Attachment_3-Draft_FA9401-15-R-8002_(DD254).pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

SECRET

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER

a. ORIGINAL (Complete date in all cases)

DATE (YYYYMMDD)

b. SUBCONTRACT NUMBER b. REVISED (Supersedes all previous specs)

REVISION NO.

X c. SOLICITATION OR OTHER NUMBER

FA9401-15-R-8002

DUE DATE (YYYYMMDD)

20150921

c. FINAL (Complete Item 5 in all cases)

4. IS THIS A FOLLOW-ON CONTRACT? YES X NO. If Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES X NO. If Yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

TBD

b. CAGE CODE

TBD

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

TBD

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE

b. CAGE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION

Air Force Nuclear Weapons Center/NT

8601 Frost Ave, Bldg 20202

Kirtland AFB, NM 87117

b. CAGE CODE

N/A

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

377 ABW/IP

4500 Biggs Ave SE

Kirtland AFB, NM 87117

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Nuclear Surety Scheduling: The Contractor shall integrate, develop, and deliver high fidelity, in-depth Master Schedules for nuclear certification activities required for each program (estimated as six (6) ACAT I programs and three (3) new MILCON facilities) as well as an estimated thirteen (13) on-going, recurring sustainment activities to include risk assessment in support of achieving nuclear certification.

10. CONTRACTOR WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION X a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY X

b. RESTRICTED DATA X b. RECEIVE CLASSIFIED DOCUMENTS ONLY X

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION X c. RECEIVE AND GENERATE CLASSIFIED MATERIAL X

d. FORMERLY RESTRICTED DATA X d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE X

e. INTELLIGENCE INFORMATION e. PERFORM SERVICES ONLY X

(1) Sensitive Compartmented Information (SCI) X f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES X

(2) Non-SCI X g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER X

f. SPECIAL ACCESS INFORMATION X h. REQUIRE A COMSEC ACCOUNT X

g. NATO INFORMATION X i. HAVE TEMPEST REQUIREMENTS X

h. FOREIGN GOVERNMENT INFORMATION X j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS X

i. LIMITED DISSEMINATION INFORMATION X k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE X

j. FOR OFFICIAL USE ONLY INFORMATION X l. OTHER (Specify)

Government Notifications; Security Education and Training; Foreign Disclosure; AFFARS 5352.204-9000 Clause

X

k. OTHER (Specify)

SIPRNet; IT/AIS/IS/LAN

DD FORM 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE. Adobe Professional X

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release Direct X Through (Specify)

All requests for release of information must have the approval of the Program Manager and the 377 ABW/PA Public Affairs Office, Kirtland AFB, NM 87117.

Requests should be submitted 60 days prior to expected date of release.

DoD information requested by the media or members of the public or proposed for release to the public by DoD civilians, military personnel, or contractors shall be processed in accordance with DoD Manual 5200.01, DoD Information Security Program, DoD Directive 5230.09, Clearance of DoD Information for Public Release, DoD Instruction 5230.29, Security Policy Review of DoD Information for Public Release, AFMAN 33-302, Freedom of Information Act Program, and

AFI 35-102, Security and Policy Review Process, as applicable.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

The contractor is designated an Integrated Visitor Group. The National Industrial Security Operating Manual (NISPOM) applies, as does applicable

DoD and AF guidance associated with Integrated Visitor Group operations conducted on installations, including but not limited to DoD Manual

(DoDM) 5200.01, DoD Information Security Program, Volume 1, Volume 2, Volume 3, and Volume 4 and AFI16-1404 Air Force Information

Security Program and related Supplements thereto (notify government Program Manager and/or Contract Officer if guidance clarification is required). Access is limited to “need-to-know” contract-specific classified performance information. The Contractor is prohibited from establishing separate classified information controls.

Contractor will follow CG-W-5, Joint DOE/DoD Nuclear Weapon Classification Policy, TCG-WPMU-2, Joint DOE/DoD Topical Classification

Guide for Weapon Production and Military Use, GG-3, Joint DOE/DoD General Guidance for UCNI, and Intercontinental Ballistic Missile (ICBM)

Security Classification/Declassification Guide (SCG) dated 23 Oct 2008, and other classification guidance as required and provided to support related mission work. Documents classification marking will be in accordance with E.O. 13526, and DoDM 5200.1M, Volume 2, Marking of

Classified Information, 24 Feb 2012, and supplements thereto.

