CAMMO_Notional_DD_254_ver_2_0.pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

TOP SECRET

b. LEVEL OF SAFEGUARDING REQUIRED

TOP SECRET

2. THIS SPECIFICATION IS FOR: (x and complete as applicable) 3. THIS SPECIFICATION IS: (x and complete as applicable)

a. PRIME CONTRACT NUMBER

a. ORIGINAL (Complete date in all cases)

DATE (YYMMDD)

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs)

Revision No. DATE (YYMMDD)

c. SOLICITATION OR OTHER NUMBER

FA8823-13-R-0009

DUE DATE (YYMMDD)

c. FINAL (Complete Item 5 in all cases)

DATE (YYMMDD)

4. THIS IS A FOLLOW-ON CONTRACT? YES NO. If Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes, complete the following:

In response to the contractor’s request dated , retention of the identified classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

TBD

b. CAGE CODE

c. .COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip code)

8. ACTUAL PERFORMANCE

a. LOCATION

Multiple Locations. See Attachment 1

c. COGNIZANT SECURITY OFFICE(Name, Address, and Zip Code)

See Attachment 1 Special Access Programs (SAP): See Attachment X

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

This contract will provide organizational and depot maintenance, space operations, sustainment, systems engineering, and support of the Air Force Satellite Control Network (AFSCN) and NRO Operational Missions. It encompasses but is not limited to: hardware maintenance, software releases, technical documentation, system administration, information assurance, special studies, data collection and anomaly responses.

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR’S

FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE TEMPEST REQUIREMENTS

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify) APPLY GENERAL SECURITY PRINCIPLES AS DIRECTED IN

BASIC DOD AND AIR FORCE PUBLICATIONS AS LISTED IN THE ATTACCMENT

k. OTHER (Specify)

DD FORM 254 Front For Official Use Only

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the iNISPOM or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release

Direct Through (Specify):

SMC/RN SMC/PA Public Affairs 483 North Aviation Blvd, LAAFB and 483 North Aviation Blvd, LAAFB El Segundo, CA 90245-2808 El Segundo, CA 90245 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

The following document with subsequent revision or changes will be used for specific security guidance on this contract: National Industrial Security Program Operating Manual (NISPOM) (DoD 5220.22M). Supersession of these documents by more current guidance will be forwarded to the contractor with the same level of compliance required from the date of implementation.

The contractor shall protect critical program information, technologies, and systems (CPI), as identified and supplied by the program office’s Program Protection Plan (PPP). The prime contractor shall develop a Program Protection Implementation Plan (PPIP) from the PPP and, approved by Range and Network Division to implement the protection of the identified CPI. The prime contractor will flow-down applicable CPI to all subcontractor with protection requirements as identified in its PPIP. Additionally, classified national security information, special access and unclassified controlled information as prescribed in applicable security classification guides will be protected as outlined in the NISPOM.

All Information systems which processes government information (classified and unclassified) for transmission over the internet must be adequately protected to comply with Air Force computer security policies in order to receive the appropriate government DAA interim and final accreditation. Contractor employees and subcontractors who have access to AF networks must submit to a National Agency Check and/or security clearance.

Unescorted entry to these resources may require the contractor’s employees be granted at least a SECRET security clearance. Requests for security clearances and investigations will be submitted IAW NISPOM directives.

At this time ## SCI billets are required to support this contract, however, additional billets may be required as deemed necessary.

Additional specific security requirements as identified in blocks 10 and 11 are located in attachments.

Vernal R. Bitton, GS-12, DAF Ronnie E. Cosier Matthew J. Brimhall Acquisition Systems Protection Manager Industrial Security Officer Asst Special Security Officer SMC/RNE, Los Angeles AFB , CA SMC/ENP, Los Angeles AFB, CA SMC/INS, Los Angeles AFB, CA

Project Officer: Mr. James Hasling, GS-13, DAF Estimated Completion of Contract: ## MMM #### Additional specific security requirements as identified in blocks 10 and 11 are located in the following attachments.

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to NISPOM requirements, are established for this contract. (If Yes, identify the Yes No pertinent contractual clauses in the contract document itself, or provide any appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

For additional requirements see attachments.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific Yes No areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

DSS is relieved of Industrial Security oversight and inspection responsibilities on government installations. Contractor personnel providing Direct Support to this contract who are permanently assigned to an Air Force Installation will abide by the provisions set forth in the Visitor Group Security Agreement (VGSA) and cooperate under the local security authority’s oversight.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

d. TITLE

Procuring Contracting Officer

e. TELEPHONE (Include Area Code)

f. ADDRESS (Include Zip Code)

