Attachment_E_-_Security_Requirements_FINAL_6-17-15.docx

ATTACHMENT E

SECURITY REQUIREMENTS

a. General. All task orders issued under this contract will be in support of classified programs. In order to be eligible to provide support to classified programs, prime contractors (to include team members and subcontractors) should be either a United States owned firm or possess a favorable National Interest Determination if foreign owned. The company must have a final Top Secret Facility Clearance (FCL) from the Defense Security Service (DSS) Facility Clearance Branch (FCB).

The contractor must have readily available access to Defense Security Services (DSS) certified work locations for performing classified work up to and including TS/SCI at time of contract award. Individuals performing work under resultant tasks orders must be a United States citizen and comply with applicable program security requirements which will require Top Secret personnel security clearances with SCI eligibility at time of award. The contractor shall comply with all appropriate security regulations in handling classified material and in publishing reports and other products.

b. Sensitive Compartmented Information Facility (SCIF). The contractor must have access to DSS certified work locations for performing classified work up to and including TS/SCI at time of contract award. The Contractor may be precluded from award of task order if unable to comply with DoD 5220.22M National Industrial Security Program Manual (NISPOM). Local Area SCIF access is not a requirement.

Local area is any facility within 50 mile radius of Ft. Meade. The primary place of performance will be at USCYBERCOM Government facilities within the Ft. George G. Meade, MD local area.

Contractor employees may also be required to support USCYBERCOM, Cyber Service Components, and the CNMF at locations within the CONUS, ie. alternate places of performance other than Ft. George Meade, Md. Specific locations will be detailed in each Task Order.

Contingency Only: Contractor employees may work at the Contractor’s facility upon prior approval by the COR or during emergency conditions when USCYBERCOM facilities are closed without prior approval.

Contractors designated as critical to successful completion of mission essential functions, or as or emergency personal may be required to travel with government counterparts to work for extended periods of time from a remote contingency location during a continuity of operations event.

The Contractor may be required to travel from their primary work location to other USCYBERCOM locations, other U.S. Government locations and contractor facilities, as well as partner sites worldwide in support of Command activities. Travel requirements may be adjusted at the discretion of the Government.

All proposed personnel must be eligible for outside the contiguous U.S. (OCONUS) travel. All OCONUS travel will require data entry into the Command travel system of record and approval through the Command foreign travel process. At the conclusion of each OCONUS trip a consolidated trip report will be required.

For air travel contractors shall use Non-Refundable fares to the maximum extent possible when purchasing tickets.

All Contractor travel shall be coordinated and approved in advance by the COR.

Specific travel requirements will be outlined in individual Task Orders.

Under NO CIRCUMSTANCE will a home office be considered an alternate work location.

c. Personnel Security Requirements. Prior to being assigned to this contract, all contractors shall possess a final Top Secret clearance with Sensitive Compartmented Information (SCI) eligibility and granted full SCI eligibility by a U.S. Government Adjudication Authority within the past 60 months and has not had a break in SCI access of more than 24 months during this period; Contractors shall have a Counterintelligence Scope Polygraph (CSP) examination conducted by a recognized U.S. Government polygraph entity within 7 years (in scope); and Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information (SCI): Contractors must have successfully undergone a Single Scope Background Investigation (SSBI) that is current (in scope) as defined by DoD 5200.2-R, DoDM 5105.21-V3, and ICD 704. The nature of the contract requires contractor personnel to possess a high degree of security awareness.

All Contractors must receive security indoctrination by U.S. Cyber Command (USCYBERCOM) and must be vetted and approved for access approval by the National Security Agency (NSA) Military Affairs Desk Office (MADO) prior to access to USCYBERCOM classified information, spaces, and IT systems and networks being granted. Contractors will be required to sign a Non-Disclosure Agreement based on the tasks to be performed.

