FA8771-16-R-0023_Attachment_8_-_Security_Requirements_for_Classified_Services__(3_Jun_2016).pdf

SECURITY REQUIREMENTS FOR CLASSIFIED SERVICES (3 Jun 2016)

1 Security Facility Clearance Requirements: The contract company must possess or obtain an appropriate facility security clearance as identified in the contract perform work on a classified government contract. If the contractor does not possess a facility clearance the government will request one. The contractor shall notify the 42d Security Forces Squadron, Plans and Programs Flight, Information Protection (42 SFS/S5X/IP) before on-base performance of the service. The notification shall include:

The Facility Clearance for this contract is:

Select One

( X ) Top Secret

( ) Secret

a. Name, address, and telephone number of company representatives.

b. The contract number and contracting agency.

c. The highest level of classified information which contractor employees require access to.

d. The location(s) of service performance and future performance, if known.

e. The date service performance begins.

f. Any change to information previously provided under this paragraph.

2 Personnel Security Clearance Requirements: Some or all of the personnel performing work on this contract will require a security clearance as identified below.

(X) Top Secret ( Minimum of 2 Technical Personnel)

(X) Secret

The contractor shall request security clearances for personnel requiring access to classified information within 15 business days after receiving a facility clearance or, if the contractor is already cleared, within 15 business days after service award. Due to costs involved with security investigations, contractor security clearances shall be kept to an absolute minimum necessary to perform service requirements.

3 Security Manager Appointment: The contractor shall appoint a security manager for the on base long-term visitor group. The security manager may be a full-time position or an additional duty position. The security manager shall provide contractor employees with training required by DoDM 5200.01, Volume 3, Enclosure 5, DoD Information Security Program, and AFI 16-1404, Air Force Information Security Program. The contractor security manager shall provide initial and follow-on training to contractor personnel who work in Air

Force controlled or restricted areas. Air Force restricted and controlled areas are explained in AFI 31-101, Air Force Integrated Defense Plan.

4 Visit Request: Contractors participating in the National Industrial Security Program are authorized to use Joint Personnel Adjudication System (JPAS) in lieu of sending Visitor Authorization Letters (VALs) for classified visits to Department of Defense facilities and military installations. VALs are only required if the contractor isn’t using JPAS or if contractor personnel whom access level and affiliation are not accurately reflected in JPAS. However, some agencies may still require VALs to be submitted for access to their facilities. AFLCMC Gunter SMO Code is MG1MFD3Q6 for visit requests to Gunter.

5 Obtaining and Retrieving Identification Media: As prescribed by the AFFAR 5352.242-9000 Contractor Access to Air Force Installations, AFFAR 5352.242-9001, Common Access Cards (CAC) for Contractor Personnel, and FAR 52.204-9, Personal Identity Verification of Contractor Personnel, the contractor must comply with the requirements set forth in these guidance and AFMAN 31-113, Installation Perimeter Access Control. Contractors requesting a CAC for personnel on the contract will submit on company letterhead the names and all other personnel information as prescribed by the contracting officer to begin the identification processing effort. Contracting officers will follow installation specific guidance regarding the issuance and recovery of all identification media issued to the contractors by the government. Government ID card holders may not use their credentials to sponsor an individual on to the base to perform work that’s been contracted to an official contractor.

When work under this contract requires unescorted entry to controlled or restricted areas, the contractor shall comply with AFI 31-101, Integrated Defense, and AFI 31-501, Personnel Security Program Management.

Failure to return all government issued identification upon termination of contract or service, termination of employees, or expiration of the identification may result in withholding of final payment.

6. Pass and Identification Items: The contractor shall ensure the following pass and identification items as required for contract performance are obtained for employees:

6.1 DoD Common Access Card (AFI 36-3026). For contractors who require a CAC, contractors shall provide a listing of personnel who require a CAC to the contracting officer. The government will provide the contractor instruction on how to complete the Trusted Associate Sponsorship Systems (TASS) application and then notify the contractor when approved. Contractor personnel shall obtain a CAC from the nearest Real Time Automated Personnel Identification Documentation System (RAPIDS) Issuing Facility (typically the local Military Personnel Flight (MPF)). While visiting or performing work on installation(s)/location(s), contractor personnel shall wear or prominently display the CAC as required by the governing local policy.