SMC/PKL

1050 E. Stewart Ave Peterson AFB, CO. 80914

17. REQUIRED DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINSTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY: SMC/RNE, SNC/RNL SMC/ENP

e. SIGNATURE

DD FORM 254 Front For Official Use Only

Continuation of DD Form 254 Contract Solicitation No. FA8823-13-R-0009 P a g e | 3 o f 1 2

For Official Use Only

Attachments to

Solicitation No.: FA8823-13-R-0009

Contract Security Classification Specification (DD Form 254)

For

CONSOLIDATED AIR FORCE SATELLLITE

CONTROL NETWORK (AFSCN)

MODIFICATIONS, MAINTENANCE,

AND OPERATIONS

(CAMMO)

DATE:

## Month 2015

Contract Solicitation No. FA8823-13-R-0009 P a g e | 4 o f 1 2

Reference Block 8a: Actual Performance Locations follows:

Location Cognizant Security Office

CLEARANCE

REQUIRED

Number of TS/SCI Billets

50 SW, Schriever AFB (SAFB), CO 50 SFS/SFAD

50 SW OSS/INS

TS/SCI To Be Supplied by Offeror’s

(TBS)

21 SOPS, Vandenberg AFB (VAFB), CA 30 SFS/SFAC Secret TBS

21 SOPS, Vandenberg Tracking Station

(VTS), CA

30 SFS/SFAC Secret TBS

21 SOPS, Det 1, Diego Garcia Tracking Station (DGS) Diego Garcia, British Indian Ocean Territories (BIOT)

50 SFS/SFAD TS/SCI TBS

21 SOPS, Det 2, Guam Tracking Station (GTS) Anderson AFB, Guam

50 SFS/SFAD TS/SCI TBS

21 SOPS, Det 3, Hawaii Tracking Station (HTS), Oahu, HI

50 SFS/SFAD TS/SCI TBS

23 SOPS, New Boston Air Force Station

(NBAFS), NH

50 SFS/SFAD TS/SCI TBS

23 SOPS, Det 1, Thule Tracking Station (TTS), Thule Air Base, Greenland

50 SFS/SFAD Secret TBS

23 SOPS, Site B, Eastern Vehicle Checkout Facility (EVCF), Cape Canaveral AFS, FL

45 SFS/SFRC Secret TBS

23 SOPS/OL-A, Oakhanger, Telemetry & Command Station (TCS) Hampshire, United Kingdom

50 SFS/SFAD Secret TBS

Awarded Contractor Name (Cage) Street Address City, State ZIP

Cognizant DSS Office Street Address City, State ZIP

Secret TBS

Contract Solicitation No. FA8823-13-R-0009 P a g e | 5 o f 1 2

Reference Block 10. Contractor will require access to:

Reference Block 10a: Communications Security (COMSEC) Information

In addition to the COMSEC requirements identified in the NISPOM the Contractor shall comply with NSA/CSS Policy Manual 3-16, dated Aug 2005, Air Force Instruction (AFI) 33-201, Volume 1, Communications Security (COMSEC) [if on-base contractor], and Committee on National Security Systems Policy (CNSSP) No. 12, National Information Assurance Policy for U.S. Space Systems used to Support National Security Missions.

For on-base contracts, Prime Contractors must forward requests for COMSEC material/information to the Government COMSEC Custodian through the Contracting Officer.

Access to COMSEC material or information is restricted to U.S. citizens holding final U.S. Government clearances and is not releasable to personnel holding only a reciprocal clearance. All contractor employees who require access to classified COMSEC information in the performance of their contractual duties shall be briefed prior to being granted access. The Government Program Manager shall designate the number of Prime Contractor personnel requiring cryptographic access. The number will be limited to the minimum necessary and will be on a strict need-to-know basis. The contractor shall maintain a record of all COMSEC briefings.

NACSIM/NACSEM documents are not considered COMSEC controlled material.

Prior approval from the Contracting Officer is required in order for a Prime Contractor to grant COMSEC access to a subcontractor.

The Prime Contractor should also notify the National Security Agency (NSA) Central Office of Record (COR) before negotiating or awarding subcontracts.

(For Visitor Groups) Contractor will require access to COMSEC information at the on-base locations listed in item 8a. On-base contractors will not require their own COMSEC account. Access will be controlled by Installation COMSEC accoutale office. On-base contractors will protect COMSEC material IAW directives identified by the installation COMSEC Custodian to include AFI 33-201, Communications Security (COMSEC), Volume 1. Access to COMSEC material by personnel is restricted to U.S. citizens holding final U.S. Government clearances.

Reference Block 10e: Intelligence Information

1. Sensitive Compartmented Information (SCI)

SCI data furnished to or generated by the contractor will require security handling and control beyond those in the National Industrial Security Program Operating Manual (NISPOM). These supplemental instructions will be furnished and or made available to the contractor through the Special Security Representative (SSR) as appointed by the User Agency Special Security Officer (SSO). For additional reference and POC information, see SMC/IN SSO DD Form 254 Addendum at the end of the attachments.

