Attch_3_-_DD_Form_254.pdf

CONTINUATION OF DD 254 FOR FA9451-17-S-0008

8. ACTUAL PERFORMANCE

a. LOCATION

TBD

b. CAGE CODE

TBD

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

TBD

Item 10.a.: The contractor is governed by AFMAN 33-283, Para 7.2.6 Air Force COMSEC guidance.

Item 10.b.: The contractor is permitted access to RESTRICTED DATA (RD) in the performance of this contract. Access to RD requires a final U.S. Government clearance at the appropriate level.

Item 10.d.: The contractor is permitted access to Formerly Restricted Data (FRD) in the performance of this contract.

Access to FRD requires a final U.S. Government clearance at the appropriate level.

Item 10.e.(2).: Non-SCI work will only be performed within government accredited facilities. Prior approval of the contracting activity is required for subcontracting. Access to intelligence information requires a final U.S. Government clearance at the appropriate level. Attachments will be provided upon award of contract.

Item 10.g.: The contractor is permitted access to North Atlantic Treaty Organization (NATO) information in performance of this contract. The government project manager is the designated representative that will ensure the contractor Facility Security Officer and concerned employees are NATO briefed prior to access being granted. Prior approval of the contracting activity is required for subcontracting. Access requires a final U.S. Government clearance at the appropriate level. Forward NATO classified materials needed by the contractor only from an Air Force Sub-registry directly to the contractor concerned.

Contractor is cleared by DSS to have access to NATO. Please have your facility security officer contact DSS immediately for NATO access. No NATO access will be allowed until DSS has provided you with the access and it is reflected in the Industrial Security Facilities Database (ISFD).

Item 10.h.: The contractor is permitted access to Foreign Government Information. Access to Foreign Government information requires a final U.S. Government clearance at the appropriate level.

Item 10.j.: FOUO information provided under this contract shall be safeguarded as specified in For Official Use Only (FOUO) Addendum. See DoDM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI), Enclosures 3 & 4 and DoD 5400.7-R/Air Force Manual 33-302, DoD Freedom of Information Act (FOIA) Program, for requirements.

Item 10.k.: Access to SIPRNET is required in performance of this contract.

Item 11.c.: The contractor requires access to classified source data up to and including SECRET in support of the work effort.

The TBD Contractor is only authorized to store SECRET at their off base facility. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, Chap. 4, and use of bibliography, classification, declassification, and markings will be in accordance with EO 13526, the DoDM 5200.01, Volume 2, Marking of Classified Information, 24 Feb 2012, and AFI 16-1404, Information Security Program.

Item 11.d.: The contractor must provide adequate storage for classified hardware to the level of SECRET which exceeds two cubic feet and is of size or quantity that cannot be safeguarded in an approved storage container.

Item 11.g.: The contractor is authorized to use the services of Defense Technical Information Center (DTIC) and is required to prepare and process a DD Form 1540, Registration for Scientific and Technical Information Services, and DD Form 2345, Military Critical Technical Data Agreement. The contracting activity must be involved in certifying need-to-know to DTIC.

If you need help registering or filling out the forms please contact the DTIC Office at 1-800-225-3847.

Item 11.h.: COMSEC material/information may not be released to DOD contractors without Air Force Cryptological Support Center (AFCSC) approval. Contractor must forward requests for COMSEC material/information to the COMSEC officer through the program office.

FA9451-17-S-0008

Attachment 3

Item 11.i.: Any transfer or processing of classified or sensitive information via electronic methods (e.g., facsimile, telemetry, voice, and computer) must be protected by implementing an appropriate combination of countermeasures such as encryption devices and sound practices and procedures. The specific countermeasures used, must be coordinated by the Project Manager for approval through the AFRL/RVIC, ISSM/O (IA). TEMPEST requirements apply to the SCIF execution location. See Defense Federal Acquisition Regulation Supplement (DFARS) Clause 252.239-7000, Protection Against Compromising Emanations, dated 25 Jun 04, revised 10 Jan 08; Intelligence Community (IC) Tech Spec‐for ICD/ICS 705, Technical Specifications For Construction and Management of Sensitive Compartmented Information Facilities, version 1.3, dated 10 Sep 15; Committee on National Security Systems Advisory Memorandum (CNSSAM) TEMPEST/01-13, Red/Black Installation Guidance, dated 17 Jan 14.

SENSITIVE INFORMATION:

Any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled under Section 552a of Title 5, U.S. Code (The Privacy Act), but which has not been specifically authorized under criterions established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy.