6.2 Entry Procedures for AFLCMC Gunter Facilities: Contractor employees require an AFLCMC BES Gunter Access Badge for unescorted entry into AFLCMC BES Gunter facilities. To obtain an AFLCMC Gunter Access Badge contractor personnel must be in JPAS or have a VAL on file with AFLCMC Gunter Security Office. Contractors requiring an access badge will bring a completed AF Form 2586, Unescorted Entry Authorization Certificate to the AFLCMC Gunter Security Office Room 240 B, Bldg.

892. The AF Form 2586 must include in Section III the task order number, period of performance, facility number and be signed by the Contracting Officer Representative (COR) associated with the assigned contract. Contractor personnel are required to wear their company’s identification badge and the AFLCMC Gunter badge AT ALL TIMES while in AFLCMC Gunter facilities. The access badges will be displayed on the outer garment between the shoulder and the waist. Every time a period of performance is executed this paperwork must be re-accomplished to reflect the new expiration date.

6.3. All commercial vehicles will be directed to Gate 3 (Kelly St) or Gate 4 (Congressman Dickenson for Gunter) for processing through the Commercial Vehicle Inspection (CVI) Area, when operational. During non-duty hours and holidays, commercial vehicle inspections will be conducted at Gate 1 (Maxwell Blvd) or Gate 4 only. Inspection members will conduct thorough inspections of the interior and exterior of the vehicle for items prohibited from the installation such as explosive devices, weapons and ammunition, drugs, and open or closed alcohol containers.

7. Computer and Network Access Requirements: Contractor personnel that require access to classified government computers and operations systems (Automated Information Systems – AIS) will be designated as either:

AIS-I Position - Critical-Sensitive Positions. Security Clearance: TOP SECRET based on a Tier 5 background investigation. Responsible for the planning, direction, and implementation of a computer security program; major responsibility for the direction, planning and design of a computer system, including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain.

AIS-II Position - Noncritical-Sensitive Positions. Security Clearance: SECRET based on a Tier 3 background investigation. Responsibility for systems design, operation, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the AIS-I category, includes, but is not limited to; access to and/or processing of proprietary data, information requiring protection under the Privacy Act of 18 1974, and Government-developed privileged information involving the award of contracts.

AIS-III Position - Nonsensitive Positions. No security clearance required. Contractor personnel that require access to unclassified government computers and operations systems will be designated as Trusted Position based on a favorable Tier 1 background investigation. Applies to all other positions involved in U.S. Government computer activities.

Contractor personnel must submit a clearance and must be favorably adjudicated before operating government furnished computer workstations or systems that have access to

Air Force e-mail systems. These investigations shall be submitted by the government at no additional cost to the contractor. NOTE: Since the clearance process can take up to 18 months, contractor personnel may be issued a CAC before the process is completed after a favorable fingerprint return (3-5 working days).The contractor shall comply with the DoD 5200.2-R, DoD Personnel Security Program, AFI 31-501, Personnel Security Program Management and AFI 33-119, Air Force Messaging, and Homeland Security Presidential Directive-12, requirements.

8. Visitor Group Security Agreement (VGSA): The contractor shall enter into a long-term visitor group security agreement for contract performance on base. This agreement shall outline how the contractor integrates security requirements for contract operations with the Air Force to ensure effective and economical operation on the installation. The agreement shall include:

Security support provided by the Air Force to the contractor shall include storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, base visitor control, investigation of security incidents, base traffic regulations and the use of security forms and conducting inspections required by DoD 5220.22-R, Industrial Security Regulation, Air Force Instruction 16-1406, Air Force Industrial Security Program, DoDM 5200.01, volumes 1-4, DoD Information Security Program, and AFI 16-1404, Air Force Information Security Program.

