KAFB_VGSA_Template_20150217_16_March_15.docx

Visitor Group: XXX Contract Number: 00000

VISITOR GROUP SECURITY AGREEMENT

377 ABW/IP ID #20150217

Facility Name: INSERT COMPANY NAME Contract Number: INSERT # (Example: FA8818-14-F-003) CAGE Code: 0GYV7

377th AIR BASE WING

2000 WYOMING BLVD, SE

KIRTLAND AFB, NM 87117-5000

AND

Home Office Physical Location INSERT COMPANY NAME (Example: MCR Federal, LLC) INSERT ADDRESS (Example: 2010 Corporate Ridge, Suite 350) INSERT CITY, ST, ZIP (McLean, VA 22102)

Cognizant Security Office

377 AIR BASE WING INFORMATION PROTECTION

4500 BIGGS AVE, SE

KIRTLAND AFB, NM 87117

STATUS: NON-STORAGE OF CLASSIFIED MATERIAL

I. Contractual Agreement:

This agreement, promulgated by DoD 5220.22-R, Industrial Security Regulation and DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), Chapter 1, Section 2, Paragraph 1-200, is entered into by the Installation Commander, KIRTLAND Air Force Base (AFB), and INSERT ORGANIZATION AND ADDRESS MCR Federal, LLC (hereafter referred to as visitor group), prescribes the specific actions to be taken by the visitor group’s employees and the Department of the Air Force (DAF), to properly protect classified information involved in the on-base contract performance at the visitor group’s on-base operating location of INSERT ORGANIZATION AND ADDRESS Operationally Responsive Space Office, 2351 Carlisle Blvd, SE, Buildings 404 & 277, Kirtland AFB, NM 87117.

Responsibilities are delineated as follows:

NOTE: As used in this agreement, the terminology visitor group, contractor, company, and home office facility (HOF) are synonymous. Furthermore, the verbiage Air Force (AF) activity, unit, contracting officer, program/project manager, Cognizant Security Office (CSO), Servicing Security Activity (SSA), refers to entities representing the DAF in their appropriate and respective capacity.

Should there be any conflict in instructions, regulations or guidance, such conflict shall be reported to the CSO and appropriate Contract Officer (CO) or Contract Officer Representative (COR) for resolution. As security and related information protection is a dynamic and changing environment due to evolving threats and risk management responses, key instructions, regulations, and guidance sources herein may undergo changes and/or updates to include complete replacement or substitution. Upon notification to 377 ABW/IPD of such a change, updates and/or replacement or substitutions, 377 ABW/IPD will provide details to the CO or COR for forwarding to the HOF. The HOF agrees to comply with the associated new direction unless notifying the CSO, CO or COR within 30 days of notification of those areas they cannot or will not comply with the change, updates and/or replacement or substitutions. In absence of such a non-compliance notification, the related new direction shall thereafter be considered fully biding at no additional cost to the U.S. Government.

Severability: If any provision of this agreement is held invalid or unenforceable, its invalidity or unenforceability will not affect any other provisions and/or requirements of the agreement, and this agreement will be construed and enforced as if such provision had not been included.

a. Visitor Group Security Supervision: Under the terms of this agreement, the visitor group will operate per DoDM 5200.01-M V 1-4, Information Security Program Manual, Air Force Instruction 31-401, Information Security Program Management, supplements thereto, and the Air Force (AF) activity’s unit security program operating instructions (OIs), plans and/or procedures. The installation CSO is responsible for providing security program oversight and the AF activity is responsible for implementing and managing the AF activity security program per DoDM 5200.01 and AFI 31-401, and all supplements, AFI 31-601, and all supplements. The visitor group will adhere to AFFARS clauses 5352.204-9000, Notification of Government Security Activity and Visitor Group Security Agreements, 5352.242-9001 Common Access Card (CAC) for Contracted Personnel, 5352.242-9000 Contractor access to Air Force Installations, and DFARS clause 252.204-7005. While visiting or performing work on Kirtland AFB, NM, contractor personnel shall wear or prominently display the CAC or contractor badge on the most outer part of clothing above the waist visible to an observer.

