4B Attachment 2 DD254 SAP and SCI Addenda 20 December 2019.pdf

DD‐FORM 254 SAP ADDENDUM

Contract Number: _______________________

This addendum must be filled out and attached to each DD Form 254 that requires SAP access. Also, blocks 14 and 15 must state “see attached SAP addendum.

1. Requirements for access to SAP:

a. (U) For SAP efforts the contractor shall comply with DoD Manual 5205.07, Volumes 1 ‐ 4 (latest versions), AF Policy Directive (AFPD 16‐7, Special Access Programs, AF Instructions (AFI) 16‐701, Management Administration and Oversight of Special Access Programs, and the SAF/AAZ Memorandum, Implementation of DoD Manual 5205.07 .Volumes 1‐4 (dated 04 April 2016).

b. (U) Defense Security Service (DSS) has been relieved of inspection oversight responsibilities for SAP programs associated with this contract. The Air Force is identified as the Cognizant Security Authority (CSA) with the Air Force Office of Special Investigations (AFOSI), Office of Special Projects (PJ), fulfilling the execution role for all contractor inspections under the purview of SAF/AAZ.

c. (U) Any conflict and/or issue regarding SAP classification guidance will be protected at the highest level until the conflict or issue is resolved by AFOSI/PJ Program Security Officer (PSO). Written resolution and/or direction will be provided by the PSO.

d. (U) All subcontract DD254s with block 10f (Special Access Information checked YES must be signed by an AFOSI PJ PSO, per AFI 16‐701, section 2.20.8. This requirement may not be waived by the Government Contracting Officer or Government Program Manager.

2. Contract estimated completion date: TBD Period of Performance (Base): TBD

SMC/INS SSO DD FORM 254 SCI ADDENDUM

Contract Number: ___________________________

This addendum must be filled out and attached to each DD Form 254 that requires SCI access. Also, blocks 14 and 15 must state “see attached SCI addendum V4.0”

1. Reference Block 14. This contract requires access to Sensitive Compartmented Information (SCI. The following orders/directives/manuals/instructions provide the necessary guidance for physical, personnel, information and information systems security measures and is part of the SCI security specification for the contract.

Executive Order 12333 – United States Intelligence Activities (AMMENDED by EO 13470, 2008 Executive Order 13526 – Classified National Security Information (29 Dec 09 {replaced EO 12958} ICD 503 ‐ Information Systems ICD and ICPGs 704 ‐ Personnel Security ICD and ICS/Tech Specs 705 ‐ Physical Security DCID 1/20P – Security Policy Concerning Travel and Assignment of Personnel with Access to SCI DCID 6/1 – Security Policy for Sensitive Compartmented Information and Security Policy DCID 6/9 ‐ Physical Security (for facilities accredited under 6/9 standards DoDM 5105.21 V1, V2, V3 ‐ SCI Administrative Security Manual(s DoDM 5200.01 V1, V2, V3, V4 – DoD Information Security DoDM 5200.02 ‐ Procedures for the DoD Personnel Security Program (PSP DoDM 5220.22 Volume 2 – National Industrial Security Program (NISP AFMAN 14‐304 ‐ Security, Use and Dissemination of SCI AFMAN 16‐1405 – Air Force Personnel Security Program AFI 16‐1404 – Air Force Information Security Program AFI 16‐1406 – Air Force Industrial Security Program SMC/IN SSO Handbook DIAM 50‐4 ‐ Defense Intelligence Agency Manual NISPOM Supplement NIST 800‐53 Rev 4

2. The COR must be a Government employee (military or civilian who is appropriately cleared and SCI indoctrinated for all accesses required by the contract in order to verify the SCI contract deliverables and validate need‐to‐know. An alternate COR should be appointed to assist the COR whenever the primary COR is not available. Contact information of the Contract Officer Representative (COR for the SCI portion of this contract:

Primary COR Alternate COR Name: TBD Name: TBD Org: : TBD Org: TBD Telephone: 310‐653‐XXX Telephone: 310‐653‐XXX Address: 483 N. Aviation Blvd

El Segundo, CA 90245 Address: 483 N. Aviation Blvd El Segundo, CA 90245

E‐Mail: XXX.XX@us.af.mil E‐mail: XXX.XX@us.af.mil

3. All DD Form 254s prepared for subcontracts involving access to SCI under this contract must be forwarded to the COR for approval and then to SMC/INS SSO for review and concurrence prior to award of the subcontract. Inquiries pertaining to classification guidance on SCI will be directed to the COR

Contract Number: ___________________________ listed in paragraph 2 above. SMC/INS SSO is designated as the User Agency SSO for SCI requirements.