Security support requiring joint Air Force and contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks and internal security controls for protection of classified material and high-value pilferable property.

On base, the long-term visitor group security agreement may take the place of a Standard Practice Procedure (SPP).

9. Information Security: Contractors performing duties associated with this contract must adhere to all the standards for protecting classified information as specified in DoDM 5200.01, volumes 1-4, DoD Information Security Program, Air Force Instruction AFI 16-1404, Air Force Information Security Program and all applicable supplements and operating instructions.

10. Unescorted Entry to Secure Rooms: Contractor personnel requiring unescorted entry to secure rooms designated by the installation commander shall comply with base access requirements and these additional security instructions; DoD 5200.2-R, DoD Personnel Security Program AFI 31-101, Air Force Integrated Defense Plan, and AFI 31-501, Personnel Security Program Management, as applicable. Contractor personnel shall be the subject of a favorably adjudicated Tier 3 investigation to qualify for unescorted entry to a secure room. Contractor personnel must contact their Contracting Officer Representative and the appropriate secure room monitor for permission. AFLCMC

Gunter Security Office, Bldg. 892, Room 240 B/C can assist and provide technical guidance as necessary.

11. SIPRNet Access: Contractors must have a current Secret security clearance and complete Derivative Classification and Marking Classified Information training. The Derivative Classification course #IF103.16 and Marking Classified Information course #IF 105.16 are available at the Defense Security Service, Center for Develop of Security Excellence, Security Education Training, Education, and Professionalization Portal at http://www.cdse.edu/stepp/index.html . Training certificate(s) must be provided to the unit security manager prior to granting access to the SIPRNet. Derivative Classification training must be completed every two years. Once the Initial course is completed members can complete the refresher training to maintain SIPRNet access.

12. Freedom of Information Act Program (FOIA): The contractor shall comply with DoD Regulation 5400.7-R/Air Force Supplement, DoD Freedom of Information Act Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding For Official Use Only (FOUO) material. The contractor shall comply with AFI 33-332, Air Force Privacy Act Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, section 8013. The contractor shall maintain records in accordance Air Force manual (AFMAN) 33-363, Management of Records; and disposed of in accordance with Air Force Records Information Management System (AFRIMS) Records Disposition Schedule (RDS) located at https://www.my.af.mil/gcss-af61a/afrims/afrims/.

13. Reporting Requirements: The contractor shall comply with AFI 71-101, Volume-1, Criminal Investigations, and Volume-2, Protective Service Matters, requirements.

Contractor personnel shall report to 42d Air Base Wing Information Protection Office, and AFLCMC Gunter Security Office, any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information. Contractor employees shall be briefed by their immediate supervisor upon initial on-base assignment and as required thereafter.

14. Physical Security: All AFLCMC Gunter contractor employees shall comply with base operations plans/instructions for FPCON procedures, Random Antiterrorism Measures (RAMS) OPSEC and local search/identification requirements. The contractor shall safeguard all government property, including controlled forms, provided for contractor use. At the close of each work period, government equipment, facilities other valuable materials shall be secured.

15. Wireless Electronic Devices: No cell phones, camera cell phones, cordless telephones, or wireless microphones, keyboards, or mice, wireless or Infrared Local Area Networks (LANs), or devices are allowed in areas where classified information is discussed, briefed, or processed. “Area” refers to a room and/or to a space the size of a 3-meter radius sphere, centering on the classified source. In areas where classified information is discussed, briefed, or processed, wireless pointer/ mice devices are allowed for presentations only. This is an acceptable EMSEC risk. All other Personal Electronic Devices, PEDs. All other wireless PEDs not specifically addressed above, that are used for storing, and processing, and/or transmitting information shall not be operated in areas where classified information is electronically stored, processed, or transmitted.

The contractor will not establish their own Information Technology (IT) systems or networks (Local Area Networks [LAN], Wide Area Network [WAN], Cellular phone/USB Modem as WAN, Wi-Fi as WAN, etc.), or camera system without the direct permission of the Program Manager and governing communications and responsible information systems office (42 CS).

