DD254_Cont_-_Solicitation_JSOMTC_Medical_Instruction.pdf

FOR OFFICIAL USE ONLY

DD Form 254 Attachment 1 (continuation sheet)

Solicitation Number (from item 2.b.): H92239-13-R-0004

General Identification (item 9.): Provide instruction in the Special Operations Forces (SOF) Medical

Courses offered by the Joint Special Operations Medical Training Center (JSOMTC); perform administrative support for the JSOMTC, US Army John F Kennedy Special Warfare Center and School, US Army Special Operations Command, Fort Bragg, NC. The Period of Performance will be determined upon contract award.

THIS DD FORM 254 IS FOR SOLICITATION PURPOSES ONLY.

THE PERIOD OF PERFORMANCE FOR THIS CONTRACT

WILL BE DETERMINED AT THE TIME OF CONTRACT AWARD.

The HQ USASOC DCS, G-2, Security Operations Division, Information Systems Security Branch

(AOIN-SOD-SS), Industrial Security Office prepared this DD Form 254, Contract Security Classification

Specification, based on the Contract Requirements Document(s) (i.e., stated in the Performance Work

Statement (PWS)/Statement of Work (SOW)/Statement of Work (SOO)), and as identified by the User

Organization Contracting Officers’ Representative (COR)/Technical Representative (TRep)/Functional

Representative (FRep)/Contract Point of Contact (POC).

The User Organization Contract COR (TRep/FRep/POC) is responsible for all security issues and matters concerning this contract and contract performance:

a. To provide technical counseling, inspection, and acceptance of all work performed under all contracts and/or Task Orders issued.

b. To prepare the DD Form 254 for the contract and/or Task Order. Ensure that security guidance is provided if classified information will be involved during any stage of the contracting/acquisition process.

c. Provide direct technical and security oversight of all contractors performing on classified contracts.

d. Interface between the contractor, KO, and the HQ USASOC Industrial Security Office.

If the User Organization COR (TRep/FRep/POC) is no longer available (due to PCS, Deployment, retirement, etc.), the User Organization’s Security Manager is responsible for all security issues and matters concerning this contract and contract performance. It is the responsibility of the User

Organization to ensure the continued security oversight of their contract/contract performance.

The HQ USASOC Security Manager has delegated the DD Form 254 Certification (Item 16) to the HQ

USASOC DCS, G-2, Security Operations Division, Information Systems Security Branch (AOIN-SOD-

SS), Industrial Security Office for all USASOC Contracts IAW the Army Federal Acquisition Regulation

(AFAR), Revision 21, dated 22 May 2007, Paragraph 5104.403.

This is valid for all contracts awarded solely for USASOC Army Service Component Command (ASCC), Component Subordinate Commands (CSCs), and Component Subordinate Units (CSUs) (unless specifically delegated by the HQ USASOC DCS, G-2, Security Operations Division, Information

Systems Security Branch (AOIN-SOD-SS), Industrial Security Office).

The signer of the DD Form 254 (Item 16) certifies that all “Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort” as of the date the document was signed. Any changes made to the contract/contract documents (i.e., contract modification, or exercising an OPTION) without the certifier’s knowledge and approval shall invalidate this certification.

At that point, the User Organization COR (TRep/FRep/POC) becomes responsible/culpable for any failure of the DD Form 254 to provide adequate Security Guidance/Requirements for the classified contract. Failure of the DD Form 254 (at any time) to provide adequate/current safeguards for the protection of classified, Controlled Unclassified Information (CUI), or For Official Use Only (FOUO) information entrusted to member of industry will be considered a reportable security incident/violation.

DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), paragraph 4-103 states the Government Contracting Activity (GCA) is an element of an agency designated by the agency head and delegated broad authority regarding acquisition functions.

“The GCA is responsible for incorporating appropriate security requirements clauses in a classified contract, Invitation for Bid (IFB), Request for Proposal (RFP), Request for Quotation (RFQ), or other solicitation, and for providing the contractor with the security classification guidance needed during the performance of the contract. This guidance is provided to the contractor by the Contract Security

Classification Specification. The Contract Security Classification Specification must identify the specific elements of classified information involved in the contract that require security protection.”