NOTE: Within the Air Force, sensitive information includes, but is not limited to, information which could:

(1) Be useful to a hostile agent in developing countermeasures.

(2) Involving new or high technology.

(3) Involve key indicators of operational capabilities which could be used by hostile agents to determine operational capabilities, weaknesses, and wartime missions.

Protecting. The application of government-approved protection equipment, devices, techniques or services to C4 systems over which sensitive information is transmitted.

Government - Approved Protection. Equipment or techniques that have been determined by National Security Agency (NSA) or the National Institute for Standards and Technology (NIST) to meet certain prescribed government security standards for the protection of sensitive information being transmitted over C4 systems.

Securing. Applying NSA-approved COMSEC Equipment, devices, techniques, or services to C4 systems over which classified information is transmitted.

Item 11j.: OPSEC. The contractor shall provide operations security (OPSEC) protection for all sensitive/critical information in accordance with AFI 10-701 and the (RV/RD OPSEC Plan or specific Program OPSEC Plan). The applicable Critical Information List (CIL) will be provided under separate cover. It is incumbent upon the contractor to request this document via the contracting officer or directly to the OPSEC Program Office. The contractor shall describe the steps necessary to protect sensitive and Critical Program Information (CPI) to their staff and communicate any sensitivity to the government for the work they complete. The contractor will include OPSEC awareness, Program Protection, and Counter Intelligence education and awareness training to all personnel as part of their standard security program on an annual basis. New contracted employees shall be trained within 90 days. Technology Protection unique security measures may apply. The contractor must also adhere to any Program Protection Plans (PPP) that may cover the protection of sensitive and/or CPI under their respective contract. On-site/on-base contractors will participate in the ongoing efforts and requirements laid out by the PRS OPSEC Program and Program Protection Lead.

Items intended for public release shall be processed through the internal AFRL RD/RV review process (OPSEC Tool). Final approval must occur prior to release outside of government channels. Items submitted to the OPSEC Tool must derive from a government representative if being released by a DoD contractor. Unclassified information does not equal publically releasable. All information deemed FOUO or unclassified must be marked according to the originating office's instructions and AFI 61-201.

Information requested by the media or members of the public shall be processed through, referred to the 377th ABW Public Affairs Office. The 377th ABW Public Affairs Office will work with the designated AFRL POCs to provide a proper response.

FA9451-17-S-0008

FOIA requests for information are to be worked by the government Office of Primary Responsibility (appointed by the 377th FOIA Office) and the AFRL FOIA office. An OPSEC assessment will be completed on all information being released via the

FOIA.

Proprietary information must be protected in accordance with non-disclosure and other applicable contractual (if any) agreements.

Item 11.l.: See Section I of the general provisions for the clause titled Notification of Government Security Activity. AF FAR Sup 5352.204-9000. Prior to classified AIS processing, the contractor will ensure that computer systems comply with Chapter 8 of the NISPOM.

Item 13.:

AFRL/RVKDL, CO, Deborah Moyer, 3550 Aberdeen Avenue SE, Kirtland AFB, NM 87117:

Date

AFRL/RDMS, Industrial Security, 3550 Aberdeen Avenue SE, Kirtland AFB, NM 87117:

Date

AFRL/RDMS (OPSEC Security), 3550 Aberdeen Avenue SE, Kirtland AFB, NM 87117:

Date

AFNWC/NT2 (SIO), 1350 Wyoming Blvd SE, Kirtland AFB NM 87117:

Date

AFRL/RVIC ISSM/O (IA), 3550 Aberdeen Ave SE, Kirtland AFB, NM 87117:

Date

377 MSG/SCXS (COMSEC), 2000 Wyoming Blvd SE, Kirtland AFB, NM 87117:

Date

AFRL/RDMS, Chief Information Protection (IP), Robert Clougherty, KAFB, NM:

Date:

FA9451-17-S-0008

TEMPEST SECURITY REQUIREMENTS

The contractor shall ensure that TEMPEST conditions related to this contract are minimized.