See DD FORM 254 Block 13 Security Guidance Continuation Pages for additional guidance, Addendum/s, and Attachment/s.

THIS DD FORM 254 HAS BEEN REVIEWED AND COORDINATED BY (Digital or Print Name, Org and Sign):

AFNWC/NTS AFNWC/OS AFNWC/IT 377 ABW/IP Government PM

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. X Yes No

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

See DD FORM 254 Block 13 Security Guidance Continuation Pages. Visitor Group Security Agreement (VGSA) is required for locations.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. X Yes No

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

Installation commander has elected to retain security cognizance, CSO is relieved of responsibility to inspect. The Information Protection Office (IPO) at performance locations listed in 8a, have inspection oversight of activities on their respective installations. Each IPO will provide day-to-day security oversight and conduct required inspections IAW DD FORM 254, applicable DoD and AFI guidance, and applicable Visitor Group Security Agreement (VGSA). Other functional experts such as COMSEC, OPSEC, IA/COMPUSEC, etc., may be included when warranted.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

Honey M. Smalls

b. TITLE

Contracting Officer

c. TELEPHONE (Include Area Code)

(505) 846-4579

d. ADDRESS (Include Zip Code)

AFNWC/PZIE

8500 GIBSON BLVD SE, Bldg 20202, Rm 237

KIRTLAND AFB NM 87117

17. REQUIRED DISTRIBUTION

X a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

e. SIGNATURE

DD FORM 254 (BACK), DEC 1999

Item/Block 13 Security Guidance Continuation Page 1 of 3.

Ref 8a. Additional performance locations include:

Air Force Nuclear Weapons Center/NT

8601 Frost Ave, Bldg 20202

Kirtland AFB, NM 87117

Temporary duty locations will include Hill AFB UT, Eglin AFB FL, Fort Worth TX and other locations if necessary.

Ref 10a. Contractor will comply with relevant NISPOM provisions in regards to all Communications Security (COMSEC) information and/or

Cryptologic (CYRPTO) items. The Contractor will access, handle, and protect COMSEC and/or CYRPTO per direction of government representatives

IAW AFMAN33-283 and other guidance/directives as deemed necessary by the responsible installation COMSEC Manager. Access to COMSEC material by personnel is restricted to U.S. citizens holding final U.S. Government clearances. Such information is not releasable to personnel holding only reciprocal foreign clearances. The Contractor will seek clarification from the government Contracting Officer, Program Manager or 377

MSG/SCXS for any area dealing with COMSEC and/or CYRPTO they are unsure of in regards to procedures, access, handling, safeguarding, etc. The

Contractor will make immediate notification to the responsible government security manager and/or 377 MSG/SCXS, the installation COMSEC

Manager, of any situation potentially putting at risk any COMSEC or CYRPTO information, material, items, etc.; and if necessary, take immediate safeguarding measures deemed appropriate and reasonable until properly relieved by the government Security Manager, and/or 377 MSG/SCXS, the installation COMSEC Manager.

Ref 10b. The contractor is permitted access to the RESTRICTED DATA (RD) in performance of this contract only at the performance location/s specified by the organization in 8a, unless specifically authorized and documented otherwise by the government Contracting Officer; and only when all related access requirements stated below have been met. Access to the RD requires a final U.S. Government clearance at or above the appropriate level commensurate with the information concerned. Contractors granted access to RD information will be based on verification of final security eligibility, need-to-know, and only after the individual receives an RD indoctrination briefing. RD is not a dissemination control marking, but instead a unique category of classified information defined by section 2014 of title 42, U.S.C. (also known and hereafter referred to as “The Atomic Energy Act of 1954, as amended.” Guidance on policies and procedures governing access to and dissemination of RD, including CNWDI and Sigma categories, which are subsets of RD is provided by DoDI 5210.02. The contractor shall comply with applicable RD provisions in DoDM 5200.01, DoDI 5210.02, and AFI16-

1404; and notify the government Program Manager and/or Contracting Officer of any provisions or requirements therein which they are unable to meet or require clarification. Contractor personnel with access to RD must be trained on the procedures for derivative classification, marking, recognizing, and handling RD information and documents. Requests for access to RD in the possession of the DOE or other Federal agencies designated by the DOE, other than DoD will only be made through the appropriate government responsible program management office and utilize DOE Form 5631.20, “Request for Visit or Access Approval.” Dissemination of RD information will be made only after the holder of the information has verified: (a) The identification of the prospective recipient, (b) The validity of the prospective recipient’s clearance, (c) The need to know of the prospective recipient in connection with official duties. RD is never automatically declassified and such information must not include declassification instructions; never annotate a declassification instruction on documents containing solely RD/FRD. If a RD document also contains classified national security information annotate the “Declassify On:” line with “Not Applicable to RD/FRD portions” Mark RD in accordance with DoDM 5200.01, Volume 2, Enclosure 4.