“The GCA is required to review the existing guidance periodically during the performance stages of the contract and to issue a revised Contract Security Classification Specification when a change occurs to the existing guidance or when additional security classification guidance is needed by the contractor.”

If the User Organization COR (TRep/FRep/POC) has any questions concerning the “security requirements” certification (USASOC command’s implementation of the National Industrial Security

Program [NISP] regulations, policies, and procedures; or Classified Contracts [as defined by the ISR and

NISPOM]), please contact the HQ USASOC, DCS, G-2, Security Operations Division, Information

Systems Security Branch (AOIN-SOD-SS), Industrial Security Office for assistance and guidance. It is the responsibility of the User Organization to ensure these required actions are accomplished.

Failure of the contractor to comply with the Security Guidance/Requirements identified in the DD Form

254 Package shall be reported to the contractor’s Facility Security Officer (FSO) and the Defense

Security Service (DSS).

This DD Form 254 Package shall not be used for award of a different contract. This DD Form 254

Package was prepared solely for this contract, based on the specific contractual requirements of this contract and Contract Requirements Document(s) (PWS/SOW/SOO).

(Ref Item 2.) Pre-Award access is not required.

(Ref Item 2.) This DD Form 254 reflects the security requirements for the contract when awarded.

o The USAJFKSWCS, Acting G-2 and Industrial Security POC shall ensure the DD Form 254

Package correctly/accurately reflects the Security Guidance/Requirements of the contract document(s) (and as identified by the User Organization COR (TRep/FRep/POC), as of the date of preparation. Changes made to the contract/contract documents without the certifier’s knowledge and concurrence shall invalidate this certification.

o Failure of the User Organization COR (TRep/FRep/POC) to ensure the DD Form 254 Package continues to protects classified information and materials IAW the National Industrial Security

Policy (NISP) and HQ USASOC Industrial Security guidance (i.e., through contract changes, modifications, etc.) shall result in the Form 254 Package being unable to protect classified information provided to industry (contractors). This shall result in:

(1) The DD Form 254 Package being considered invalid and unable to protect classified information/materials.

(2) A reportable Security Infraction/Violation.

Item 13. SECURITY GUIDANCE: (continued)

DoD 5220.22-M, The National Industrial Security Program Operating Manual (NISPOM), 28 Feb

06, applies to this contract.

(Ref Item 8.a.) Contract performance shall be conducted at the Joint Special Operations Medical

Training Center (JSOMTC), US Army John F Kennedy Special Warfare Center and School, US

Army Special Operations Command, Fort Bragg, NC.

(Ref Item 10.j.) “FOR OFFICIAL USE ONLY” information is provided under this contract and shall be safeguarded as specified by the NISPOM.

o Specific guidance may be found in the NISPOM; DoD 5400.7, Department of Defense Freedom of Information Act Program.

o FOUO information provided under this contract shall be safeguarded as specified in Attachment

2, “Protecting For Official Use Only (FOUO) Information.”

(Ref Item 11.a.) Cleared contractor personnel are required by DoD 5220.22-M, National Industrial

Security Program Operating Manual (NISPOM), to provide supplemental controls.

o Releasing contractor or DoD (Government) activity shall furnish complete classification guidance on this contract.

o If any classified information is generated in the performance of this contract at the identified location(s), the contractor shall apply derivative classification and markings consistent with the source material.

(Ref Item 11.e.) Contract is to provide instruction (Special Operations Forces (SOF) Medical

Courses) and perform administrative support for the JSOMTC, US Army John F Kennedy Special

Warfare Center and School, US Army Special Operations Command, Fort Bragg, NC.

o Cleared personnel are required to perform this service because:

(1) Access to certain locations/organizations require a security clearance.

(2) Security measures currently in force do not preclude inadvertent access to classified information by escorting personnel.

o There shall be no requirement to access any classified material and/or information.

o There shall be no instruction/discussion of any classified material and/or information.

o Actual knowledge of, generation, or production of classified information is not required for performance of the contract.

o The User Organization shall provide any classification guidance needed.

USER ORGANIZATION COR (TRep/FRep/POC) RESPONSIBILITIES:

o The User Organization COR (TRep/FRep/POC) is responsible to (shall) ensure contractor employees are briefed (as required) on Local/Applicable Directives, Regulations, Policies and

Procedures concerning classified contract performance, materials, information, and “need-to-know” for contract performance under this contract.