The contractor shall provide countermeasures assessment data to the Contracting Officer (CO), with an informational copy to AFRL/RVIC, ISSM/O (IA), 3550 Aberdeen SE, Kirtland AFB, NM 87117, in the form of a TEMPEST Emission Security Protection Assessment Request (ESPAR). The ESPAR shall provide only specific responses to the data required in paragraph c. below; the contractor’s standard security plan shall not be used as a “stand-alone” ESPAR response. The contractor shall not submit a detailed facility analysis/assessment. The ESPAR information will be used by the government TEMPEST authority to complete a TEMPEST Countermeasures Assessment of the contractor’s facility using current Air Force TEMPEST directives. TEMPEST is applied on a case-by-case basis and further information may be required to complete the ESPAR; should this be the case, the contractor shall provide this information to the contracting officer when requested. After evaluation of the ESPAR by the government TEMPEST authority, additional TEMPEST requirements may be necessary. When changes to the information required in paragraph c. below occur (including, but not limited to, relocation of equipment from the originally approved room, or increasing the classification level or volume of processing), the contractor shall submit to the CO a new ESPAR, with an informational copy to AFRL/RVIC, ISSM/O (IA), address as shown above, identifying the new configuration at least thirty (30) days before the changes occur; the contractor shall not commence SECRET or higher processing with the new configuration until receiving approval to do so from the CO.

ESPAR Contents:

SYSTEM DESCRIPTION:

SYSTEM/FACILITY: Full name and address of company submitting request and RFP/contract number and duration.

Manufacturer, model, and serial number of all electronic processing equipment that will be used for processing classified information (SECRET and above). Also, provide a brief title identifying the overall system or facility (e.g., XYZ missile word processing system, ABC aircraft interactive graphics system, etc.).

LOCATION: Identify the address (including city, state, zip code, facility, building and room number) where the system and facility are located.

RESPONSIBLE PERSONNEL

SECURITY OFFICER/MANAGER: Provide name, title, office symbol and telephone number. Include the company appointed TEMPEST authority, if applicable.

SYSTEM CUSTODIAN: If different from c(2)(a) above, provide name, title, office symbol and telephone number.

OPERATIONAL RISK: Level/amount of classified: Identify the levels of classification (including specific designator, such as SCI, SAP, SIOP, etc.) that will be processed, the estimated volume per day/month for each level expressed as a percent (of total material processed) for each level. If time-sharing an advice, list classification(s), volume(s), and percentage(s) of use by other program(s). Volume may be described in data bytes/day, lines/day, pages/day or hours/day.

The prime contractor shall ensure that all subcontractors/vendors are included as part of their TEMPEST.

Subcontractors/vendors are subject to comply with Air Force TEMPEST requirements.

Classified processing shall not begin until specific written approval/authorization, including approval for changes required pursuant to paragraph c above, are provided by the Contracting Officer based on an TEMPEST certification letter issued by the TEMPEST authority. The TEMPEST approval authority is the Air Force Certified Tempest Technical Authority

(AFCTTA).

Use of any telecommunications system or a device to include, but not limited to; cellular phones, hand-held radios, beepers/pagers, cordless telephones, cordless microphones, facsimile machines and computers constitutes consent to monitoring in accordance with AFI 10-712, (TMAP).

TEMPEST requirements apply to the SCIF execution location. See Defense Federal Acquisition Regulation Supplement (DFARS) Clause 252.239-7000, Protection Against Compromising Emanations, dated 25 Jun 04, revised 10 Jan 08;

Intelligence Community (IC) Tech Spec‐for ICD/ICS 705, Technical Specifications For Construction and Management of Sensitive Compartmented Information Facilities, version 1.3, dated 10 Sep 15; Committee on National Security Systems Advisory Memorandum (CNSSAM) TEMPEST/01-13, Red/Black Installation Guidance, dated 17 Jan 14.

FA9451-17-S-0008

COMSEC ACCESS AND /OR ACCOUNT

General Guidance Access to classified COMSEC information shall be restricted to U.S. citizens who have been granted a final security clearance by the U.S. Government, have a valid need-to-know (as defined in the National Industrial Security Program Operating Manual), and have successfully completed a non-lifestyle, counterintelligence scope polygraph examination, when required by the U.S. Government or appropriate security office, administered in accordance with DoD or agency requirements and applicable law. Non-U.S. citizens, including immigrant aliens, are not eligible for access to classified COMSEC information. For access to some types of COMSEC information a Cryptographic Access Briefing or COMSEC Briefing may be required. (NSA Contractor accounts refer to NSA/CSS PM 3-16 Para 7 and 8 for briefings required under specific types of access.) Access to unclassified controlled cryptographic items (CCI) will be limited to U.S. Citizens who have a need for such access.

If a National Security Agency (NSA) Contractor COMSEC Account is established (or already exists), NSA/CSS Policy Manual 3-16 and appropriate follow-on documents shall apply. If contractor personnel will have access to COMSEC information via an Air Force COMSEC user account, USAF COMSEC instructions and regulations (e.g.: AFMAN 283), Command COMSEC supplements (and appropriate follow-on documents) and guidance provided by the supporting AF COMSEC Office regarding operation of Air Force COMSEC user accounts shall apply.

