RSRV_Subsystem_DD254_Attachment_Two_5_Dec_2017.pdf

DD FORM 254 Attachment Two FA8214-19-D-XXXX 5 Dec 17

DD FORM 254 ATTACHMENTS AND ADDENDUMS

ATTACHMENT TWO

TEMPEST

Emission Security (EMSEC) Requirements Contract # FA8214-19-D-XXXX

EMISSIONS SECURITY ASSESSMENT REQUEST

(ESAR) FOR ALL CLASSIFIED SYSTEMS

1. The contractor shall ensure that compromising emanations (EMSEC) conditions related to this contract are minimized.

2. The contractor shall provide countermeasures assessment data to the Contracting Officer (CO), in the form of an ESAR. The ESAR shall provide only specific responses to the date required in paragraph c, below. The contractor’s standard security plan shall NOT be used as a “stand-alone” ESAR response. The contractor shall NOT submit a detailed facility analysis/assessment. The ESAR information will be used to complete an EMSEC Countermeasures Assessment Review of the contractor’s facility to be performed by the government EMSEC authority using current Air Force EMSEC directives. EMSEC is applied on a case-by-case basis and further information may be required to complete the review.

Should this be the case, the contractor shall provide this information to the contracting officer when requested. After the evaluation of the ESAR by the government EMSEC authority, additional EMSEC requirements may be established.

3. ESAR contents shall include, as a minimum, the following information (NISPOM, paragraph 11- 101c) (Note: A copy of your Automated Information System Security Plan(s) (AISSP) will suffice.

a. The specific classification and special categories of material to be processed or handled by electronic means.

b. The specific location where classified processing will be performed.

c. The name, address, title and telephone number of a point-of-contact at the facility where processing will occur.

NOTE: Once the above information has been provided to the CO, no further reporting is required for equipment reconfigurations. However, if the facility is physically relocated to another geographical location, the information requested in paragraph c above MUST be furnished to the CO.

4. The prime contractor shall ensure that all subcontractors and/or vendors comply with EMSEC requirements when performing classified processing related to this contract. They will provide the above documentation through their prime to the contracting officer to complete the ESAR.

ADDENDUM TO DD FORM 254 (Block 10e (1)) Sensitive Compartmented Information (SCI) Clauses FA8214-19-D-XXXX, Expiration Date 4 JUN 2032

Lockheed Martin Space Systems Company, 79272

Reference Block 14

1. This contract requires access to Sensitive Compartmented Information (SCI). Per the National Security Act of 1947, as amended; Executive Order (EO) 12333, as amended; EO 13526; EO 13549; EO 12829; EO 12968, as amended; 32 CFR Part 2001; 32 CFR Part 2003, 32 CFR Part 2004; and other applicable provisions of law; DNI Memorandum ES 2017-00356; DoD Manual 5105.21, Volumes 1 -3; AFMAN 14-304; AFMAN 14-401; Joint DoDISS Cryptologic SCI Information Systems standards (JDSCSISSS); 5220.22-M (NISPOM and Supplement); ICD 701, ICD 702, ICD 703, DCID 6-03 w/ICPM 2006-700-9, ICD 704/ICPGs 704.1.

ICPG 704.2, ICPG 704.3, ICPG 704.4, ICD 710, DCID 6-06, as amended; ICD 705, ICS 705-1; ICD 501 and related NIST/CNSSI guidance for Risk Management Framework, and the ICD 503 Practitioner Manual, (This defines the RMF, Reciprocity, Roles & Responsibilities and each of the 6 steps of RMF), and AFMC SCI Management Guidance provides the necessary guidance for physical, personnel, information, and information systems security measures and is part of the SCI security specifications for the contract.

2. This contract will require __2__ SCI positions in order to fulfill contractual obligations. SCI access is subject to U.S. Government review and approval as outlined in the aforementioned SCI security guidance.

Justification must be identified in the contract Statement of Work (SOW)/Performance Work Statement (PWS). Upon completion or cancellation of the contract, the SSO/CSSO will debrief all personnel not required for contract closeout and those positions will be disestablished.

