DD_254_Security_Supplemental_Pages.doc

Section 13 Security Guidance Item 10b. Restricted Data (RD): The contractor is permitted access to Restricted Data (RD) in the performance of this contract. Access to RD requires a final U.S. Government clearance at the appropriate level.

Item 10d. Formerly Restricted Data: The contractor is permitted access to Formerly Restricted Data (FRD) in the performance of this contract. Access to FRD requires a final U.S. Government clearance at the appropriate level.

Item 10e (2). Intelligence Information (Non- SCI):

Requirements for Release and Dissemination of Classified Intelligence Information

1. The Intelligence Division Chief, 412 Test Wing (412 TW/XP2) is the Senior Intelligence Officer (SIO) for this contract. The SIO is authorized to approve release of intelligence material to US Contractors. For this contract, classified intelligence can be released to this contractor at the program office level provided the proper security procedures are followed. This release does not include intelligence material marked Dissemination and Extraction of Information Controlled by Originator (ORCON), Proprietary Information (PROPIN), or where distribution statements preclude release without the originator’s approval. For intelligence material marked ORCON, PROPIN, or where there is an originator controlled distribution statement, contact 412 TW/XP2 for proper release procedures.

2. Contractors must return intelligence data to the Contracting Officer's Representative (COR) at the termination or completion of a contract unless the COR has provided written approval for the contractor to retain for an additional two years. If retention is required beyond the two year period, the contractor must again request and receive written retention authority from the COR. Written approvals from the COR shall be provided to 412 TW/XP2.

3. The contractor must:

a. Maintain control of all classified intelligence released in his or her custody in accordance with current SCI directives. Contractor agrees that all intelligence materials released, all reproductions, and other material generated (including reproductions) are the property of the US Government.

b. Maintain control of all reproduced intelligence data in the same manner as the original.

c. Destroy intelligence materials in accordance with approved destruction methods.

d. Restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, other government agencies, and private individuals or organizations is prohibited unless authorized by the COR.

e. Not release intelligence material to foreign nationals or immigrant aliens whether or not they are also consultants, US contractors, or employees of the contractor, and regardless of the level of their security clearance, except with advance written permission from the appropriate Foreign Disclosure Policy Office.

f. Ensure each employee having access to intelligence material is fully aware of the special security requirements for this material.

4. Clarification is provided as follows on what derivative classified intelligence is and dissemination of derivative classified intelligence:

a. Derivative classified intelligence is intelligence which has been extracted out of an intelligence document and incorporated into a white paper, briefing, information report, working papers, or product to be delivered to the government in some form, or used in performance of the contract for the program office. For example, if an intelligence document is released to one of your contractors, the contractor could produce a briefing by extracting information out of the document, creating viewgraphs, and then presenting the briefing in support of the contract. Information from the same document could also be extracted to create a white paper or working papers to support the contract. Extraction of information out of the document could be:

(1) Reproducing a table, page(s), or other portions of the document,

(2) Entering the intelligence contained in the document into a word processor or data base, or authorized software package in support of the contract, or

(3) hand-written notes.

b. Dissemination of derivative classified intelligence will be for the SPO and contract use only. Derivative classified intelligence will not be transferred from one contract to another without COR approval, and will have access restricted to only those individuals who possess the necessary security clearance and who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, consultants, and private individuals or organizations is prohibited unless authorized by the COR.

Item 10g. NATO Information: The contractor is permitted access to North Atlantic Treaty Organization (NATO) information in performance of this contract. Access to NATO information requires a final U.S. Government clearance at the appropriate level. The government program/project manager is the designated representative that will ensure the contractor concerned employees are NATO briefed prior to access being granted. Prior approval from the contracting activity is required for subcontracting.

Item 10j. Controlled Unclassified Information (CUI): Refer to DoDM 5200.01, Vol 4, DoD Information Security Program: Controlled Unclassified Information (CUI), available at http://www.esd.whs.mil/DD/DoD-Issuances/, when considering protection for CUI.

Item 10k. For Official Use Only:

The following procedures will be used to protect FOR OFFICIAL USE ONLY (FOUO) information:

1. HANDLING: Access to FOUO material shall be limited to those employees who need the material to do their jobs. The FOR OFFICIAL USE ONLY marking is assigned to information when created by a DOD User Agency. FOR OFFICIAL USE ONLY is not a classification, but requires extra precautions to ensure it is not released to the public.