(1) The visitor group’s HOF will identify (in writing) to the CSO and AF activity Key On-base Management Officials or Representatives an employee to interface with and serve as the visitor group’s focal point for security related matters, normally the Facility Security Officer (FSO). Under the terms of this agreement, the identified employee per this paragraph will provide appropriate security program management assistance to the AF activity’s unit security manager.

(2) The visitor group’s HOF will provide the CSO and AF activity unit security manager the name, address and phone number of the HOF’s FSO.

(3) All parties, the AF activity, contracting office (sponsor), visitor group, and CSO will perform duties specified by this agreement in a timely manner.

(4) The visitor group’s on-base management will maintain on file a copy of all contracting documents, DD Form 254 and any associated DD Form 254, DoD Contract Security Classification Specification, applicable VGSA, current listing of the key on-base management officials or representatives letter, copy of last annual ISPM program review applicable to the contractor (if any), copies of last self-inspection report portion applicable to the contractor (if any), and current JPAS Visit Request.

(5) The HOF shall not assign personnel to this contract requiring access to classified information without the required and properly submitted/approved JPAS visit request. The FSO is responsible to submit personnel security clearances for the contractor via eQIP in a timely manner to ensure personnel remain in-scope.

(6) The HOF will ensure procedures are in place to notify the Activity Security manager and/or CSO of:

· Suspicious Contacts

· Changed Conditions Affecting the HOF facility clearance (FCL) to include Foreign Ownership, Control or Influence (FOCI) changes

· Unauthorized Receipt of Classified Material tied to the contract or AF Activity associated with this VGSA

· Any adverse information coming to their attention concerning their cleared employee (if said employee participates on the contract associated with this VGSA). Adverse information consist of any information that negatively reflects on the integrity or character of a cleared employee, that suggests that his or her ability to safeguard classified information may be impaired, or that his or her access to classified information clearly may not be in the interest of national security. The HOF is responsible for Continuous Evaluation Program (CEP) requirements of cleared personnel to ensure they continue to be trustworthy in accordance with the standards in adjudicative guidelines found in DoD 5200.2-R, Chapter 2

· Change in Cleared Employee Status (if said employee participates on the contract associated with this VGSA). Include changes in employment (such as firing, dismissal, lay-off, etc); as well as notifications of derogatory information for CEP or when a Security Information File (SIF) is being considered or if JPAS updates to access suspensions/revocations are planned or occurred.

(7) The CSO may provide copies of reports involving contractor/s employees to the HOF.

b. Standard Practice Procedures (SPP): Compliance with this agreement eliminates SPP publication requirement. The visitor group will use and comply with the AF activity’s unit security program operating instructions (OIs), procedures and/or requirements, per this agreement and other applicable DoD or AF directives. This provision of the agreement is not intended nor does it interfere with the visitor group’s internal management policies, procedures, or requirements unless stated otherwise.

c. Access to, Accountability, and Marking of Classified Material:

(1) All access to and/or possession of classified material by on-base visitor group personnel, including oral and/or visual, at the location of INSERT ORGANIZATION AND ADDRESS (Example: Operationally Responsive Space Office, 2351 Carlisle Blvd, SE, Buildings 404 & 277, Kirtland AFB, NM 87117) will be under the AF activity’s oversight. The AF activity maintains accountability, control, and ownership of all classified information involved under the terms of this contract at all times per DoDM 5200.01 and AFI 31-401. The visitor group’s access to classified information will be controlled by the AF activity and limited to contract-specific, “need-to-know" information only. Contractors shall appropriately protect all classified information to which they have access or custody per policy and procedures in accordance with the AF activity, as well as related compliance instructions, regulations, and guidance noted herein.

(2) If contractor personnel during contract performance discover unattended classified material or an insecure/unattended security container they will immediately secure the classified materials and notify the AF activity’s unit security manager. During non-duty hours visitor group personnel will notify the 377 ABW Command Post at 846-3777. Classified material will be turned over to the Wing Command Post when the AF designated safe custodian cannot be contacted.

(3) If contractor personnel are required in performance of their duties to be derivative classifiers, they must have specifically been trained on derivative classification and authorized by the AF Activity to make derivative classification decisions. Procedures shall be in place to ensure said contractor/s are identified on the documents on which they make derivative classification decisions. Please note that this includes contractor cleared personnel who derivatively classify e-mail. Unless otherwise directed by a government customer, contractors have the option to use name and position or a unique personal identifier as the identification for the contractor’s cleared personnel who are authorized to make derivative classification decisions.