Make every attempt to not comingle RD/FRD/CNWDI with non-RD/FRD/CNWDI classified national security information; notify the government

Program Manager if this must be done. The contractor shall maintain a record of individuals with access to RD (and CNWDI if applicable) and associated indoctrination and recurring training details until directed otherwise. The FSO shall document related access in JPAS.

Ref 10c. The contractor is permitted access to Critical Nuclear Weapons Design Information (CNWDI) in performance of this contract only at the performance location/s specified by the organization in 8a, unless specifically authorized and documented otherwise by the government Contracting

Officer; and only when all related access requirements stated below have been met. Access to CNWDI is on a need-to-know basis and a special DoD briefing (RD and CNWDI Nuclear Information Security Indoctrination Briefing) is required. At a minimum, the required security clearances for personnel eligible for access to CNWDI shall be final TOP SECRET or SECRET (at or above level required, as appropriate). Written or oral communication of CNWDI shall be strictly limited to those personnel who have a need to know. Management personnel at all levels shall not automatically approve requests for access to CNWDI, but shall insist upon full justification and shall reject any requests that are not completely justified. Briefing and access authorizations will be recorded in appropriate security records (e.g., JPAS). Contractor personnel with access to CNWDI must be trained on the procedures for recognizing and handling CNWDI information and documents. Mark in accordance with DoDM 5200.01, Volume

2, Enclosure 4, as CNWDI is a subset of RD, use the same rules for marking CNWDI information as for marking RD, except “-N” shall be appended to the banner and portion markings. Make every attempt to not comingle RD/FRD/CNWDI with non-RD/FRD/CNWDI classified national security information; notify the government Program Manager if this must be done. Processing or transmitting CNWDI is authorized only on systems specifically accredited for CNWDI; and when related system use is authorized by the government Program Manager and/or Contracting Officer.

Contractors shall not disclose CNWDI without the prior written approval by the government Contracting Officer.

Ref 10d. The contractor is permitted access to Formerly Restricted Data (FRD) in performance of this contract only at the performance location/s specified by the organization in 8a, unless specifically authorized and documented otherwise by the government Contracting Officer; and only when all related access requirements stated below have been met. FRD is not a dissemination control marking, but instead a unique category of classified information defined by section 2014 of title 42, U.S.C. (also known and hereafter referred to as “The Atomic Energy Act of 1954, as amended.”

Guidance on policies and procedures governing access to and dissemination of FRD is provided by DoDI 5210.02. The contractor shall comply with

DoDI 5210.02 and notify the government Program Manager of any provisions or requirements therein they are unable to meet. To have access to FRD an individual must have a valid security clearance at or above the level commensurate with the information concerned, and a need-to-know. There is no special indoctrination required to have access to FRD. Contractor personnel with access to FRD must be trained on the procedures for derivative classification, marking, recognizing, and handling FRD information and documents. Mark FRD in accordance with DoDM 5200.01, Volume 2, Enclosure 4. Never annotate a declassification instruction on documents containing solely RD/FRD. Make every attempt to not comingle

RD/FRD/CNWDI with non-RD/FRD/CNWDI classified national security information; notify the government Program Manager if this must be done.

Item/Block 13 Security Guidance Continuation Page 2 of 3.