2. MARKING:

a. Mark an unclassified document containing FOUO information “FOR OFFICIAL

USE ONLY” at the bottom of each page containing FOUO information and on the bottom of the front page or front cover (if any) and on the back of the last page and on the back cover (if any).

b. In a classified document, mark:

(1) An individual paragraph that contains FOUO, but not classified information, by placing “(FOUO)” at the beginning of the paragraph.

(2) The top and bottom of each page that has both FOUO and classified information, with the highest security classification of the information on that page.

(3) “FOUO” at the bottom of each page that has FOUO information but is not classified.

(4) If a classified document also contains FOUO information or if the classified material becomes FOUO when declassified, place the following statement on the bottom of the cover of the first page, under the classification marking: “NOTE: If declassified, review the document to make sure material is not FOUO and not exempt under the Air Force Supplement to DoD Regulation 5400.7, DoD Freedom of Information Act Program, before public release.”

c. Mark other records, such as computer print outs, photographs, films, tapes, or slides “FOR OFFICIAL USE ONLY” so that the receiver or viewer knows the record contains FOUO information.

d. Mark each part of a message that contains FOUO information. Unclassified messages containing FOUO information must show the abbreviation “FOUO” before the text begins.

e. Make sure that documents that transmit FOUO materials call attention to any FOUO attachments.

3. STORAGE: To safeguard FOR OFFICIAL USE ONLY records during normal duty hours, place them in an out-of-sight location if your work area is accessible to persons who do not have a valid need for the information. After normal duty hours, store FOUO records to prevent unauthorized access. File them with other unclassified records in unlocked files or desks when normal internal building security is provided. When there is no internal security, locked buildings or rooms usually provide adequate after-hours protection. For additional protection, shore FOUO material in locked containers such as file cabinets, desks, or bookcases. Expenditure of funds for security containers or closed areas solely for the protection of FOUO is prohibited.

4. TRANSMISSION: FOUO material shall be transmitted by the same means as other

UNCLASSIFIED material. Discussion of FOUO material on the telephone is authorized if necessary for performance of the contract. FOUO information may be transmitted over telephone lines in digital form, by telecopy’s, or by other commercial teletype lines without encryption.

5. RELEASE: FOUO information may be released only to DoD components, officials of DoD components, and other DoD contractors when needed to conduct official DoD business.

6. DESTRUCTION: When no longer needed, FOUO information may be disposed of by any method which will preclude its disclosure to unauthorized individuals.

Item 11a: Contractor performance is restricted to the Air Force Research Laboratory, Aerospace Systems Directorate (AFRL/RQ-West), Edwards AFB, CA 93524. AFRL/RQ-West will provide security classification guidance for performance of this contract.

Item 11g. DTIC Access: The contractor may submit a DD Form 2345, Militarily Critical Technical Data Agreement (after registration with DTIC) to the Defense Logistics Service Center for access to unclassified, militarily critical technical data from other DoD sources. The GCA must certify need-to-know to DTIC.

Item 11j. OPSEC: The contractor will comply with the AFRL/RQ-West OPSEC Program. The basis for the on-site contractor OPSEC Program is the AFRL/RQ-West OPSEC Security Plan. AFRL/RQOF (Security) is the Aerospace Systems Directorate point of contact for AFRL/RQ-West. The contractor must comply with special OPSEC requirements contained in the contract or addendum thereto. The contracting activity will be involved in approving OPSEC requirements for subcontracts.

Item 11l. Receive, Store, or Generate Controlled Unclassified Information (CUI): Refer to DoDM 5200.01, Vol 4, DoD Information Security Program, when considering specific requirements to be imposed on the contractor for the protection of CUI.

Item 11m. Other: Prior to beginning operations on Edwards AFB, the contractor will provide the servicing security activity (SSA), AFRL/RQOF, with all information required by the Notification of Government Security Activity clause, and any additional information and/or documentation that is required by that office. The contractor shall enter into a Visitor Group Security Agreement with the Installation Commander to ensure that the contractor’s security procedures are properly integrated with those of the installation.