(4) Marking of Classified Information. If authorized, contractor/s shall mark classified information in accordance with current guidance such as DoDM 5200.01 to ensure compliance. Consult the AF Activity Security Manager for training and specific direction.

d. Storage of Classified Material:

(1) The visitor group will handle classified information in accordance with DoDM 5200.01, AFI 31-401, and the AF activity’s unit operating instructions (OIs), policy and/or procedures. All classified information must be stored in an approved government owned and controlled GSA-approved security container or classified information system accredited and approved for storing such classified material. The contractor is prohibited from establishing and/or maintaining a separate classified information system. All classified material will be returned and secured in the designated government security container at the end of the duty day. For this activity, the contractor/s does not require access to GSA-approved security container combinations. The contractor/s does not require alarm activation/deactivation codes to complete tasks associated with execution of contract duties.

(2) Under the terms of this agreement, the AF activity will have access to and control all security containers. The responsibility for setting the storage container combination rests with the AF activity in accordance with the policy/procedures. Each container will have a government safe custodian appointed. The Standard Form (SF) 700, Security Container Information, will be used to identify persons responsible for the container. The first name listed on the SF 700 may not be a contractor. This form will be posted inside the locking drawer of each security container.

e. Transmission and Transportation of Classified Material:

(1) Contractor/s may be authorized to receive accountable mail if listed on the Air Force Form 4332 (Accountable Communications Receipt Authorization), signed by the AF activity commander/director. However, if examination of the interior contents of accountable mail reveal classified information inside, the contractor will safeguard the material and notify an appropriate government representative and ensure the transfer of the classified information to government control. The on-base visitor group contractor/s are not authorized for direct receipt (by signing the AF Form 310) or dispatch of classified material in support of the contract associated with this VGSA and/or at location of the INSERT ORGANIZATION and ADDRESS (Example: the Operationally Responsive Space Office, 2351 Carlisle Blvd, SE, Buildings 404 & 277, Kirtland AFB, NM 87117) unless having been specifically authorized in writing to do so by the CSO.

(2) Classified material being transmitted via U.S. postal channels or GSA-approved commercial carrier shall be executed by a government representative. Contractor/s may assist in the preparation of such packages at INSERT ORGANIZATION and ADDRESS (Example: Operationally Responsive Space Office, 2351 Carlisle Blvd, SE, Buildings 404 & 277, Kirtland AFB, NM 87117) in accordance with DoDM 5200.01 and AFI 31-401, however, final processing through the classified information control system and release to approved carrier shall be by a government representative.

(3) Classified material may not be hand-carried onto or off KIRTLAND AFB by an appropriately cleared and briefed visitor group courier, unless the employee is so designated in writing by the contractor Facility Security Officer (FSO) as a courier and the AF activity’s commander or designee, per DoDM 5200.01 and AFI 31-401, Unit Security Manager.

(4) Electronic data transmission of classified information is authorized for those contractor/s with approved access and authorization to use classified Automated Information System/s (AIS) and/or information processing systems and having a related approved DD Form 2875, NATO familiarization briefing, and Derivative Classifier training. (Note: Contractor access to SIPRNet requires a NATO briefing because NATO information resides on that network). See paragraph y below for additional requirements.

(5) Verbal transmission of classified information shall only be between appropriately cleared persons with a valid need-to-know; via telephone it shall only be through electronic means over an approved secure communications system.

f. Destruction and Disposition of Classified Material: The visitor group will return all classified information jointly shared and/or involved, under the terms of this agreement, to the AF activity at the end of contract performance or when no longer required, unless authorized to do otherwise by the contracting officer. The contractor/s are not authorized to destroy any classified information without specific permission from an AF Activity Government representative. If so authorized, it must be destroyed in accordance with DoDM 5200.01-V3, AFI 31-401, and any related unit/organization operating procedures or guidelines.

g. Reproduction of Classified Material: Only AF approved and controlled reproduction equipment will be used by the visitor group, when so authorized, per DoDM 5200.01 and AFI 31-401. The visitor group cannot reproduce classified material without permission of the AF activity.

h. Security Education: The activity, security managers or security officers shall:

(1) Provide information security program training (initial, refresher and annual) and other security awareness support to integrated visitor groups regarding their individual responsibility for safeguarding classified information. Derivative classification training shall be provided if warranted. These briefings shall be tailored to those responsibilities associated with the individual’s assigned duties, and the results of the most recent self-inspections or security reviews. The AF activity will be responsible for administering security education training per DoDM 5200.01, AFI 31-601, AFI 31-401 and supplements. Contractors will not be appointed as primary or alternate security managers, nor sign any government documents, i.e. AF Forms 2586, AF Form 2587 or DD Forms as required by the appointed government security managers. However, they can be required to provide other security program support under Air Force direction, such as assisting the security manager, conducting end-of-day security checks, security training/briefings, etc.

(2) Ensure all contractor/s have completed the Standard Form (SF) 312, Classified Information Nondisclosure Agreement as applicable by verification of JPAS person summary report of each contractor employees with clearances. Applicable contractors are briefed to NATO, COMSEC and CNWDI by their company Facility Security Officer (FSO) commensurate with their involvement of a government classified contract. Contact with FSO to brief contractor personnel by electronic means commensurate with a classified contract shall be accomplished when an employee has not been briefed and it is required. Government briefed accesses are performed for intelligence information, special access information and foreign government information per the contract. When debriefed, it will be in accordance with DoDM 5200.01 and the debriefing will be recorded on AF Form 2587, Security Termination Statement by the government representative. The AF Form 2587 will be maintained by the AF activity’s unit Security Manager in accordance with Disposition of AF Records Disposition Schedule, (currently for two years). Government representatives shall remove access to classified information, and if briefed by government rep., debrief cleared contractor employees at the time of termination of employment (discharge, resignation, or retirement); when an employee's security clearance is terminated, suspended, or revoked; and upon termination of the contractor Facility Clearance.

(3) Ensure employees attend and participate collectively in the AF activity’s Security Education and Awareness Training Program, per DoDM 5200.01 and AFI 31-601 and AFI 31-401.

(4) Ensure employees are familiar with who their organization's OPSEC coordinator is and contact them for questions, concerns, or recommendations for OPSEC or Signature Management (SM) related topics. AFI10-701 OPSEC requirements apply.

(5) The contractor will brief their personnel on the provisions of this agreement, and any associated DD Form 254.

i. Reports: The visitor group must immediately submit to the CSO, in writing, reports required under any of the situations outlined in DoDM 5200.01 and AFI 31-401. The CSO coordinates and/or reports security violations committed by visitor group employees to the appropriate Defense Security Service (DSS) Cognizant Security Office (CSO), base contracting office, Higher Headquarters, and the visitor group’s HOF, if and when appropriate. The visitor group and FSO must keep the AF activity and CSO advised of any reports submitted per AFI 71-101, VOLUME 4, Counterintelligence Awareness and Briefing Program.

(1) The AF activity’s unit commander appoints inquiry or investigation officials. Inquiry or investigation officials coordinate findings and reports with the appointing official and CSO.

(2) The visitor group’s HOF will advise the CSO activity, AF Contracting Office of any changes in management, location, address, or contractual performance requirements.

m. Emergency Protection: The visitor group will make every effort to secure all classified material in an approved storage container in the event of a natural disaster, major accident, or civil disturbance per DoDM 5200.01, AFI 31-401, and AF unit’s security program OIs, Standard Operating Plan, and Safeguarding Classified Emergency Plan, if applicable. If the area is evacuated and/or the container(s) abandoned, the visitor group employees will, upon termination of the emergency condition, examine classified information/holdings to ensure there has been no compromise or loss of exposed information. In the event of missing material or possible compromise, the visitor group employees will immediately notify the AF activity’s unit security manager.

n. Protection of Government Resources: The visitor group will comply with AFI 31-101, Integrated Defense; Kirtland AFB Integrated Defense Plan and other security and safety OIs of the AF activity. File systems containing classified records will be maintained in accordance with AFRIMS.

o. Clarification of Security Requirements: The visitor group will address inquiries or questions pertaining to the provisions of DoDM 5200.01 and AFI 31-401 to the AF activity’s unit security manager. If that does not resolve the query, forward to the CSO.