Ref 10g. North Atlantic Treaty Organization (NATO) Information. Access to NATO information based on verification of security eligibility and a need-to-know. All contractor personnel requiring direct access to NATO or who require Secret Internet Protocol Router Network (SIPRNET) access must receive a NATO briefing to facilitate potential access to NATO classified information, and acknowledge in writing. COSMIC TOP SECRET (CTS) requires a final U.S. Top Secret security clearance; NATO SECRET (NS) and NATO CONFIDENTIAL (NC) require a final U.S. Secret security clearance; and CTS ATOMAL (CTSA); NS ATOMAL require a final U.S. Top Secret security clearance and read in to RD per AFI16-1404; NC

ATOMAL require a final U.S. Secret security clearance and read in to Restricted Data per AFI16-1404. For NATO Restricted (NR) no security clearance is required. Access to NATO Unclassified (NU) does not require indoctrination. The FSO will ensure NATO access for contractors must be entered into JPAS. Terminate an individual’s access to NATO when no longer needed and ensure appropriate officials brief the individual their access has been terminated; If the individual refuses to acknowledge a NATO brief and related access, have a witness sign a statement indicating the individual was informed the access was terminated); and verify the NATO access has been removed from JPAS. Use the appropriate NATO coversheet to protect

NATO information when outside of approved storage containers and areas. For marking instructions refer to DoDM 5200.01, Volume 2 and the current

USSAN instruction. For questions concerning security procedures consult with the organization’s NATO Subregistry or Control Point Officer or the

Wing Information Protection Office.

Ref 10h. Foreign Government Information (FGI) shall be safeguarded consistent with Executive Order 13526, Classified National Security Information, and requirements of DoDM 5200.01, except as required by the Appendix to Enclosure 4 of Volume 3; treaties; or international agreements. Information that is jointly developed with a foreign partner under a cooperative program agreement will be safeguarded in accordance with the security and disclosure provisions of the cooperative arrangement. Ensure that threats to security and security incidents pertaining to classified information, including

FGI, are reported, recorded, coordinated with the proper authorities, and, when necessary, investigated and that appropriate action is taken to mitigate damage and prevent recurrence. The prime contractor must receive approval from the government Contracting Officer to grant related access to any subcontractor.

Ref 10j. Controlled Unclassified Information (CUI) is the term which collectively refers to certain types of unclassified information which also requires application of access and distribution controls and protective measures for a variety of reasons. The attached FOR OFFICIAL USE ONLY (FOUO)

ADDENDUM, DoD CONTROLLED UNCLASSIFIED INFORMATION ADDENDUM includes requirements for handling of certain types of information. DoDM 5200.01-V4 also applies. Attachment #2, NOTICE TO ACCOMPANY THE DISSEMINATION OF EXPORT-CONTROLLED

TECHNICAL DATA also applies.

Ref 10k. SIPRNet. Secret Internet Protocol Network (SIPRNet) access is required. The contractor shall not access, download or further disseminate any special access data (i.e., intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the government Contracting Officer.

Ref 10K. IT/AIS/IS/LAN. Information Technology (IT)/Automated Information System/s (AIS)/Information Systems (IS)/Local Area Network (LAN):

The contractor will require access to the government IT/AIS/IS/LAN to perform their contractual duties. Contractors requiring access to government

IT/AIS/IS/LAN must meet authorized user access control, training, reporting and other requirements specified by the host installation and as contained in AFMAN33-282, which includes being determined to be trustworthy by a designated government official prior to LAN access being granted. At no time will individual personally owned computer systems be used to support government operations without prior DAA C&A approval. At no time will foreign nationals or foreign government personnel be granted access to any information systems with official government information associated with the contract (either processing or with data at rest) without specific prior approval from GCA and DAA C&A. Ensure all users are warned and provided with appropriate privacy and security notices that the systems they are entering are DoD systems, and thus subject to monitoring, recording and auditing by authorized personnel. In addition, in accordance with HSPD-12, any new applicant for the Common Access Card (CAC) will require an appropriate background investigation prior to issuance of the CAC.

Ref 11a. All related access to classified will only be at locations specified in item 8a unless specifically authorized in writing by Program Management and the Government Contract Officer.

Ref 11f. The contractor may require access to U.S. classified information outside the U.S., Puerto Rico, U.S. Possessions and Trust Territories in performance of duties at specific direction of the government Program Manager. Required travel is projected to be to U.S. controlled areas only within

United States Air Forces Europe (USAFE), see Item/Block 8c. Any access to Communications Security (COMSEC) information and/or Cryptologic items (CYRPTO) will be through the visited government organizations sub-account. The contractor is not required nor authorized to disclose U.S.