2. Non-SCI

Provisions for the handling of Non-SCI or “Collateral” Intelligence by contractors are governed by Chapter 9, Section 3 of DoD 5220.22-M, the National Industrial Security Program Operating Manual (NISPOM), Feb 2006 incorporating Chg 1, March 28 2013. Particular emphasis is placed on the contractor(s) correctly understanding and heeding intelligence portion markings.

As classified material, collateral intelligence will be afforded the same protections, safeguards and precautions required by any classified material unless special intelligence related handling instructions are additionally imposed. These basic safeguards are found in DoD 5200.1-R, Information Security Program and AFI 31-401, Information Security Program Management. The disclosure or release of intelligence derived information, whether its status is collateral or SCI, is not authorized without the prior consent of SMC/IN.

Reference Block 10f: Special Access Information

Contract Solicitation No. FA8823-13-R-0009 P a g e | 6 o f 1 2

This contract requires access to Special Access Program (SAP) information or material. DSS is relieved of security inspection of any SAP material released to or developed under this contract and held within the Prime Contractor’s Special Access Program Facility (SAPF). Security cognizance for all SAP aspects of this contract belongs to the Government Program Security Office (PSO).

DODD 5205.07, Special Access Program (SAP) Policy, sets the DoD policy for SAP information and AFI 16-701, Special Access Program, specifies specific controls for access to SAP information. Because SAP information requires higher security measures, access must be limited to only those personnel requiring SAP access to perform their contractual obligations. Access to SAP information requires a final U.S. Government Secret (or Top Secret) clearance with a favorable NACLC or PRS (or SSBI/PPR) investigation, an approved SAP nomination, and a signed special access non-disclosure agreement prior to access. The Prime Contractor will establish and maintain an access list of all employees approved for access to SAP portions of the contract. A copy of the list will be furnished to the Government Program Security Officer (PSO). The Contractor will immediately inform PSO of a SAP accessed employee's reassignment to other duties not associated with this contract, to include termination.

SAP information/material will not be released to contractor employees without the establishment of a specific need-to-know and SAP access approval. SAP material concerning this contract will not be disclosed, discussed or released to any individual not employed on this contract without specific written approval of PSO, through the Contracting Officer.

Access to SAP information or material is authorized only at facilities and locations specifically approved by the PSO. All SAP work associated with this contract will be accomplished within a closed area approved for work. SAP information or material will be safeguarded in a manner that provides positive control by SAP accessed personnel only and within facilities approved by PSO.

Requests for interpretation of SAP information/material and its safeguarding requirements or additional classification guidance on SAP portions of this contract will be directed to PSO, through the Contracting Officer.

Upon completion/cancellation of the SAP portion of this contract, the contractor will comply with the provisions of the NISPOM Supplement for disposition of SAP material in their custody or call Contracting Officer for direction.

For additional instructions and POC information, see AFSPC/A8Z DD Form 254 SAP Addendum at the end of the attachments.

Reference Block 10h: Foreign Government Information

Access to foreign government information may be required in the performance of this contract. The Program Manager will validate contractor requests for FGI on a case-by-case basis. Access to FGI requires a final government clearance at the appropriate level. FGI shall be protected in the same manner as the equivalent U.S. government classified information. Information supplied by or provided to a foreign government(s) shall be handled in accordance with the NISPOM, Chapter 10, Section 3 and DoDM 5200-01 V1-V4. All other foreign disclosure requirements are covered by AFI 16-201 and as established in Delegated Disclosures Letters (DDL). Any releases to foreign governments will go through the Range and Network program office, which will forward the request to the SMC/ENP Foreign Disclosure Officer (FDO) for review and approval. A training program must be developed to insure personnel are aware of foreign disclosure guidelines.

Reference Block 10j: For Official Use Only (FOUO) information will be handled as follows:

Controlled Unclassified Information (CUI) is now the term which collectively refers to FOUO and Unclassified Controlled Nuclear Information (UCNI). CUI information provided under this contract shall be managed and safeguarded IAW DoDM 5200.01, Volume 4, Controlled Unclassified Information (CUI).

Reference Block 10K: Other:

SIPRNET access for Visitor Groups: The government will provide classified SIPRNET network access to include e-mail and web browser. Contractors will be held accountable for actions they initiate on the network and will conduct business IAW USAF, SMC, and LAAFB instructions and policies. Sponsoring Government Contracting Activity (GCA) will provide Information Assurance training prior to contractor access to SIPRNet services.