p. Contract and Associated DD Form 254: The AF program, project or activity reviews the DD Form 254 and applicable security classification, declassification at least once every five years or as required, to ensure accuracy and currency. Only the CO can approve revisions/modifications of an original contract.

q. Foreign Involvement: Under the terms of this agreement, the visitor group is required to notify the AF activity and contracting office, prior to any foreign involvement, regardless of access requirements or the sensitivity of information to be disclosed (classified or unclassified).

r. Visit Requests/Personnel Security Clearances: The visitor group’s HOF will submit a visit request annually using JPAS, the government designated database prior to the original anniversary month of the DD Form 254 from block 3a., for on-base contractor employees to the AF activity unit security manager, and the CSO upon request per DoDM 5200.01, DoD 5220.22-M and this agreement. Submit a visit request using JPAS when additions and/or deletion changes occur in the contractor employee status, i.e. clearance upgrade/downgrade, new hire, termination of employment or resignation, loss of clearance. The HOF will confirm contractor employee clearance eligibility and access to classified information is commensurate with performance of the contract using JPAS. The HOF shall ensure correct employee company affiliation is updated in JPAS prior to submitting a visit request to the government organization. The AF Activity Security Manager will in-process contractors into the their JPAS Personnel Security Management Network (PSM-Net) as “Servicing.” Upon termination of employment or completion of visit, the on-base contractor representative and FSO will notify the AF Activity Security Manager to out process the contractor/s visitor/s from their PSM-Net.

s. COMSEC Information or Material: COMSEC information or material will not be released to the visitor group without the approval of the base COMSEC Officer. If approved, the contractor will only have access to COMSEC non-accountable and accountable material through the Government representative’s sub-account. Access will be controlled by the sponsoring agency. Contractor will protect COMSEC material IAW directives deemed necessary by the Installation COMSEC Officer. Access to COMSEC material by personnel is restricted to U.S. citizens holding final U.S. Government clearances.

t. Release of Information. All request for release of information shall be coordinated prior to any such public release. Under terms of this agreement, request must go through appropriate Public Affairs (PA) channels. Security and Policy Review of DoD Information for Public Release shall apply requiring a review on all official DoD information intended for public release that pertains to military matters, national security issues, or subjects of significant concern to the DoD (refer to DoDI 5230.29 for additional requirements). Only after a Security and Policy Review is approved may information associated with this contract be released.

u. Escort Authority in Controlled or Restricted Areas. The contractor does not require escort authority in Controlled or Restricted Areas. If required, the contractor/s will only escort individuals after receiving required training on fulfilling such responsibilities to include use of the Air Force Form 1109. Anyone escorted into the Controlled or Restricted Area must have a valid “need to know” and actually provide services under the contract or per specific direction of a Government representative aligned with the AF Activity.

v. Notices. Ensure all contractor users are warned and provided with appropriate privacy and security notices that DoD telecommunication and related IT/AIS systems are subject to monitoring, recording, and auditing by authorized personnel.

w. CAC. The most commonly used unclassified PKI hardware token or smart card is the CAC. On AF installations, the Air Force Military Personnel Flight (MPF) issues the CAC. The CAC is the primary hardware token for identifying individuals for logical access to NIPRNET assets and physical access to DoD facilities according to Directive-Type Memorandum (DTM) 08-003, Next Generation Common Access Card (CAC) Implementation Guidance (to be incorporated into DoD Manual 1000.13-M Volume 1). In accordance with HSPD-12, any new applicant for the Common Access Card (CAC) will require an appropriate background investigation prior to issuance of the CAC. The locally appointed Contractor Verification System (CVS) Trusted Agent (TA) individual (e.g., organizational security manager) verifies contractor access against a valid contract in the CVS before approving the request for a contractor to be issued a Common Access Card (CAC).