Required Contractor Clauses

a. 5352.242-9000 Contractor Access to Air Force Installations

b. 5352.242-9001 Common Access Cards (CACs) for Contractor Personnel

c. 5352.204-9000 Notification of Government Security Activity and Visitor Group Security Agreements Item 14: Additional Security Requirements:

1. USAF Controlled/Restricted Areas:

a. According to AFI 31-101, The Air Force Installation Security Program, AF Form 1199 (Computer Generated), Entry Control Card, will be used by contractor personnel for unescorted entry into USAF Controlled Areas on Edwards AFB. Individuals must be a U.S. citizen and have a favorable background investigation completed to be eligible or for unescorted access to an AF Controlled Area.

b. According to AFI 31-501, USAF Personnel Security Program Management, AFRL/RQOF (Security) will submit all Tier 1 requests for unescorted entry to AF Controlled Areas. Based on a justified need for performance of an official function in conjunction with meeting the requirements of section 3.3 of Executive Order 13526, temporary escorted access to the AF Controlled Area may be granted before investigations are completed and favorably adjudicated. Upon review of the individual’s Personnel Security Questionnaire (SF 86) and submission of the Tier 1 request, escorted entry can be granted. The information will be recorded on the AF Form 2583, Request for Personnel Security Action. The eligibility will be noted on the AF Form 2583 to show favorable adjudication of the SF 86 and interim access to the Controlled Area.

c. Controlled Area Badges will be issued at the request of the Program/Project Manager. The individual’s original copy of the AF Form 2586, Unescorted Entry Authorization Certificate, will be maintained by the AFRL RQ-West Security Office. Requests for Controlled Area Badges must be supported by a valid visit authorization letter.

2. Company Badges: Contractor employees are required to wear, or have in their immediate possession, a company photo badge and/or wallet size identification that reflects the complete name of the contractor’s company, photograph of employee prominently reflected on the face of the badge, and last, first, and middle name of employee. Any additional information is at the option of the contractor.

3. Access to SIPRNET: Contractor personnel will require a NATO Awareness Briefing to the appropriate contractor personnel since SIPRNET access is required for contract performance.

4. COMPUTER SECURITY (COMPUSEC):

Employees, not requiring a security clearance, who have access to government computer systems must have a favorably completed NACI accomplished. The VG will complete an Electronic Questionnaire for Investigations Processing (e-QIP), which is submitted to the AF Activity’s Security Office. Upon review of the individual’s SF 85/e-QIP and submission to the Office of Personnel Management-Federal Investigations Processing Center (OPM-FIPC), eligibility for interim access to government computer systems may be granted following the AF Activity’s established process. If upon review the SF 85/e-QIP, issues are identified, interim access may not be authorized until completion of the NACI.

4.1 Computer Security:

4.2. According to AFMAN 17-1301 Computer Security (COMPUSEC), and DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), Chapter 8; the following requirements also apply to contract performance:

4.2.1. Contractor personnel authorized access to one or more DoD information systems shall comply with the requirements outlined in AFMAN 17-1301, as well as AFMAN 33-152, User Responsibilities and Guidance for Information Systems, in addition to any system specific security policies.

4.2.2. Contractor owned or operated hardware and software must meet all security requirements for government-owned hardware and software IAW AFMAN 17-1301, whenever one or more of the following conditions exist: interconnection with one or more Government owned-/operated-systems; dedicated to DoD processing and/or under DoD configuration control IAW DoDI 8510.01; processing classified DoD information; located within AF-controlled facilities operating under the FAR, DFARS, and DoDI 4161.02 as required by contract. All such assets operated within AF facilities shall be registered and authorized by the cognizant enclave Information System Security Officer (ISSO), Manager (ISSM), or Central Security Service (CSS).

4.2.3. All unclassified DoD information in the possession or control of non-DoD entities on non-DoD information systems, to the extent provided by the applicable contract, grant, or other legal agreement with the DoD, shall be protected IAW the provisions outlined in DODI 8582.01, Security of Unclassified DoD Information on Non-DoD Information Systems, Enclosure 3. Unclassified DoD information shall not be removed or transferred from DoD information systems to non-DoD information systems unless specifically authorized by contract and expressly released to the contract by the Contracting Officer or contract designated government representative.

4.2.4. Foreign owned or operated (e.g., joint/coalition) information systems shall not be used to process sensitive or classified information or for critical processing, unless required by international treaties or security agreements.

4.2.5. Privately-owned hardware and software shall not be used for the processing, storing, or transferring of classified or unclassified DoD information.

4.2.6. Foreign National access to Air Force information systems is subject to the restrictions and approval processes outlined in AFMAN 33-282.

4.3. Contracts that require the operation of information systems independent of the supporting organization (i.e. contractor allocated a subnet or portion thereof) will follow the guidance and requirements of Air Force Instructions and Manuals for all classification levels and will comply with DoD O-8530.01-M, Department of Defense Computer Network Defense (CND) Service Provider Certification and Accreditation Program, for DoD-owned IS (Information Systems) and DoD-controlled ISs operated by this visitor group that receives, processes, stores, displays or transmits DoD Information.

For Official Use Only