All individuals with access to COMSEC information via an AF COMSEC user account who:

• Have access to cryptographic media classified SECRET or above;

• Operate Key Generating equipment (e.g.: KG-83, KoK-22, Etc);

• Prepare, authenticate, or decode nuclear control orders (actual or exercise);

• Are responsible for keying cryptographic equipment to SECRET or above; or

• Are responsible for crypto engineering or designated installation technicians;

MUST be enrolled in the AF Cryptographic Access Program PRIOR to having such access.

Audit and inspection of NSA contractor COMSEC accounts shall be in accordance with NSA/CSS PM 3-16 Section XVII.

Audit and Inspection of AF COMSEC user accounts shall be in accordance with AFMAN 33-283. COMSEC and non- COMSEC inspections of AF user accounts will not be conducted concurrently.

The POC for Communications Security (COMSEC) at Kirtland Air Force Base is:

377 MSG/SCXS, 2000 Wyoming SE, Bldg. 20604, Room B-16, Kirtland AFB, NM 87117-5607 (505) 846-1218

FA9451-17-S-0008

FOR OFFICIAL USE ONLY (FOUO) ADDENDUM

The following procedures will be used to protect FOR OFFICIAL USE ONLY (FOUO) material:

1. HANDLING: Access to FOUO material shall be limited to those employees needing the material to do their jobs. The FOUO marking is assigned to material created by a DoD user agency. FOUO is not a classification, but requires extra precaution to insure it is not released to the public.

2. MARKING UNCLASSIFIED: Mark unclassified documents containing FOUO; “UNCLASSIFIED//FOR OFFICIAL USE ONLY” at the bottom of each page and back cover (if any). Paragraphs, sentences, illustrations, and figures that are deemed to be FOUO will be portion marked (U//FOUO) at the beginning of the item. FOUO material released to a contractor by a DoD user agency must have the following statement on the front page or cover: “THIS DOCUMENT

CONTAINS MATERIAL EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FREEDOM OF

INFORMATION ACT. EXEMPTION(S)_ APPLY.”

3. MARKING CLASSIFIED: In a classified document, mark:

a. An individual paragraph that contains FOUO, but not classified material by placing “U//FOUO” at the beginning of the paragraph.

b. The top and bottom of each page that has both FOUO and classified material with the highest security classification of the material on that page.

material.

c. “UNCLASSIFIED//FOR OFFICIAL USE ONLY” at the bottom of each page that has FOUO but no classified

d. If a classified document also contains FOUO material or if the classified material becomes FOUO when declassified, place the following statement on the bottom of the cover or the first page under the classification marking:

“NOTE: If declassified, review the document to make sure material is not FOUO and not exempt under AFI 37-131 before public release.”

e. Mark other records such as computer print outs, photographs, films, tapes, or slides “UNCLASSIFIED//FOR OFFICIAL USE ONLY” so the receiver or viewer knows the record contains FOUO material.

f. Ensure documents that transmit FOUO material call attention to any FOUO attachments.

4. FOUO DETERMINATION: All documents determined to contain FOUO information will identify the FOUO exemption criteria from the Freedom Of Information Act (FOIA), by citing the applicable paragraph number. FOUO material released to a contractor by a DoD user agency must have the following statement on the front page or cover: “THIS DOCUMENT

CONTAINS MATERIAL EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FREEDOM OF

INFORMATION ACT. EXEMPTION(S)_ APPLY.”

5. STORAGE: During normal duty hours, place FOUO material in an out-of-sight location, if your work area is accessible to persons who do not have a valid need for the material. After normal duty hours, store FOUO material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided. When there is not internal security, locked buildings or rooms usually provide adequate after-hours protection.

For additional protection, store FOUO material in locked container such as file cabinets, desks, or bookcases. Expenditure of funds for security container or closed areas solely for the protection of FOUO material is prohibited.

6. TRANSMISSION: FOUO material shall be transmitted by the same methods as other unclassified material. Discussion of FOUO material on the telephone is authorized if necessary for the performance of the contract. FOUO material may be transmitted over telephone lines in digital form, by telecopies, or by other DSN Teletype lines without encryption.

7. RELEASE: FOUO material shall not be released outside the contractor’s facility except to representatives of the DOD.

8. DESTRUCTION: When no longer needed, FOUO material shall be disposed of by a method that precludes its disclosure to unauthorized individuals.

FA9451-17-S-0008