(1) Visitor Policy at JSOMTC (USAJFKSWCS).

(2) Security Policies, Procedures and Requirements

(3) Unit Security Procedures Guide (SPG).

(4) Standard Operating Procedures (SOP).

(5) Security Classification Guide(s) (SCG(s)).

(6) Operations Security (OPSEC) Plan.

(7) Use of the Secure Communications Devices.

(8) Unauthorized Items.

(9) Personal Electronic Devices.

(10) Safeguarding of FOUO Information/Material.

(11) Etc.

o Should there be a conflict between or among two or more security requirements; the more stringent requirement(s) shall take precedence.

o The USER ORGANIZATION COR (TRep/FRep/POC) shall:

(1) Review the DD Form 254 Package and supporting documents and “certify” they are current and adequate to ensure all “Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort.” whenever:

(a) The contract or contract documents are changed, modified, extended, or the government exercises their OPTION.

(b) At least annually.

(c) User Organization COR’s (TRep’s/FRep’s/POC’s) “Certification” review shall be noted in a dated “Memo for Record” and placed in the User Organization COR’s

(TRep’s/FRep’s/POC’s) file for the contract. This shall be an inspection item.

(2) Ensure the USAJFKSWCS Industrial Security POC reviews the DD Form 254 Package whenever changes to the contract or Contract Requirements Document(s)

(PWS/SOW/SOO) result in a conflict with the current contract DD Form 254 Package.

(3) Ensure that access to any USASOC Technical Program(s) shall comply with the HQ

USASOC Technology Protection Program (USASOC Policy 20-06). This is required prior to allowing contractor personnel any access to USASOC Technical Program(s) or

Technical Data.

(4) Ensure that any contractor requirements for access to non-USASOC Technical Program(s) is/are properly identified, and all requests for accessing such information shall be processed through the HQ USASOC Technology Protection Program POC IAW USASOC Policy 20-

06. This is required prior to allowing contractor personnel any access to non-USASOC

Technical Program(s) or Technical Data.

(5) Ensure the dissemination of any information involved in this contract is to be conducted through applying the strictest “Need-To-Know” measures during any disclosure of information controlled under the International Traffic in Arms Regulations (ITAR), FOUO, or CUI. The USASOC Foreign Disclosure Officer (IAW applicable directives and regulations) shall approve any release of ITAR CUI, or CMI, controlled information to foreign nationals by DoD or contractor employees.

o Disclosure of U.S. FOUO, or CUI to Foreign Nationals. U.S. FOUO/CUI Information/

Materials shall remain under the direct control of the U.S. Government.

(1) Foreign Nationals shall not be allowed access to any U.S. FOUO/CUI Information/

Materials unless officially approved (in writing) by the Designated Disclosure Authority/

Foreign Disclosure Officer of the command, agency, or organization that has proponency and original classification authority over the information proposed for disclosure.

(2) The written approval shall specifically identify what Information may/may not be released to Foreign Nationals.

(3) Their disclosure/release are consistent with applicable U.S. laws and regulations.

(4) The Government Agency having classification jurisdiction over the information involved has granted/authorized approval for disclosure in writing to the USASOC Foreign

Disclosure Officer. The disclosure of the classified information to a foreign entity shall be accomplished IAW Chapter 10 of the NISPOM; AR 380-10; USSOCOM Reg 550-2;

USASOC Dir 380-10; and USASOC Reg 380-10.

o Foreign National Visits to USASOC, USASOC Elements, or USASOC Activities. All visits by Foreign National Contractors require an official Request for Visit Authorization (RVA).

(1) The RVA shall be submitted by the Foreign National Contractor’s home country embassy in Washington, D.C., via the Foreign Visit System (FVS). The FVS is located on the DoD

Security Policy Automated Network (SPAN).

(2) The RVA shall be submitted with at least 45-days lead-time before the proposed execution date of the visit.

o Training Events/Training Missions with Foreign Nationals shall comply with USASOC Policy

29-06 and USASOC Directive 380-10.