Information to Foreign Interests. Contractor personnel travelling overseas will ensure appropriate Antiterrorism/Force Protection (AT/FP) awareness training and information has been provided and documented by the government prior to travelling outside the continental U.S.

Ref 11h. Contractor will require access to Communications Security (COMSEC) information and/or Cryptologic items (CYRPTO) only at the on-base location and/or locations under cognizance and/or support of the organization listed in 8a. Contractor will only have access to COMSEC non-accountable and accountable material through the government representative's sub-account. Access will be controlled by the sponsoring agency.

Ref 11j. The contractor will comply with installation OPSEC programs. Contractor personnel will know who their organization’s OPSEC coordinator is and contact them for questions, concerns, or recommendations for OPSEC or Signature Management (SM) related topics. AFI10-701 OPSEC requirements apply to include being familiar with the organization’s critical information and protecting critical and/or sensitive information from disclosure. Contractor personnel will NOT publicly post or publish work-related information that potentially contains critical or sensitive information without explicit approval of their immediate supervisor, security office and/or OPSEC PM/SM/OPSEC coordinator, this includes NOT publicly disseminating, or publishing photographs displaying critical and/or sensitive information, nor publicly referencing, disseminating, or publishing critical and/or sensitive information already compromised. When directed or as part of established Standard Operating Procedures, contractor personnel will destroy (burn, shred, etc.) critical and/or sensitive unclassified information no longer needed to prevent the inadvertent disclosure and/or reconstruction of this material and implement additional protection measures as ordered by the commander, director, or an individual in an equivalent position.

Contractor personnel will report attempts by unauthorized personnel to solicit critical and/or sensitive information and treat such attempts as human intelligence (HUMINT) gathering and consider it a HUMINT incident. All contractor personnel who have been involved in or have knowledge of a possible HUMINT incident will report all facts immediately to the nearest supporting AFOSI office.

Item/Block 13 Security Guidance Continuation Page 3 of 3.

Ref 11l. Government Notifications. The Contractor will notify the government when so directed and/or specified by provisions in this DD FORM 254, related FA9401-15-C-0006 contract and/or related clauses, attachments, addendums, etc., The Contractor will immediately notify the government

Contracting Officer of any changes relating to foreign owned, controlled, or influence (FOCI) type concerns, events and/or changes which may affect the Facility Security Clearance (FCL).

Ref 11l. Security Education and Training. Contractor personnel will participate in and receive security education and training at direction of the government Security Manager to include initial, recurring and annual venues, if warranted. Training may include what defines classified information and CUI; proper protection of classified and CUI; actions to take if classified information or CUI is found unsecured, a vulnerability is noted, or a person seeks unauthorized access; a basic understanding of security policies and principles; requirements for public release of DoD information;

personnel responsibilities and the sanctions that can be applied; local threat and techniques foreign intelligence activities use; and other relevant subjects/topics. Training and use of Security Classification Guide/s (SCG/s) will also be done. Contractor personnel not completing required training may be limited or prohibited from doing government work if deemed necessary by the government Program Manager. Related training records should be maintained on file for review by the CSO.

Ref 11l. Foreign Disclosure. Foreign Disclosure of DoD information is not authorized in performance of this contract.

Ref 11l. AFFARS 5352.204-9000 Clause. This contract contains a DD Form 254, DOD Contract Security Classification Specification, and requires performance at a government location in the U.S. or overseas. Prior to beginning operations involving classified information on an installation identified on the DD Form 254, the contractor shall take the following actions:

(a) At least thirty days prior to beginning operations, notify the Information Protection Office shown in the distribution block of the DD Form 254 as to:

(1) The name, address, and telephone number of this contract company’s representative and designated alternate in the U.S. or overseas area, as appropriate;

(2) The contract number and military contracting command;

(3) The highest classification category of defense information to which contractor employees will have access;

(4) The Air Force installations in the U.S. (in overseas areas, identify only the APO number(s)) where the contract work will be performed;

(5) The date contractor operations will begin on base in the U.S. or in the overseas area;

(6) The estimated completion date of operations on base in the U.S. or in the overseas area; and,

(7) Any changes to information previously provided under this clause.

This requirement is in addition to visit request procedures contained in DOD 5220.22-M, National Industrial Security Program Operating Manual, and

DOD 5220.22-M-Sup 1.