STE access (if required): STE access is required for contract performance. Access will be controlled by the Government Contracting Activity (GCA). Contractor will follow requirements IAW AFI 33-201 V9, Operational Instructions for Secure Voice Devices.

Access to government AIS: The Contractor will require access to the government LAN to perform their contractual duties.

Contractors requiring access to government AIS (LAN) must meet the requirements contained in AFI 33-115, Volume 2, Licensing Network Users and Certifying Network Professionals, and all installation requirements.

Contract Solicitation No. FA8823-13-R-0009 P a g e | 7 o f 1 2

For Official Use Only

Access to Public Key Enabled sites: Contractor organizations that require access to DoD websites will be required to be Public Key Infrastructure (PKI) compliant. DoD approved commercial certificates for users requiring access to DoD websites can be obtained from: http://iase.disa.mil/pki/eca/index.html.

Reference Block 11. In performing this contract, the contractor will:

Upon finding that a requirement of any of the clauses of the contract are in conflict with security instructions issued to the contractor, the contractor shall notify the Contracting Officer of such conflict and the Contracting Officer or his/her duly authorized representative for security matters shall: (1) modify or rescind such requirement, or; (2) shall provide the contractor written instructions concerning the compliance with the requirements of the clause(s) or provisions conflicting with such security requirement. Any waiver of compliance with clauses or provisions of this contract issued by the Contracting Officer shall be in writing and approved by the Program Office in advance. In the event a conflict occurs between various security manuals, the contractor will utilize the most restrictive guidance and immediately refer the matter to the cognizant security officer for resolution. The contractor as a matter of policy will conduct a pre-publication review for all classified deliverables as required by DoD 5105.21 (Vol 1). The corporate CSSO/FSO, as the CSA, will conduct these reviews and coordinate with the Program Office whenever there is any uncertainty regarding information classification or compartmentalization.

Reference Block 11c: Receive and Generate Classified Material

Classified material, whether original or derivative in nature, will be handled in accordance with DoDM 5200.01 Vol 1 - Vol 3 or the provisions set forth in Chapters 4 and 5 in the NISPOM as applicable.

Reference Block 11d: Fabricate, Modify, or Store Classified Material

The Contractor is required to provide adequate storage for classified hardware up to and including the level of TOP SECRET.

COMSEC CCI (when keyed), key material and/or other COMSEC related hardware and materials must be protected IAW the NISPOM, NSA/CSS Policy Manual 3-16, and NCSS No. 12, National Information Assurance Policy for U.S. Space Systems used to Support National Security Missions. If the hardware is such a size and/or quantity that it cannot be safeguarded in an approved storage container, use of an approved ‘Closed Area’ will be required.

Reference Block 11f: Access To Classified Information Outside The US

Contractor requires access to U.S. Classified Information outside the U.S. Possession and Trust Territories.

The User Agency (Range and Network Division) or HQ, Space and Missile Systems Center, will furnish complete classification guidance for the service to be performed. The highest level of classification for the contract is TOP SECRET.

All other foreign disclosure is covered by AFI 16-201, and Delegated Disclosures Letters provided by SMC/PIP. A training program must be developed to insure personnel are aware of foreign disclosure guidelines.

Reference Block 11g: Be Authorized To Use The Services of Defense Technical Information Center (DTIC) Or Other Secondary Distribution Center

The contractor may access information provided by DTIC by complying with all established safeguards and following the registration procedures as set forth in Chapter 11 Section 2 of the NISPOM (DoD 5220.22M).

Reference Block 11h: COMSEC Account

(On-base contractors) The contractor will be required to establish and maintain a COMSEC user account following the procedures and requirements contained in AFI 33-201, Volume 2, Communications Security (COMSEC) User Requirements, the NISPOM, and installation COMSEC account procedures.

(Off-base contractors)

Contract Solicitation No. FA8823-13-R-0009 P a g e | 8 o f 1 2

For Official Use Only

NSA accounts will be established for and maintained by contractor IAW NSA/CSS Manual 3-16. The Contractor will comply with the additional security requirements and the management of NSA information/material as defined in the manual.

Reference Block 11i: TEMPEST Requirements

(Collateral) TEMPEST security measures must be considered if electronic processing of classified information is involved. The contractor shall comply with EMSEC requirements before processing classified data in accordance with AFI 33-203, Vol 1, Emission Security (EMSEC), and AFSSI 7700, Emission Security. Document the IA countermeasures and the EMSEC assessments on AF Form 4170, Emission Security Assessments/Emission Security Countermeasures Review, according to AFSSI 7702.