3. Name, organization, Telephone number and address of the contract Officer Representative (COR) for the SCI portion of this contract is:

Contracting Officer Representative Office Symbol Phone Number Bruce Richman AFNWC/NIAF 801-777-4341

4. All DD Form 254s prepared for subcontracts involving access to SCI under this contract must be forwarded to the COR for approval and then to SSO HILL for review and concurrence prior to award of the subcontract. Inquiries pertaining to classification guidance on SCI will be directed to the COR listed in para. 3 above. SCI security management issues shall be directed to:

SMO: SSO HILL – AFLCMC/INLS Address: 6137 WARDLEIGH ROAD DSN: 777-0484/Comm: 801-777-0484 HILL AFB, UT 84056-5843

5. SCI Access: SCI will not be provided to contractor employees without the specific release approval by the originator of the material as outlined in the governing directives and based on prior approval and certification of “need-to-know” by the Contracting Officer’s Representative (COR). The COR requirements and responsibilities are as follows: 1) COR be Military Member or Government Civilian. 2) Must be SCI indoctrinated. 3) Will establish Billet Position Document (instructions and worksheet template provided by SSO HILL). 4) Will validate each candidate’s need-to-know via the “Nomination Letter” process (instructions and template provided by SSO HILL). 5) If work will be performed in a contractor operated SCIF, the COR will coordinate with SSO HILL to identify a Contractor Special Security Officer (CSSO).

6) If work will be performed in a US Government owned SCI Facility (SCIF), the COR will coordinate with

SSO HILL to identify a Contractor Special Security Representative (CSSR)

a. Names of contractor personnel requiring access to SCI and justification for SCI access will be submitted for coordination and action to SSO HILL after the COR’s approval/concurrence. Upon receipt of written approval from the COR, the Facility Security Officer (FSO) and/or Contractor Special Security Officer (CSSO) may submit the necessary forms to the Defense Security Service (DSS) for a Single Scope Background Investigation (SSBI) for those personnel nominated for SCI in accordance with the National Industrial Security Program Operating Manual (NISPOM).

b. The COR and SSO/CSSO must restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract. Further dissemination to other contractors, sub-contractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the releasing agency.

6. SCI Materials: SCI materials furnished in support of this contract remains the property of the DoD department or command that released it. Upon completion or cancellation of the contract, all SCI materials furnished will be returned to the direct custody of the originator of the materials or the COR.

a. Classified foreign intelligence materials will not be released to foreign nationals or immigrant aliens whether or not they are also consultants, U.S. contractors, or employees of the contractor regardless of the level of their security clearance, except with advance written permission from the originator.

b. Contractor personnel must maintain accountability for all intelligence (to include foreign intelligence) materials released to their custody.

c. Contractor personnel must not reproduce classified foreign intelligence without advance approval of the releasing agency. If permission is granted, each copy will be controlled in the same manner as the original.

The CSSO must not destroy any classified foreign intelligence without advance approval of the releasing agency.

7. SCIF Guidance: A SCIF meeting the physical security requirements in DCID 6/9 or ICD 705 is required for this contracting effort. All SCI used for this contract shall be stored, handled, and maintained in an accredited SCIF.

8. Visits: The contractor will submit the written request for SCI visit certifications through the COR for approval of the visit. The certification must arrive at SSO HILL at least three working days prior to the visit.

9. Electronic Processing: Information assurance and electronic processing; information security (computer) and network connectivity require accreditation of the equipment connectivity.

a. Other networks processing corporate unclassified, SIPRNET, or other collateral information will follow the cognizant authority policy requirements. Prior authorization by a cognizant authority must be obtained before operation. Non-AF SCI systems must be accredited by the designated authority and may require a Co-Use Agreement (CUA) for operation in DIA facilities.

b. Joint Worldwide Intelligence Communication System (JWICS) accounts require NATO – Secret indoctrination reflected in Joint Personnel Adjudication System (JPAS). JWICS access must be coordinated through the AFLCMC/INL Information Systems Security Manager (ISSM) at DSN 777-6833, Comm. 801- 777-6833.

c. For contract work within an approved contractor facility, all SCI information systems will be accredited and authorized following the Risk Management Framework (RMF), IAW ICD 503 and the ICD 503 Practitioners Manual. All SCI systems will be accredited through the XACTA system and HQ AFMC and the Authorizing Official (AO), the 25th AF/A6S (AF Intelligence Community). Other applicable policy as directed by DIA, ODNI, or HQ AFMC shall apply. This includes all electronic connectivity and electronic methods for storing and communicating within and outside the SCIF.