(b) Prior to beginning operations involving classified information on an installation identified on the DD Form 254 where the contractor is not required to have a facility security clearance, the contractor shall enter into a Visitor Group Security Agreement (or understanding) with the installation commander to ensure that the contractor’s security procedures are properly integrated with those of the installation. As a minimum, the agreement shall identify the security actions that will be performed:

(1) By the installation for the contractor, such as providing storage and classified reproduction facilities, guard services, security forms, security inspections under DOD 5220.22-M and DOD 5220.22-M-Sup 1, classified mail services, security badges, visitor control, and investigating security incidents; and

(2) Jointly by the contractor and the installation, such as packaging and addressing classified transmittals, security checks, internal security controls, and implementing emergency procedures to protect classified material.

Item/Block 14. ADDITIONAL SECURITY REQUIREMENTS.

The Visitor Group Security Agreement (VGSA) is a legally binding contractual agreement between the DoD contractor and AF, and must be executed prior to initiation of on-base operations, unless an extension is specifically authorized permitting immediate on-base operational access due to mission requirements. Prime contractors are responsible for ensuring their subcontractors are knowledgeable of and comply with the applicable requirements.

Prime must include a provision in each subcontract that requires subcontractors to contact the installation commander’s designee (377 ABW/IP)

Kirtland AFB Industrial Security Office. Subcontractor must execute a separate and/or independent VGSA with the installation when not collocated (i.e.

not working at the same military reservation) with the prime contractor. If at the same location, a subcontractor signature indicating acknowledgment of the prime contractor VGSA is acceptable, prior to beginning on-base operations.

Item/Block 15. INSPECTIONS.

The Contractor will be treated as an on-base integrated visitor group and evaluated and conduct self-inspections collectively with the AF activity per

DoDM5200.001 Vol 1-4, AFI16-1404, and per other directives/instructions and/or government direction applicable as security guidance from this DD

FORM 254, VGSA, other contractual document requirements, and lawful government direction. Major security program deficiencies or non-compliance with security guidance may result in home office facility (HOF) notification, DSS CSO notification, or other agency notification if deemed warranted by the ISPM, and could have implications on contractor performance ratings/awards, and in very serious cases recommendation of invalidation of the FCL.

Item/Block 17. REQUIRED DISTRIBUTION

Ref Item 17f. Provide copy to offices listed in Item/Block 8c.

Attachment#1 to the DD Form 254. FOR OFFICIAL USE ONLY (FOUO) ADDENDUM

CONTINUATION OF DD FORM 254

SOLICITATION: FA9401-15-C-8002

DoD CONTROLLED UNCLASSIFIED INFORMATION ADDENDUM

In addition to classified information, certain types of unclassified information also require application of access and distribution controls and protective measures for a variety of reasons. Such information is referred to collectively as Controlled Unclassified Information (CUI). DoD CUI includes For

Official Use Only (FOUO), Law Enforcement Sensitive (LES), DoD Unclassified Controlled Nuclear Information (DoD UCNI), and LIMITED

DISTRIBUTION, as well as some of those developed by other Executive Branch agencies. Contractors shall comply with related CUI applicable provisions identified in DoDM 5200.01, V-4, dated February 24, 2012.

ALL DoD unclassified information MUST BE REVIEWED AND APPROVED FOR RELEASE through standard DoD Component processes before it is provided to the public. The contractor will notify the Government Contracting Officer of unauthorized disclosures of DoD CUI.

The originator of a document is responsible for determining at origination whether the information may qualify for CUI status, and if so, for applying the appropriate CUI markings.

FOR OFFICIAL USE ONLY (FOUO)

FOUO is a dissemination control applied by the Department of Defense to unclassified information when disclosure to the public of that particular record, or portion thereof, would reasonably be expected to cause a foreseeable harm to an interest protected by one or more of FOIA Exemptions 2 through 9. The document’s originator will determine at origination whether the information may qualify for FOUO status and to ensure markings are applied as required.

Contractors will comply with DoDM 5200.01, V-4, dated February 24, 2012. In regards to DoD CUI and related FOUO. The following are select areas of emphasis:

1. ACCESS/DESIGNATION: Access to FOUO material shall be limited to those employees needing the material to do their jobs. No person may have access to information designated as FOUO unless that person has been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. FOUO is not a classification. When a classified document or portion thereof is declassified, FOUO markings may be applied, if applicable, to protect the information. Marking information FOUO does not automatically qualify it for exemption from public release pursuant to the FOIA. If a request for a record is received, the information shall be reviewed to determine if it truly qualifies for exemption.