(Ref Item 11.j. and 11.l.) Operations Security (OPSEC) awareness and execution is crucial to

Army success.

o OPSEC is applicable to all personnel and all Army missions and supporting activities on a daily basis.

(1) To accomplish this level of OPSEC vigilance, OPSEC training programs shall be action and job-oriented, and to be included as a part of their organization’s annual training.

(2) All personnel shall know how to apply and practice OPSEC in the performance of their daily tasks.

o In concise terms, the OPSEC process identifies the critical information of military plans, operations, and supporting activities and the intelligence indicators (generally unclassified) that can reveal it; and then develops measures to eliminate, reduce, or conceal those indicators. Items requiring such protection include:

(1) Critical Information (CI) and Essential Elements of Friendly Information (EEFI).

(2) The unit’s/organization’s Critical Information List (CIL).

(3) Sensitive Information.

(4) Controlled Unclassified Information (CUI).

(5) Information concerning International Traffic in Arms Regulations (ITAR) or the Export

Administration Regulations (EAR).

(6) Etc.

o On September 21, 2001, the United States Department of Defense designated the United States

Special Operations Command (USSOCOM) a sensitive unit, as defined by Title 10 United States

Code (USC) Section 552 (10 USC 552).

(1) In keeping with this designation, any unclassified information related to USSOCOM or any of its component commands, will be designated and identified, at a minimum, as Controlled

Unclassified Information (CUI).

(2) As such, any release of information which associates USSOCOM, Special Operation

Forces (SOF), or any component command with an official activity or program is expressly prohibited unless specifically authorized by USSOCOM or an officially designated representative.

o Controlled Unclassified Information (CUI): A categorical designation that refers to unclassified information that does not meet the standards for National Security Classification under Executive Order 12958, as amended. However, it is: (i) Pertinent to the national interests of the United States or to the important interests of entities outside the Federal Government, and

(ii) Under law or policy requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination. It includes U.S. information that is determined to be exempt from public disclosure according to DODD 5400.7, AR 25-55, AR

340-21, AR 530-1; or that is subject to export controls according to the International Traffic in

Arms Regulations (ITAR), or Export Administration Regulation (EAR). Henceforth, the designation CUI replaces "Sensitive But Unclassified" (SBU).

(1) All CUI shall merit one of two levels of safeguarding procedures: standard (marked

"Controlled") or enhanced (marked "Controlled Enhanced").

(2) All CUI shall merit one of two levels of dissemination controls: "Standard

Dissemination" or "Specified Dissemination."

(3) All CUI shall be categorized into one of three combinations of safeguarding procedures and dissemination controls, and so indicated through the use of the following corresponding markings:

o Controlled With Standard Dissemination: Meaning the information requires standard safeguarding measures that reduce the risks of unauthorized or inadvertent disclosure.

Dissemination is permitted to the extent that it is reasonably believed that it would further the execution of a lawful or official purpose.

o Controlled With Specified Dissemination: Meaning the information requires safeguarding measures that reduce the risks of unauthorized or inadvertent disclosure. Material contains additional instructions on what dissemination is permitted.

o Controlled Enhanced With Specified Dissemination: Meaning the information requires safeguarding measures more stringent than those normally required since the inadvertent or unauthorized disclosure would create risk of substantial harm. Material contains additional instructions on what dissemination is permitted.

o OPSEC is a continuous process and shall be fully integrated into the execution of all Army operations and supporting activities. All personnel shall know how to apply and practice OPSEC in the performance of their daily tasks.

(1) AR 530-1, OPSEC, places trust in the Solider, civilian employee, Family member, and contractor that they shall use proper judgment to ensure operations security (OPSEC).

(2) OPSEC does not replace other security disciplines - it supplements them.

(3) OPSEC is everyone’s responsibility. This is to include all Department of the Army (DA) personnel (active component, reserve component to include U.S. Army Reserve, Army

National Guard, and DA civilians), and DoD contractors.

(4) Personnel not subject to the UCMJ who fail to protect critical and sensitive information from unauthorized disclosure may be subject to administrative, disciplinary, contractual, or criminal action.

o The User Organization COR (TRep/FRep/POC) shall (is responsible to) ensure the contractor(s) under this contract:

(1) Know what the User Organization considers to be Critical Information (CI), Sensitive

Information (SI), and Controlled Unclassified information (CUI). Who is responsible for it.