SCI security management issues shall be directed to:

SMC/INS SSO

483. N. Aviation Blvd.

El Segundo, CA 90245

310‐653‐4351/4122, DSN 633‐4351/4122

Unclassified e‐mail: smc.ins.sso@us.af.mil JWICS e‐mail: SMC_INS_SSO@af.ic.gov

4. SCI access is subject to U.S. Government review and approval as outlined in the aforementioned SCI security guidance. Upon completion or cancellation of the contract, the SSO/CSSO will debrief all personnel not required for contract closeout and those positions will be disestablished.

5. All incidents affecting personnel, SCIFs, equipment, and material under SMC SSO cognizance will be reported to the SSO within 24 hours of incident discovery, to include Classified Message Incidents (CMIs) and adverse information of SCI indoctrinated personnel. The company will notify the SSO on the first duty day if the incident occurs on a weekend or holiday. In addition to policy, principles of risk management and risk based analysis are applied to incidents by the Senior Intelligence Officer (SIO) and

Special Security Officer (SSO), which may include interim action to locally suspend access to SCI pending final resolution.

6. Names of contractor personnel requiring access to SCI and justification for SCI access will be submitted for coordination and action to SMC/INS SSO after the COR’s approval/concurrence. Upon receipt of written approval from the COR, the Facility Security Officer (FSO) and/or Contractor Special

Security Officer (CSSO) may submit the necessary forms to the Defense Security Service (DSS) for a

Single Scope Background Investigation (SSBI) or Tier 5 or 5R for those personnel nominated for SCI in accordance with the National Industrial Security Program Operating Manual (NISPOM).

7. The SSO/CSSO can grant access to only those who possess the necessary security clearance and who are actually providing services under the contract. Further dissemination to other contractors, sub‐ contractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the releasing agency.

8. SCI materials furnished in support of this contract remains the property of the DoD department or command that released it. Upon completion or cancellation of the contract, all SCI materials furnished will be returned to the direct custody of the originator of the materials. The information management system employed by the contractor shall be capable of facilitating such retrieval and disposition in an expeditious manner.

9. Classified foreign intelligence materials must not be released to foreign nationals or immigrant aliens whether or not they are also consultants, U.S. contractors, or employees of the contractor regardless of the level of their security clearance, except with advance written permission from the originator.

10. Contractor personnel must maintain accountability for all intelligence (to include foreign intelligence) materials released to their custody.

Contract Number: ___________________________

11. Contractor personnel must not reproduce classified foreign intelligence without advance approval of the releasing agency. If permission is granted, each copy will be controlled in the same manner as the original. The CSSO must not destroy any classified foreign intelligence without advance approval of the releasing agency.

12. A SCIF meeting the physical security requirements in ICD 705 (or DCID 6/9 for facilities accredited before 26 May 2010) is required for this contracting effort. All SCI used for this contract shall be stored, handled, and maintained in an accredited SCIF, be it the local contractor SCIF or similarly SCI accredited facilities used by the contractor. Address of the SCIF for contract execution (if there are multiple facilities please list them in Block 8 of the DD254, or attachment, with the following information):

12.1. (FOUO)

Office Symbol and Company Name: TBD Street Address (to include bldg. #):TBD City, State, Zip Code: TBD

12.2. Contact information for FSO/CSSO:

Primary FSO/CSSO Alternate FSO/CSSO Name: TBD Name: TBD Telephone: TBD Telephone: TBD E‐Mail: TBD E‐mail: TBD

13. Visits. The contractor will submit the written request for SCI visit certifications through the COR for approval of the visit. The certification must arrive at their servicing SSO (SMC/INS SSO) at least five business days prior to the visit.

14. Information assurance and electronic processing; information security (computer) and network connectivity require accreditation of the equipment connectivity. If JWICS accounts are required, it must be identified in Block 11m. (JWICS must be stated, not just a blanket statement of access to government AISs). If JWICS connectivity at a contractor site is required, the statement of work or statement of objectives must specify a continual ongoing requirement for access that cannot utilize other means of information transmission or exchange, and it must be annotated in Block 11m of the

DD254.

15. Reference Block 15. This contract requires access to SCI. If the Contractor has established a SCIF, DIA and its designees are responsible for all inspections of the contractor SCIF and SCI security management program for ensuring compliance with all SCI security regulations and policies. SMC/INS SSO is designated as the inspection authority for SCI security requirements; Defense Security Service is relieved of SCI inspection responsibilities. If a new SCIF must be established in accordance with this contracting effort, permission to build/accredit a SCIF must be requested through the COR and forwarded to the SSO. Special Security Officers reserve the right to conduct program reviews of AF SCI materials and SCI program management to ensure the protection of AF equities.

16. Contract estimated completion date: TBD Period of Performance (Base): TBD

Option Years: TBD

Contract Number: ___________________________

**Option years are not valid until executed by the government. For continued SCI access during option years, a current/signed SF 30, or revised 254, must be on file with SMC/INS SSO prior to the expiration of the current Period of Performance**