x. CUI, PII, or other sensitive information. Controlled Unclassified Information (CUI) is the term which collectively refers to certain types of unclassified information which also requires application of access and distribution controls and protective measures for a variety of reasons, see DoDM 5200.01-V4. Contractors will protect CUI as directed by responsible government officials and/or related contract provisions. Personally Identifiable Information (PII) includes information that identifies, links, relates, or is unique to, or describes an individual, e.g., a social security number; age; race; date of birth; etc. Accordingly, the requirements of The Privacy Act of 1974, Section 552a of Title 5, applies to government contractors and their employees working on contracts for the design, development, or operation of DoD systems of records. This includes applicable DoD Privacy Act Issuances implementing the Privacy Act, such as DoDD 5400.11. All requests for public release of records involving CUI, PII or other sensitive information, and, specifically, all requests that reference the Freedom of Information Act, shall be immediately forwarded to GCA. If the contractor suspects a breach (actual or possible loss of control, unauthorized disclosure of or unauthorized access to CUI, PII or other sensitive information) immediately notify the government Security Manager and Information Assurance Officer and take appropriate response actions as established and/or directed. Security and Policy Review of DoD Information for Public Release shall apply, see paragraph t above. The Contractor will coordinate with the GCA to ensure all employees and subcontractors are adequately trained on related CUI, PII, or other sensitive information protection, approved release processes, and breach and/or incident reporting and actions.

y. Information Technology (IT)/Automated Information System/s (AIS)/Information Systems (IS)/Local Area Network (LAN). Contractors requiring access to government IT/AIS/IS/LAN must meet authorized user access control, training, reporting and other requirements specified by the host installation and as contained in AFMAN33-282, which includes being determined to be trustworthy by a designated government official prior to LAN access being granted. Every individual who has access to the Non-Classified Internet Protocol Router Network (NIPRNET) or Secret Internet Protocol Router Network (SIPRNET), standalone systems, specialized ISs, and/or mission systems is an IS user. Access to AF ISs is a revocable privilege and will be granted to individuals based on need to know and according to DoDI 8500.2, Information Assurance (IA) Implementation; NSTISSP No. 200, National Policy on Controlled Access Protection; DoD 5200.2-R, Personnel Security Program; and Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6510.01, Information Assurance (IA) and Support to Computer Network Defense (CND). Authorized Users account creation and administration must be configured with role-based access schemes according to system policy requirements in DoDI 8500.2. All authorized users must complete DoD IA training prior to being granted access to an IS. IA training will be re-accomplished annually by the user and compliance maintained by the IAO according to DoD 8570.01-M. DoD IA training is located on Advanced Distributed Learning System (ADLS) accessible via the AF Portal. A publically accessible version of the DoD IA training is located on the Information Assurance Support Environment (IASE) website (http://iase.disa.mil/eta/ProductDownload/awareness_download.html). Failure to maintain DoD IA training results in immediate suspension of access to unclassified and classified ISs. For IS access, the IAO ensures the DD Form 2875, System Authorization Access Request (SAAR), is completed and signed. Accordingly, access requests will be documented and include DoD IA training completion, and justification for access, and clearance/background investigation verification as referenced by DoD 5200.2-R and AFI 31-501, Personnel Security Program. DD Form 2875 signatures can be “wet” or digitally signed. Access to classified ISs also requires a Standard Form 312, Nondisclosure Agreement, according to AFI 31-401, Information Security Program Management. At no time will individual personally owned computer systems be used to support government operations without prior DAA C&A approval. Introduction of privately owned devices into areas (e.g., rooms, offices) where classified information is processed and discussed is prohibitied unless approved by the DAA. If a contractor’s user’s security clearance is suspended, denied, or revoked, access to classified ISs will be immediately suspended. Unless determined by mission or operational need and documented in the IS C&A package or directed by the IP chief, the destruction of any media is the preferred method for all, rather than clearing or sanitizing.

z. Contractor-Owned Information Systems. If authorized by contract, contractor-owned or operated ISs must meet all security requirements for connection to the AF-GIG as defined in DoDI 8500.2, Enclosure 2, and AFI 31-601, Industrial Security Program Management. On base contractors within AF-controlled facilities must comply with the Federal Acquisition Regulation (FAR), Defense Federal Acquisition Regulation Supplement (DFARS) and DoD 4161.2-M, DoD Manual for the Performance of Contract Property Administration. Identification of all contractor-owned or operated IS equipment within AF facilities must be maintained by the organizational IAO. Contractor ISs connected to the AF-GIG must comply with CJCSI 6211.02, Defense Information Systems Network (DISN): Policy and Responsibilities. Any system configuration outside the normal baseline client image requires documentation in the IS C&A package and program contract.