(SCI) TEMPEST security measures must be considered if electronic processing of SCI is involved in accordance with DoDM 5105, V1- V3 and AFMAN 14-304, Chapter 7. The Contractor shall comply with EMSEC requirements before processing classified data in accordance with AFI 33-203, Vol 1, Emission Security (EMSEC), AFSSI 7700, Emission Security, and AFSSI 7702, Emission Security Countermeasures Review. SCI, regardless of classification level, must be processed only on an information system accredited for SCI processing (e.g., Joint Worldwide Intelligence Communications System (JWICS)). It may not be processed on, transferred to, or stored on SIPRNET, even if the information is SECRET//SI, SECRET//HCS, etc., as the SIPRNET is not accredited for SCI. Any transfer to and/or processing of SCI on SIPRNET constitutes a data spillage from a higher to a lower-security information domain. Document the IA countermeasures and the EMSEC assessments on AF Form 4170, Emission Security Assessments/Emission Security Countermeasures Review, according to AFSSI 7702.

(SAP) TEMPEST security measures must be considered if electronic processing of SAP information is involved. The contractor shall comply with EMSEC requirements before processing classified data in accordance with AFI 33-203, Vol 1, Emission Security (EMSEC), and AFSSI 7700, Emission Security. SAP information, regardless of classification, shall be processed only on an information system specifically accredited for SAP processing and operating at a classification level that meets or exceeds the classification level of the SAP data. Document the IA countermeasures and the EMSEC assessments on AF Form 4170, Emission Security Assessments/Emission Security Countermeasures Review, according to AFSSI 7702.

Reference Block 11j: OPSEC

The contractor will accomplish the following minimum requirements in support of SMC/RN Operations Security (OPSEC) Program.

Compliance with security requirements imposed by documents generated in response to DoDI 5200.39, Critical Program Information (CPI) Protection Within the Department of Defense, 16 July 2008, is required. Compliance with OPSEC measures if imposed by programs supported or by documents generated by SMC/RN may be necessary. OPSEC program will be IAW DoDM 5205.2, dated 3 November 2008. Program OPSEC plans shall be coordinated with and approved by the SMC/RN and shall be imposed on subcontractors as appropriate. Program protection measures will be approved by the SMC/RN and shall be applied at ALL locations where Critical Information is developed, produced, analyzed, maintained, transported, stored, tested, or used in training.”

The contractor shall comply with the SMC OPSEC Plan as well as the Program Office, SMC/RN OPSEC Plan, and apply protective measures therein. The contractor shall develop an OPSEC Plan in accordance with DoDM 5205.2.

Include OPSEC as a part of their ongoing security awareness program conducted in accordance with Chapter 3, Section 1, of the National Industrial Security Operating Manual.

Be responsive to the SMC/RN OPSEC Manager on a non-interference basis.

Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of military operations performed by the contractor in support of the mission. Sensitive unclassified information is that Information marked FOR OFFICIAL USE ONLY (FOUO), Privacy Act (PA) Of 1974, COMPANY PROPRIETARY, and as identified by the Air Force Program Office and the HQ SMC/ENP OPSEC Manager.

Disposition of Critical Information, FOUO, and PA obtained or produced pursuant to this contract will be shredded/degaussed to prevent reconstruction.

Email transmission of Critical Information, FOUO, and PA obtained or produced pursuant to this contract will be encrypted or password protected. In addition, email containing FOUO and PA will be marked in the subject line. FOUO will also be included at the beginning and end of the email.

Reference Block 11k: Defense Courier Service

This contract requires use of the Defense Courier Service (DCS). The Contractor Special Security Officer (CSSO) will prepare and submit DCS Form 10 in original triplicate to the program SSO for validation prior to their submittal to the appropriate DCS station.

Contract Solicitation No. FA8823-13-R-0009 P a g e | 9 o f 1 2

For Official Use Only

Reference Block 11l: OTHER:

Information Assurance requirements:

The terms Information Assurance and Information System, as used in this clause, is defined in DODI 8500.01 and is incorporated herein by reference. Information systems (IS) shall be engineered and managed to protect and defend information and information systems from security risks, including the risks to timely accreditation in accordance with current DoD policies, procedures, and statutes, to include:

The National Security Act The Clinger-Cohen Act National Security Telecommunications and Information Systems Security Policy No. 11 Federal Information Processing Standards DoD Directive 8500.01, Information Assurance DoD Instruction 8500.02, Information Assurance Implementation

Information assurance (IA) requirements shall be established and maintained throughout the acquisition lifecycle in accordance with DODI 8580.1. All DoD information system shall meet security requirements in accordance with DODD 8500.01 and DODI 8500.02, and be accredited by the Designated Approving Authority (DAA) prior to operation.

Prior to classified processing, the contractor will ensure that ISs comply with the NISPOM, Chapter 8 and meet the confidentiality, integrity, authentication, non-repudiation and availability requirements for a PL-2 system as identified in the Defense Security Service (DSS) Industrial Security Field Operations (ISFO) Process Manual for Certification and Accreditation of Classified Systems under the

NISPOM.