Reference Block 15

1. Inspections: This contract requires access to SCI. If the contractor has established a SCIF, DIA and its designees are responsible for all inspections of the contractor SCIF and SCI security management program for ensuring compliance with all SCI security regulations and policies. If a new SCIF must be established in accordance with this contracting effort, permission to build/accredit a SCIF must be requested through the COR and forwarded to SSO Hill. Special Security Officers (SSOs) reserve the right to conduct program reviews of AF SCI materials and SCI program management to ensure the protection of AF equities.

ADDENDUM TO DD FORM 254 (Block 10e (2)) Non-Sensitive Compartmented Information (SCI) Intelligence Information Clauses

FA8214-19-D-XXXX, Expiration Date 4 JUN 2032 Lockheed Martin Space Systems Company, 79272

Reference Block 14

1. Special Requirements of Intelligence Information: The contractor will require access to, and receipt of, classified intelligence documents in the performance of this contract. In addition to the requirements and controls for classified material in DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), the contractor shall adhere to the National Security Act of 1947, as amended; Executive Order (EO) 12333, as amended; EO 13526; EO 13549; EO 12829; EO 12968, as amended; 32 CFR Part 2001; 32 CFR Part 2003, 32 CFR Part 2004; and other applicable provisions of law; ICD 501; ICD 703; ICD 710;

DCID 6/6 and AFMAN 14-304.

2. Name, organization, Telephone number and address of the contract Officer Representative (COR):

Contracting Officer Representative Office Symbol Phone Number Bruce Richman AFNWC/NIAF 801-777-4341

3. Intelligence Information Access:

a. Contractor shall restrict access to those individuals with a valid need-to-know who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, or other government agencies and private individuals or organizations is prohibited unless authorized in writing by the COR with prior approval of SSO HILL.

b. Contractor shall not release intelligence data to foreign nationals or immigrant aliens regardless of their security clearance or contract status without advanced written permission from the COR, SSO HILL, Foreign Disclosure Policy Office, and HQ AFMC/A2S.

c. Contractor shall ensure the each employee having access to intelligence material is fully aware of the special security requirements for this material and maintains records in a manner that permits the contractor to furnish on demand the names of individuals who have access to the material in their custody.

d. Contractor shall restrict access to those individuals with a valid need-to-know who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, or other government agencies and private individuals or organizations is prohibited unless authorized in writing by the COR with prior approval of SSO HILL.

4. Intelligence Information Materials:

a. Contact SSO HILL for permission to make extra copies of intelligence data required by the contractor if approval has not previously been stipulated above, or been stipulated in the release letter. The COR then maintains accountability of copies and ensures all information is returned to the Air Force upon contract termination/expiration.

SMO: SSO HILL – AFLCMC/INLS Address: 6137 WARDLEIGH ROAD DSN: 777-0484/Comm: 801-777-0484 HILL AFB, UT 84056-5843

b. Maintain a record of all intelligence materials released to the contractor, and ensures all data is returned to the COR within 2 years after final delivery of goods and services or after completion or termination of the classified contract, whichever comes first. If retention is required beyond the 2 year period the contractor must request and receive written authority from the COR in the form of a signed Final DD FM 254/Contract Security Classification Specification identifying the period of retention and disposition instructions for the intelligence materials, once the specified period of retention ends.

c. Contractor shall maintain accountability for all intelligence released in his/her custody. Contractors must agree that all intelligence data released to them, all reproductions, and other material generated (including authorized reproductions) is the property of the US Government and will be returned upon request of the sponsoring agency or expiration date of the contract, whichever comes first.

d. Contractor shall not reproduce intelligence without permission from SSO HILL through the COR. If approved, must control each copy in the same manner as the original.

e. Contractor shall not reproduce intelligence without advance approval from the COR, except for working papers and derivative material produced in the publication process. Working papers and derivative material produced in the publication process do not need destruction approval.