How to protect it. Why it needs to be protected (i.e., local/unit specific CILs and any other local/unit specific OPSEC requirements.

(2) Protect from disclosure any critical information and sensitive information to which they have personal access.

(3) Prevent disclosure of critical and sensitive information in any public domain to include but not limited to the World Wide Web, open source publications, and the media.

(4) Are aware that the unauthorized use of a DoD computer system may subject the user to criminal prosecution.

(5) The User Organization COR (TRep/FRep/POC) shall record completion of the local

OPSEC Briefing in the User Organization COR’s (TRep’s/FRep’s/POC’s) file for this contract.

o The User Organization COR (TRep/FRep/POC) is responsible to ensure each contractor under this contract receives a copy of OPSE 1301 (OPSEC CD), Operations Security Fundamentals

(Computer Based Training), and successfully complete the course.

(1) The contractor shall provide a course completion certificate (printed upon course completion) to the User Organization COR (TRep/FRep/POC) within one month from assignment.

(2) The User Organization COR (TRep/FRep/POC) shall record the successful completion of

OPSEC Training (i.e., OPSE-1301) in the User Organization COR’s

(TRep’s/FRep’s/POC’s) file for this contract.

(3) The User Organization COR (TRep/FRep/POC) will find information concerning the ordering of OPSE 1301 at: www.ioss.gov/products.html.

o As OPSEC requirements are additional to the requirements of the NISPOM, contractors may not impose OPSEC requirements on their subcontractors unless the User Organization approves the

OPSEC requirements.

(Ref Item 11.l.) AR 25-2, Information Assurance, establishes Information Assurance (IA) policy, roles, and responsibilities.

o Information Assurance (IA): The protection of systems and information in storage, processing, or transit from unauthorized access or modification; denial of service to unauthorized users; or the provision of service to authorized users.

(1) It also includes those measures necessary to detect, document, and counter such threats.

Measures that protect and defend information and ISs by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation.

(2) This includes providing for restoration of ISs by incorporating protection, detection, and reaction capabilities.

(3) This regulation designates IA as the security discipline that encompasses COMSEC, INFOSEC, and control of compromising emanations (TEMPEST).

o Information Technology (IT): The hardware, firmware, and software used as a part of an information system to perform DOD information functions.

(1) This definition includes computers, telecommunications, automated information systems, and automatic data processing equipment.

(2) IT includes any assembly of hardware, software, or firmware configured to collect, create, communicate, compute, disseminate, process, store, or control data or information.

Transfer of materials, courseware, manuals, and/or documents to other IR&D efforts, contracts, or company proposals is not permitted.

Any information obtained, developed, or researched during performance of this contact is considered to be the intellectual property of the U.S. Government. This includes:

o Any work(s) not directly relating to this contract, but includes/involves information obtained during interviews or researched during the performance of this contract.

o Any work(s) based on the contract performance subjects, and/or organizations (i.e., HQ

USASOC, CSCs, or CSUs).

http://www.ioss.gov/products.html

Disclosure to the Public. Contractors shall not disclose classified, CUI, FOUO, or unclassified information pertaining to a classified contract to the public without prior review and clearance as specified in the Contract Security Classification Specification for the contract or as otherwise specified by the GCA (NISPOM, paragraph 5-511).

Item 14. ADDITIONAL SECURITY REQUIREMENTS: (continued)

(Ref Item 10.j.) DoD Regulation 5400.7, “DoD Freedom of Information Act Program."

The contractor shall operate under:

o Previously identified Directives, Instructions, Regulations and Manuals;

o HQ USSOCOM, HQ USASOC, USAJFKSWCS, and JSOMTC operational security procedures and policies;

o In case of conflict, the more stringent security requirements shall be adhered to.

Contractors shall not be granted access to classified materials and are not authorized to courier classified information and/or materials.

Contract Completion:

o The following actions (as applicable) shall be taken when:

(1) Any contractor employee’s access is suspended (for any reason).

(2) Termination of employment of any contractor.

(3) Completion of, or termination of, the classified contract.