2. MARKING: Mark FOUO documents in accordance with DoDM 5200.01, V-4, ENCLOSURE 3, dated February 24, 2012, unless directed by the AF

Activity to use approved variations. For example, for any e-mail containing FOUO, ensure the subject line alerts a reader the information includes

FOUO (Subject Line Example: (FOUO) SUBJECT XYZ). Also, include the following warning Statement at the top of each email containing FOUO:

This e-mail contains FOR OFFICIAL USE ONLY (FOUO) information which must be protected under the Freedom of Information Act (5 U.S.C 552) and/or the Privacy Act of 1974 (5 U.S.C. 552a). Unauthorized disclosure or misuse of this PERSONAL INFORMATION may result in disciplinary action, criminal and/or civil penalties. Further distribution is prohibited without the approval of the author of this message unless the recipient has a need to know in the performance of official duties. If you have received this message in error, please notify the sender and delete all copies of this message.

3. STORAGE: During working hours, reasonable steps shall be taken to minimize the risk of access by unauthorized personnel (e.g., not reading, discussing, or leaving FOUO information unattended where unauthorized personnel are present). After working hours, FOUO information may be stored in unlocked containers, desks, or cabinets if Government or Government-contract building security is provided. If such building security is not provided or is deemed inadequate, the information shall be stored in locked desks, file cabinets, bookcases, locked rooms, etc. Expenditure of funds for security container or close areas solely for the protection of FOUO material is prohibited unless specifically authorized by the Government

Contracting Officer.

4. TRANSMISSION: FOUO information and material may be transmitted via first class mail, parcel post, or, for bulk shipments, via fourth class mail.

Whenever practical, electronic transmission of FOUO information (e.g., data, website, or e-mail) shall be by approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure (PKI) or transport layer security (e.g., https). Use of wireless telephones should be avoided when other options are available. Transmission of FOUO by facsimile machine (fax) is permitted; the sender is responsible for determining that appropriate protection will be available at the receiving location prior to transmission (e.g., machine attended by a person authorized to receive FOUO; fax located in a controlled government environment).

5. RELEASE: FOUO material shall not be released outside the contractor's facility except to representatives of the DOD.

6. DESTRUCTION: When no longer needed, FOUO material shall be disposed of by a method that precludes its disclosure to unauthorized individuals.

Attachment#2 to the DD Form 254

CONTINUATION OF DD FORM 254

SOLICITATION: FA9401-15-C-8002

NOTICE TO ACCOMPANY THE DISSEMINATION

OF EXPORT-CONTROLLED TECHNICAL DATA

Export of the attached information (which includes, in some circumstances, release to foreign nationals within the United States) without first obtaining approval or license from the Department of State for items controlled by the International Traffic in Arms Regulation (ITAR), or the Department of

Commerce for items controlled by the Export Administration Regulation (EAR), may constitute a violation of law.

Under 22 U.S.C. 2778, the penalty for unlawful export of items or information controlled under the ITAR is up to 2 years imprisonment, or a fine of

$100,000, or both. Under 50 U.S.C., appendix 2410, the penalty for unlawful export of items or information controlled under the EAR is a fine of up to

$1,000,000, or five times the value of the exports, whichever is greater; or for an individual, imprisonment of up to 10 years, or a fine of up to $250,000, or both.

In accordance with your certification that establishes you as a “qualified U.S. contractor,” unauthorized dissemination of this information is prohibited and may result in your disqualification as a qualified U.S. contractor, and may be considered in determining your eligibility for future contracts with the

Department of Defense.

The U.S. Government assumes no liability for direct patent infringement, or contributory patent infringement, or misuse of technical data.

The U.S. Government does not warrant the adequacy, accuracy, currency, or completeness of the technical data.

The U.S. Government assumes no liability for loss, damage, or injury resulting from manufacture or use for any purpose of any product, article, system, or material involving reliance upon any or all technical data furnished in response to the request for technical data.

If the technical data furnished by the Government will be used for commercial manufacturing or other profit potential, a license for such use may be necessary. Any payments made in support of the request for data do not include or involve any license rights.

Include a copy of this notice with any partial or complete reproduction of these data that are provided to qualified U.S. contractors.