The Contractor shall maintain a database of personnel with active security clearances and initiate periodic background updates as required. All contractors working on this contract must submit to, obtain, and successfully complete a Counter-intelligence polygraph examination should their current polygraph expire during performance. Any unfavorable information developed during any investigation or other official inquiry shall result in removal from this contract in accordance with established procedures. Contractor personnel shall keep the USCYBERCOM SSO Division and the COR apprised of any significant security concerns and/or changes in personal status that could affect their eligibility for access to SCI to include:

• Any travel to a foreign country and/or proposed visits to foreign embassies. Personnel must report all foreign travel, official and unofficial, in advance of the travel and agree to forego personal unofficial foreign travel when it is deemed by agency approving authorities to constitute a hazard to national security.

• Close and/or continuing contact with citizens of a foreign country. Any unusual or suspicious contacts or incidents with foreign nationals.

• Any arrest or court actions other than minor traffic violations (over $300).

• Any change in marital status or cohabitation. If, following employment, an employee marries (or cohabits with) a foreign national, termination of employment may be effected.

• Any significant financial issues (including, but not limited to: unexplained affluence, bankruptcy, judgment, garnishment, lien, or other significant financial difficulties).

• Any unauthorized computer network activities.

• Any other activity that could negatively affect or influence the impact the security of USCYBERCOM, its personnel, installations, information and/or activities.

• In accordance with DoD 5200.2-R, Section C2.1, all individuals will be U.S. citizens. All Contractor personnel working on or managing this effort shall strictly adhere to USCYBERCOM and NSA security regulations and procedures. All members of the Contractor team (prime, sub-contractors, etc.) providing personnel, including supervisory personnel to perform the work, must comply with the applicable clearance levels (facilities/personnel) based on the sensitivity of the task/work requiring a clearance. The COR must keep and maintain a current and accurate list of all contract affiliates performing on specific contracts.

• With the exception of approved courier duties, Contractor personnel shall not remove classified information from the worksite, either physically or electronically, and under no circumstances will the Contractor or its personnel, allow any classified information be stored at an off-site facility.

• Contractor personnel shall ensure continuing adherence to accepted government information technology policies and guidance applicable to this PWS. This includes public laws, executive orders, directives, regulations, manuals, standards, memorandums and instructions.

• Contractor personnel shall fully comply with USCYBERCOM and NSA in-processing and out-processing guidelines. At a minimum the Contractor shall:

• Be indoctrinated by USCYBERCOM Security and NSA Security and sign Non-Disclosure Agreements (NDAs) with both.

• The Contractor shall follow the Agency’s support agreement and shall be required to prepare/submit IT related work orders and ensure work orders are executed.

• Notify the COR of the employee’s departure and his/her successful out-processing on the last day of work. Successful out-processing shall require at a minimum of the turn-in/collection of all: (1) security badges; (2) Smart cards and/or other comparable security devices; (3) Government Furnished Equipment (GFE) issued to employee for performance of duties in accordance with local procedures; (4) Receive security debrief.

• In the event the Contractor employee fails to successfully out-process, the Contractor shall aggressively collect/recover and turn in security badges and devices, smart cards, and GFE to the COR or designee. Every effort shall be made to ensure these are recovered/ turned in within 24 hours (one business day) of the departing employee’s last day of work.

• Coordinate changes in employment status with the COR affecting the accuracy of security badges and supporting records within 24 hours (one business day) of any such changes to ensure the appropriate devices are promptly reissued and/or collected.

• Government-issued badges, identification cards, passes, vehicle registration media, and admittance controls are U.S. Government property and as such are to be accounted for, protected and returned to the Government at the end of the contract period of performance or at any other time as required. When a contractor employee leaves the company, or ceases working on this contract, the employee shall adhere to all required USCYBERCOM out processing procedures.

• The Contractor shall not bill the Government for Contractor personnel pending successful indoctrination by both USCYBERCOM and NSA security officials unless working directly on the contract and providing contract deliverables, or as approved by the contracting officer COR. Should Contractor personnel be denied access to the host agency facilities and classified networks for any reason, that individual will shall not be counted towards the vendors required staffing level.

d. USCYBERCOM retains the right to request removal of contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, conflict with the interests of the Government. The reason for removal will be fully documented in writing by the Contracting Officer. When and if such removal occurs, the contractor management shall within 30 workdays assign qualified personnel to any vacancy (ies) thus created.