16. Internal Operating Instructions: The contractor will adhere to the all Air Force activity Operating Instructions (OI) for internal circulation control, protection of resources and to regulate entry into Air Force controlled areas during normal, simulated and actual emergency operations to include local written OIs.

17. Government Authorization: The contractor shall ensure its employees do not allow government issued keys to be used by personnel other than current authorized contractor employees. Contractor employees shall not use keys to open work areas for personnel other than contractor employees engaged in performance of their duties, unless authorized by the government functional area chief.

18. Access Lock Combinations: All access lock combinations are “For Official Use Only” and will be protected from unauthorized personnel. The contractor will adhere to the Air Force activity operating instruction (OI) for ensuring lock combinations are not revealed to unauthorized persons and ensure the procedures are implemented. The contractor is not authorized to record lock combinations without written approval by the government functional director.

19. Security Combinations: Combinations to security containers, secure rooms, or vaults are controlled unclassified information and must be properly safeguarded. Only contractor employees, who have the proper security clearance and the need-to-know, will be given combinations to security containers, secure rooms, or vaults. Contractor employees are responsible for properly safeguarding combinations. Contractor employees will not record security containers, secure rooms, or vaults combinations without written approval by the government functional director. Contractors will not change combinations to security containers, secure rooms, or vaults without written approval by the government functional director.

20. Security Alarm Access Codes: Security alarm access codes are “For Official Use Only” and will be protected from unauthorized personnel. Security alarm access codes will be given contractors employees who required entry into areas with security alarms.

Contractor employees will adhere to the Air Force activity operating instructions and will properly safeguard alarm access codes to prevent unauthorized disclosure. Contractor will not record alarm access codes without written approval by the government functional director.

21. Traffic Laws: The contractor and their employees shall comply with base traffic regulations set forth in AFI 31-218, Motor Vehicle Traffic Supervision and AFMAN 31- 113, Installation Perimeter Access Control. Personnel in violation may be issued a Central Violations Bureau Form 1805 traffic ticket.

22. Random Installation Entry/Exit Checks: Entry/exit vehicle checks are conducted by order of the 42 ABW Commander. These checks are conducted for the purpose of safeguarding the base and protecting government property by discovering and seizing stolen property, classified information and contraband. Refusal to submit to an installation (entry/exit) vehicle check may result in the loss of base driving privileges, revocation of base registration, or debarment action.

23. Cellular Phone Operation Policy: The use of cellular phones while operating a motorized vehicle is prohibited on Maxwell-Gunter. Although discouraged, drivers are authorized to use devices, i.e. ear bud or ear boom, which allows their cellular phone to be operated hands-free. The device must not cover both ears. This policy applies to everyone driving on Maxwell-Gunter AFB. Personnel in violation may be issued a Central Violations Bureau Form 1805 traffic ticket.

24. Security Education and Training: The contractor is required to participate in the government’s security training program under the terms of the contract. The government will provide the contractor with access to the on-line system. Contractor personnel will complete Protecting Sensitive Information (formerly Security Administration), DoD IAA Cyber Awareness Challenge and Force Protection computer base training and other security related training as directed at the ADLS web site.

25. Operation Security (OPSEC). The contractor will comply with installation and organizational OPSEC requirements in accordance with AFI 10-701 and applicable supplements. They will also receive a local threat briefing.

26. Weapons:

26.1 Firearm and Ammunition: Transporting weapons or ammunition, concealed or otherwise, IS NOT permitted by any non-law enforcement personnel on Maxwell AFB/Gunter Annex at any time regardless of state issued concealed weapons permits.

Violations may result in criminal prosecution under the applicable federal laws.

26.2 Illegal Weapons: The below weapons are considered illegal, unless specifically authorized by competent authority, and are prohibited on Maxwell AFB/Gunter Annex. Violations may result in criminal prosecution under the applicable federal laws.

Switchblade knives or knives with any type of automatic blade release.

An incendiary/explosive weapon (e.g., grenades, flash bangs).

Fireworks.

Homemade mortars, aka "tennis ball launchers" or similar devices.