Protection of Unclassified DoD Information on Non-Government Information Systems:

The Contractor must comply with the information safeguards as specified in DoDI 8582.01, dated 6 June 2012, Security of Unclassified DOD Information on Non-DOD Information Systems, DoD Commercial Mobile Device (CMD) Interim Policy dated 17 Jan 2012, Use of Commercial Mobile Devices Not Connected to Department of Defense Networks dated 31 Jul 2012, and Air Force (AF) Guidance memorandum to AF Manual 33-282 dated 4 April 2013. The aforementioned policies apply to Government issued, Contractor provided, or personal devices.

Non-enterprise activated Commercial Mobile Devices (CMD) is defined as any mobile handheld device that is not connected to any DoD network (wired or wireless) or to a PC that is/will be connected to a DoD network. The devices can be used for any non-sensitive unclassified DoD tasks and process/store publically released information. Non-enterprise activated commercial mobile devices, regardless of ownership, are prohibited from storing and/or processing classified information, Personally Identifiable Information (PII), Health Insurance Portability and Accountability Act (HIPAA) information, Controlled Unclassified Information (CUI), For Official Use Only (FOUO) and DoD sensitive information.

Definitions:

Non-Sensitive Information -- Information available in the public domain or DoD information that has been approved for public release.

Sensitive Information -- Information, the loss, misuse, or unauthorized access to or modification of, could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of title 5, United States Code, "The Privacy Act" but which has not been specifically authorized under criteria established by Executive order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. (Section 278g-3 of title 15, United States Code, “The Computer Security Act of 1987").

Apply security controls contained in NISP SP 800-53 for the protection of unclassified controlled technical information on non-DoD information systems.

Trusted Download Procedures:

Contractors are not authorized to use a trusted download procedure to extract lower level classified or unclassified information from classified information systems unless the procedures are jointly approved by Defense Security Service (DSS) Office of the Designated Accrediting Authority (DAA) and the cognizant Government Contracting Activity (GCA) Information Assurance Manager (IAM). Air Force Space Command memorandum, Guidance for Manual Data Transfers Across Security Domains, dated 10 Jan 2012, specifically identifies approved data transfer methodologies.

Security Incident Reporting:

In addition to the reporting requirements directed by the NISPOM, the contractor will provide a concurrent report of loss or compromise of classified information to the cognizant Government Contracting Activity (GCA) Information Assurance Manager (IAM and Designated Accrediting Authority (DAA).

For incidents involving contractor SCI information or programs, CSSOs shall report through the COR to the appropriate SCI security official. Contractors shall go through the contracting officer to the organization that issued the contract when emergency matters exists that affect plans or operations when there is a danger of compromise.

Contract Solicitation No. FA8823-13-R-0009 P a g e | 1 0 o f 1 2

Additionally it is expected that all contract personnel assigned in direct support of an AF unit will integrate into the unit’s security training program to include but not limited to:

1. Initial Security Orientation

2. Annual Refresher Training

3. Computer Awareness Training

4. OPSEC Awareness Training

5. Antiterrorism/Force Protection Exercises

The contractor shall comply with the general security provisions of the following documents, including changes or revisions:

AFI-10-701, Operations Security (OPSEC), dated 8 June 2011 AFI 16-201, Air Force Foreign Disclosure and Technology Transfer Program, Dated 1 December 2004 AFI 16-701, Special Access Programs, dated 1 November 1995 AFI 31-401 (AFGM), Information Security Program Management, date 1 November 2005 (AFGM is dated 29 February 2012) AFI 31-406, Applying North Atlantic Treaty Organization (NATO) Protection Standards, dated 29 July 2004 AFI 31-501, Personnel Security Program Management, dated 27 January 2005 AFI 31-601, Industrial Security Program Management, dated 29 June 2005 AFI 33-200, Information Assurance Management, dated 29 December 2008 (current release incorporates through change 2, dated 15 October 2010) AFI 33-201, Volume 1, Communications Security (COMSEC), dated 1 May 2005 (Incorporating Change 2, 15 October 2008) AFI 33-201, Volume 2, Communications Security (COMSEC) User Requirements, dated 26 April 2005 (will become AFSSI 4211) AFI 33-115, Volume 2, Licensing Network Users and Certifying Network Professionals, dated 14 April 2004 (new release incorporates through change 3, dated 26 October 2007) AFI 33-230, Information Assurance (IA) Assessment and Assistance Program, dated 4 August 2004 (will become AFSSI 8560) AFPEO/SP Policy 63-17, AFPEO/SP Space Research and Technology Protection (SRTP) Policy, dated 17 January 2003 AFSSI 7700, Emission Security, dated 24 October 2007 (current issue incorporates change 1, dated 14 April 2009) AFSSI 7702, Emission Security Countermeasures Review, dated 30 January 2008 (current release incorporates change 1, dated 17 October 2008) Committee on National Security Systems (CNSS) No. 12, National Information Assurance Policy for U.S. Space Systems used to Support National Security Missions, dated 20 March 2005 DODM 5105.21 V1-V3, Department of Defense Sensitive Compartmented Information Administrative Security Manual, Dated August DODM 5200.01, Volume 1, DoD Information Security Program: Overview, Classification and Declassification, date 24 February 2012 (Replaced DoD 5200.1-R, cancelled DoD O-5200.1-I, and incorporates DTMs 04-010 and 11-004) DODM 5200.01, Volume 2, DoD Information Security Program: Marking of Classified Information, dated 24 February 2012 Incorporating Change 2, March 19, 2013 DODM 5200.01, Volume 3, DoD Information Security Program: Protection of Classified Information, dated 24 February 2012 Incorporating Change 2, March 19, 2013 DODM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI), dated 24 February 2012 DODI 5200.39, Critical Program Information Within the Department of Defense, dated 16 July 28 July 2008 DODD 5205.02, DoD Operations Security (OPSEC) Program, dated 6 March 2006 DODD 5205.07, Special Access Program (SAP) Policy, dated 1 July 2010 DODI 5210.02, Access to and Dissemination of Restricted Data and Formerly Restricted Data, dated 3 June 2011 (Replaced DOD Directive 5210.2) DOD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), dated 28 February 2006 (This release cancelled DOD 5220.22-S-1, COMSEC Supplement to the Industrial Security Manual for Safeguarding Classified Information) DOD 5220.02-R, Industrial Security Regulation, dated 4 December 1985 DoD Instruction 5230.29, “Security and Policy Review of DoD Information for Public Release,” dated 8 January 2009 DOD 5400.7-R, DoD Freedom of Information Act (FOIA), dated 4 September 1998 DODI 5400.04, Provisions of Information to Congress, dated 17 March 2009 (Superseded DODD 5400.4) DODI 7650.01, Government Accountability Office (GAO) and Comptroller General Requests for Access to Records, dated 27 January 2009 (superseded DODD 7650.1) DODD 8500.01E, Information Assurance (IA), dated 24 October 2002 (certified current 27 April 2007) DODI 8500.02, Information Assurance (IA) Implementation, February 6, 2003 DODI 8510.01. DoD Information Assurance Certification and Accreditation Process (DICAP), dated 28 November 2007 DODI 8523.01, Communications Security (COMSEC), dated 22 April 2008 DoDD 8581.1, Information Assurance (IA) Policy for Space Systems Used by the Department of Defense, dated 21 June 2005 DoDI 8582.01, dated 6 June 2012, Security of Unclassified DOD Information on Non-DOD Information Systems DTM 08-027, Security of Unclassified DOD Information on Non-DOD Information Systems, dated 31 July 2009 (incorporates change 2, dated 02 September 2011) (Valid until 1 September 2012 or until replaced by 8500 series DoD issuance) Executive Order 13526, Classified National Security Information, dated 29 December 2009 Executive Order 13556, Controlled Unclassified Information, dated 4 November 2010

Contract Solicitation No. FA8823-13-R-0009 P a g e | 1 1 o f 1 2

For Official Use Only

SMC/IN SSO

DD Form 254 Addendum (2013)

Sensitive Compartmented Information (SCI) Requirements and Procedures

Reference Block 13 Security Guidance

The expiration date of initial period of performance is what determines the duration of SCI access, and not the option years unless formally exercised. If the option years are exercised, the government contract monitor must send notification as such in writing to the SMC/INS SSO.

Reference Block 14 Additional Security Requirements

Per DoDM 5105.21-Vl, enclosure 4, l.b. "Contractors will ensure SCI information in their custody is used or retained only in furtherance of a lawful and authorized U.S. Government purpose. Contactors are required to return all SCI material to the COR, COTR, or Government program manager when their contract expires or closes out, unless the US. Government has given the contractor permission to retain the classified material in accordance with Chapter 5 of DoD 5220.22-M. This requirement must be included in item 13 or 14 of the DD Form 254. The information management system employed by the contractor shall be capable of facilitating such retrieval and disposition in an· expeditious manner."

