self-inspections will not be conducted by the SSA of the visitor group, independent of AFT AC.

b. The SSA conducts PRs. if applicable, in the following manner:

( 1) The SSA will notify and schedule all PRs through the Directorate security managers. PRs will be conducted per DoD 5200.1-R. AFI 31-401, supplements thereto, and this agreement. A copy of the PR report will be provided to the visitor group by the Directorate security manager. The visitor group is not required to acknowledge receipt. or respond unless directed to do so in the report.

(2) The AFT AC PR or self-inspection will include the visitor group. The visitor group shall also be included in the AFTAC semiannual security self-inspection program. AFTAC will use the (VGSA) agreement and the unit's self-inspection criteria to monitor the visitor group's performance and compliance. Document and maintain the inspection report as required by DoD 5200. 1-R and AFI 31-401.

20. Expenditure of Funds for Security. This agreement is not an authorization for the commitment of funds. Nothing in this agreement shall be construed to impose any liability on the part of the U.S.

Government for injury to the agents, employees of the visitor group, its subcontractors (if applicable) assignees, or other individuals acting for or on the behalf of the visitor group, to the property of the same, nor shall anything in this agreement be construed to modify the provisions of existing contracts.

2 1. Review of this Agreement. All parties shall review this agreement at least annually for accuracy. The SSA is responsible for keeping this agreement current. In addition, the SSA will keep on file a copy of the last evaluation, self-inspection or equivalent review. Copies of reports may be made available to the visitor group for their files.

22. Other:

Page5of6

a. Forms. The program manager or designee will furnish all government forms and applicable A Fis. Ols. and/or unit securicy plans required in support of this contract.

b. Sub-Contracts. A (VGSA) agreement shall be initiated whenever the HOF or on-base visitor group enters into a subcontract arrangement with another contractor for classified performance at AFT AC or an AFT AC operating location. This (VGSA) agreement shall address the subcontractor operation separately. AFTAC, visitor group or it's HOF, as applicable, and all sub-contractors shall sign this agreement. A separate DD Form 254 is completed for each subcontractor requiring access to classified information. The visitor group or it's HOF. as applicable, is responsible for preparing the DD Form 254 for any sub-contractors and shall provide a copy to the SSA for review. The program manager ensures all questions pertaining to the DD Fonn 254 are resolved. The visitor group or its HOF signs item l 6 of the DD Form 254 for sub-contracts and makes required distribution.

c. Notification. Notify the SSA 30 days prior to contract completion or shutdown at AFTAC or AFT AC operating location in order to review contractor's operations to ensure proper disposition of classified materials per DoD 5200. l-R, AFI 31-40 I, and this agreement.

d. Govemment Liability. Nothing in this agreement shall be construed to impose any liability on the part of the US government for injury to the agents, employees of the contractor, its subcontractors, assignees, or other individuals acting for or on behalf of the contractor. to the property of the same.

nor shall anything in this agreement be construed to modify the provisions of existing contracts.

CHARLES A. ROLFES

Information Security Program Manager ( ISPM)

Visitor Group Representative Title/Position

DONNA L. MILLER

Program Manager

Date

Date

16Jun 15

Date

Page 6 of6