II. Security Reviews:

a. Inspections: Staff Assistance Visits (SAVs), Information Protection Management Evaluations (IPMEs), or self-inspections will not be conducted by the CSO of the visitor group, independent of the AF activity.

b. The CSO conducts IPMEs, if applicable, in the following manner:

(1) The CSO will notify and schedule all IPMEs through the AF activity’s unit security manager. IPMEs will be conducted per DoDM 5200.01, AFI 31-401, AFI 31-501 supplements thereto and this agreement. Visitor group will maintain portions of the Industrial Security Report that are applicable to their operation. The visitor group is not required to acknowledge receipt, nor respond unless directed to do so in the report.

(2) The AF activity’s IPME or self-inspection will include the visitor group. The visitor group will also be included in the AF activity’s annual security self-inspection program. The AF activity will use the VGSA and the 377 ABW/IP self-inspection criteria to monitor unit and visitor group’s performance and compliance. The Air Force activity will provide portions of the SI Report that are applicable to the contractor’s operation (if any). Document and maintain the inspection report as required by DoDM 5200.01, AFI 31-401, and AFI 31-601, and supplements.

III. Expenditure of Funds for Security:

This agreement is not an authorization for a commitment of funds. Nothing in this agreement shall be construed to impose any liability on the part of the U.S. government for injury to the agents, employees of the visitor group, its subcontractors, assignees, or other individuals acting for or on behalf of the visitor group, to the property of the same, nor shall anything in this agreement be construed to modify the provisions of existing contracts.

IV. Review of this Agreement:

All parties must review this agreement at least annually for accuracy. The AF activity is responsible for keeping this agreement current. In addition, the AF activity will keep on file copies of the evaluations and self-inspections or equivalent reviews for the last two years. Copies of reports may be made available to the visitor group for their files.

V. Other:

a. Forms: Upon request, the AF activity may furnish government forms and applicable AFIs, OIs, and/or unit security procedures and plans required in support of this agreement. (Note: Typically however, such documents are integrated into AF Activity unit/organizational process and procedures and briefed or made available to contractor/s through sites such as Air Force e-Publishing and other AF Activity electronic sites or communications to include e-mail).

b. Sub-contracts: A VGSA shall be initiated whenever the HOF or on-base visitor group enters into a sub-contract arrangement with another contractor for classified performance prior to on-base operations at Kirtland AFB. This VGSA must address the subcontractor operation separately. The AF activity, visitor group or its HOF, as applicable, and all sub-contractors must sign the agreement. A separate DD Form 254 is completed for each subcontractor requiring access to classified information. Subcontractors must execute a separate and/or independent VGSA with the installation when not collocated (i.e., not working at the same military reservation) with the prime contractor. If at the same location, a subcontractor signature indicating acknowledgement of the prime contractor VGSA requirements is acceptable. The visitor group or its HOF as applicable is responsible for preparing the DD Form 254 for any subcontractors and must provide a copy to the CSO. Prime contractors are responsible for ensuring the subcontractor has acknowledged in writing the VGSA prior to beginning on-base operations. The prime contractor is responsible for forwarding the subcontractor’s acknowledgement to the unit security manager and the 377 ABW/IP office. The AF activity ensures that all questions pertaining to the DD Form 254 are resolved. The HOF (normally FSO) signs item 16 of the DD Form 254 for subcontracts and distributes to the 377 ABW/IP office, the security manager and the program manager.

c. Notification: Notify the CSO NLT 10 days prior to contract completion or 30 days prior to shutdown on KIRTLAND AFB in order to review contractor’s operations to ensure proper disposition of classified materials per DoDM 5200.01, AFI 31-401, and this security agreement.

d. Government Liability: Nothing in this agreement shall be construed to impose any liability on the part of the U.S. government for injury to the agents, employees of the contractor, its subcontractors, assignees, or other individuals acting for or on behalf of the contractor, to the property of the same, nor shall anything in this agreement be construed to modify the provisions of existing contracts.

Chief, Information Protection xxxxxxxxxxxxxxxxxxxxxxx Date Government Program Manager

Security Manager xxxxxxxxxxxxxxxxxxxxxx Date Contractor Program Manager xxxxxxxxxxxxxxxxxxxxxx Date Contractor FSO