The contractor shall adhere to the following directives/manuals/instructions/handbooks as they pertain to the access, handling, control, dissemination, processing of Sensitive Compartmented Information:

DCID 6/9, Physical Security (for facilities accredited under 6/9 standards) DoD 5105.21 Vl, V2, V3, SCI Administrative Security Manual(s) AFMAN 14-304, Security, Use and Dissemination of SCI lCD 503 - Information Systems lCD and ICPGs 704 - Personnel Security lCD and ICS/Tech Specs 705 - Physical Security JDCSISSS- Joint DoDIIS Cryptologic SCI Information Systems Security Standards DJSIG- Department of Defense Intelligence Information System (DoDIIS) Joint Security Implementation Guide (appendix C & D only)

DIAM 50-4 - Defense Intelligence Agency Manual

SMC/IN SSO Handbook *

AFSPC CONOPS (if applicable) * *

LAAFB DODIIS Site CONOPS (if applicable) **

* Will be provided to the appointed CSSO upon request as this handbook identifies the processes, or the "how to" with SCI security management in accordance with the directives/manuals/instructions listed above.

** For facilities under SMC/IN SSO cognizance, or facilities with JWICS connectivity provided by SMC/IN SSO.

Reference Block 15 Inspection

Defense Security Service is relived of inspection responsibilities pertaining to Sensitive Compartmented Information associated with this contract. The following activity is designated as inspection authority as the User Agency SSO for SCI requirements in accordance with DoD 5105.21 Vl, V2, V3, and AFMAN 14-304.

SMC/INS (SMC SSO)

483 N. Aviation Blvd Los Angeles AFB El Segundo, CA 90245-4659

The User Agency Special Security Officer (SSO) is: SMC/INS

(310) 653-4351

The Alternate Special Security Officer (ASSO) is: SMC/INS

(310) 653-4508

Unclassified e-mail: smc.ins.sso@us.af.mil JWICS e-mail: smc.ins@la.ic.gov Secure Fax: 310-653-4509

Contract Solicitation No. FA8823-13-R-0009 P a g e | 1 2 o f 1 2

Hq AFSPC/A8Z DD Form 254 Addendum

Special Access Programs (SAP) Requirements and Procedures

(Contractor Facilities)

Reference Block 8 (c) - Actual Performance (Cognizant Security Office):

HQ AFSPC/A8Z is the Cognizant Security Office for all SAPs related to this contract. Address is 150 Vandenberg St, Suite 1105, Peterson AFB, CO 80914. Telephone contact is 719-554-1601.

Reference Block12: Public Release

No public release of classified or sensitive SAP information pertaining to this contract is authorized. All requests to release such information must be routed through the local cognizant security office.

Reference Block 13 - Security Guidance:

1. All SAP work will be performed within approved SAP facilities (SAPF) designated and approved by the Program Security Officer

(PSO).

2. Requests for SAP accesses will be made through the local CPSO or Program Manager (PM) to the Cognizant Security Office.

3. Continued contractor access to SAPs requires initial and recurring (annual) SAP security education training. The CPSO will conduct the training at the location where the contractor’s program access records are kept.

4. Inquiries regarding SAP classification guidance will be directed to the Cognizant Security Office, PSO, CPSO, or PM. Any SAP-derived material generated under this contract will be reviewed by the PSO, CPSO, or PM for proper classification prior to final publication, distribution, or transmission. Public release request will be forwarded to the Cognizant Security Office.

5. SAP information furnished or generated in support of this contract remains the property of the government and will be returned to the servicing program office upon completion of this contract.

6. All procedures, equipment, and devices used for data processing or data transfer of SAP information must be accredited (approved) by the PSO before any processing is permitted. Any subsequent configuration or procedural changes must also be approved prior to use.

7. The contractor will produce classified material and have access to classified data/areas listed in Reference Block 8a only. HQ AFSPC/A8Z will provide daily security oversight of this contract unless delegated in writing by the PSO to another activity.

8. The security clearance requirements for this contract are a Secret/Top Secret clearance based on a NACLC/SSBI investigation within the last five years.

9. The Government will provide adequate classified storage capability. Only properly accessed (program briefed) personnel will have access to security containers and classified media containing SAP information.

Reference Block 14 - Additional Security Guidance:

The contractor will follow all applicable security guidance related to the protection of SAP information. Baseline guidance includes the National Industrial Security Program Operating Manual (NISPOM), NISPOM Supplement (NISPSUP), DOD Overprint to the NISPOMSUP, Joint Air Force-Army- Navy (JAFAN) Manuals 6/0, 6/3, 6/4 and 6/9, applicable Program Protection Plans (PPPs) Security Classification Guides (SCGs), and local Standard Operating Procedures. The PSO will provide a copy of applicable guidance to the contractor.

Reference Block 15 - Inspections:

HQ AFSPC/A8Z will conduct security reviews of all SAP facilities, material, and operations related to this contract. DSS or local SF oversight over SAP portions of this contract is carved-out.