5. Electronic Processing: Information assurance and electronic processing; information security (computer) and network connectivity require accreditation of the equipment connectivity. Networks processing corporate unclassified and/or other collateral information will follow the cognizant authority policy requirements. Prior authorization by a cognizant authority must be obtained before operation.

OPERATIONS SECURITY (OPSEC)

DD FORM 254 ADDENDUM OPSEC

Contract # FA8214-19-D-XXXX

All contractors, subcontractors, their employees, associates, and consultants who have access to critical information must comply with the Air Force-sponsored Operations Security (OPSEC) program.

OPSEC is a systematic means of identifying and protecting information which an adversary could use to their advantage or to our disadvantage. Critical Information (CI) is generally unclassified but sensitive information which has been identified by the OPSEC program as requiring protection.

OPSEC Measures (OM) are control standards with which all personnel must comply in order to protect critical information.

Responsibilities:

AFNWC/NI must provide / approve OPSEC training curriculum for use by the contractor.

Training must provide listings of critical information that must be protected by all personnel, listings of OPSEC measures which must be used by all personnel to protect critical information, and current foreign intelligence and industrial espionage threats. The contractor must ensure all personnel working on the contract or having access to critical information attend initial and annually recurring refresher training and that the approved curriculum is presented. Training must be provided before personnel are allowed access to critical information. All personnel must comply with OPSEC standards and practices as trained.

Additional training may be required based on updates to critical information, OPSEC measures, intelligence threat, or other fundamental changes to the OPSEC program.

The contractor must track OPSEC training statistics to include the personnel working on the contract, when each individual received the required OPSEC training, and when refresher training is due.

Training statistics must be forwarded to Brent Molnar, AFNWC/NIOS, brent.molnar.1@us.af.mil, 777-8772; at the end of each calendar quarter and upon request.

Prior to seeking approval through Hill AFB Public Affairs, any information to be released outside of official U.S. Government channels, via any media, must be approved through an OPSEC review by Brent Molnar, AFNWC/NIOS. All personnel must promptly report OPSEC related incidents, issues, and concerns to Brent Molnar, AFNWC/NIOS, brent.molnar.1@us.af.mil, 777-8772.

Prime Contract or Solicitation #: FA8214-19-D-XXXX mailto:brent.molnar.1@us.af.mil mailto:brent.molnar.1@us.af.mil

AFFARS 5352.204-9000, NOTIFICATION OF GOVERNMENT SECURITY ACTIVITY

AND VISITOR GROUP SECURITY AGREEMENTS (APR 2003) ADDENDUM

1. This contract contains a DD-Form 254, DOD Contract Security Classification Specification, and requires performance at a government location in the U.S. or overseas. Prior to beginning operations involving classified information on an installation identified on the DD Form 254, the contractor shall take the following actions:

a. At least 30 days prior to beginning operations, notify the Cognizant Security Office/s (IP Office/s) shown in block 8.c and Program Manager shown in block 13 of the DD Form 254 as to:

(1) The name, address, and telephone number of this contract company’s representative and designated alternate in the U.S. or overseas area, as appropriate;

(2) The contract number;

(3) The highest classification category of defense information to which contractor employees will have access;

(4) The Air Force installations in the U.S. (in overseas areas, identify only the APO number(s)) where the contract work will be performed;

(5) The date contractor operations will begin on base in the U.S. or in the overseas area;

(6) The estimated completion date of operations on base in the U.S. or in the overseas area; and,

(7) Any changes to information previously provided under this clause.

This requirement is in addition to visit request procedures contained in DOD 5220.22-M, National Industrial Security Program Operating Manual.

b. Prior to beginning operations involving classified information on an installation identified on the DD Form 254 where the contractor is not required to have a cleared facility, the contractor shall enter into a Visitor Group Security Agreement (or understanding) with the installation commander to ensure that the contractor’s security procedures are properly integrated with those of the installation. As a minimum, the agreement shall identify the security actions that will be performed:

1. By the installation for the contractor, such as providing storage and classified reproduction facilities, guard services, security forms, security inspections under DOD 5220.22-M, classified mail services, security badges, visitor control, and investigating security incidents;

and

2. Jointly by the contractor and the installation, such as packaging and addressing classified transmittals, security checks, internal security controls, and implementing emergency procedures to protect classified material.