(4) Or (sooner) if the purpose of the release has been served (i.e., the contract was completed prior to the estimated completion date.

o All Unclassified, FOUO, and CUI Government Materials received, collected, and/or generated in performance of this contract are government property.

(1) All contractor owned memory and storage devices/media/materials (whether electrical, magnetic or optical) used to process Unclassified, FOUO, and CUI Contract Materials shall also be considered government property. These devices include any USB/IEEE-1394

(Firewire) Media Storage Devices (i.e., flash drives, memory sticks, CDs, DVDs, discs, external hard drive, etc.).

(2) The contractor shall return all such materials and information to the User Organization

COR (TR/FR/POC) from which it was received; unless retention or other disposition instructions have been approved in writing by the:

(a) User Organization COR (TRep/FRep/POC);

(b) USAJFKSWCS, Acting G-2 and Industrial Security POC

(c) HQ USASOC DCS, G-2, Security Operations Division, Information Systems

Security Branch (AOIN-SOD-SS), Industrial Security Office; and

(d) HQ USASOC DCSAC, Fort Bragg, NC 28310 9110.

o The contractor shall account for and return all access and identification badges issued to contractor personnel by the USAJFKSWCS, Acting G-2 and Industrial Security POC o The contractor shall account for and return all identification badges issued to contractor personnel by the XVIII Airborne Corps, ID Card Section, Fort Bragg, NC.

o The contractor shall account for and return entry passes/vehicle decals issued to them by the

XVIII Airborne Corps, Provost Marshal's Office, Fort Bragg, NC.

Contractor Furnished, Designed, or Developed Items:

o The contractor may on his own volition, augment government equipment/electronic training aids, subject to the approval of the User Organization COR (TRep/FRep/POC). The contractor will retain ownership and control of any such equipment developed to aid in the support of the contractual training requirements/objectives of this contract:

(1) The contractor is not authorized the use of a Contractor-Owned Computer to accomplish these tasks.

(2) No government funds or materials are to be used in these endeavors. The equipment/items shall remain totally contractor funded, and no charges place against the government for these items.

(3) Any contractor provided/used/owned memory and/or storage devices/media/materials

(whether electrical, magnetic, or optical) used to process Unclassified, FOUO, and CUI

Contract Information under this contract shall be considered as being government property.

(a) These devices include, but are not limited to: flash drives, memory sticks, CDs, DVDs, discs, etc.

(b) All such items (as identified above) shall be accounted for and turned over to the User

Organization COR (TRep/FRep/POC) at the completion of the contract.

Use of Government Owned Computers:

o The contractor shall be provided with government owned computers at government facility(ies) for processing UNCLASSIFIED/Controlled Unclassified Information (CUI)/For Official Use

Only (FOUO)/ information provided, collected, generated and/or developed during the contract’s period of performance.

o The purpose of the government owned computer is to conduct business as required by this contract. Any other use of the government owned computer by the contractor is prohibited.

o The contractor is not authorized to process any government owned information on any contractor or personally owned computers. This is to include any government information provided, collected, generated and/or developed during the contract’s period of performance.

o Contractors requiring access to restricted areas, sensitive information or government equipment and/or unclassified networks (i.e., Enterprise NIPRNet) shall be limited to those contractor individuals who meet the requirements of AR 25-2 and AR 380-67.

o Contractors placed in Information Assurance (IA) (Information Technology [IT]-I, IT-II, IT-III, or IT-IV) Positions shall be in compliance with:

(1) AR 25-2, Information Assurance, paragraph 4-14 Personnel Security Standards;

(2) AR 380-67, The Department Of The Army Personnel Security Program;

(3) DoD 5200.2-R, DoD Personnel Security Program;

(4) USASOC Regulation 25-70, Army Special Operations Command Network (ASOCNet)

Security, paragraph 11; and

(5) Any additional guidance as directed by HQ USASOC, CIO/G-6.

o (Ref Item 11.l.) Personnel Security Standards. Personnel who require access to Government

Network(s) processing defense information (UNCLASSIFIED/CUI/FOUO) to fulfill their duties shall possess the appropriate security ACCESS (based on AFFILIATION), commensurate with the security requirements of the Government Network. This ACCESS shall be based on the appropriate ACCESS requirements as delineated in AR 380-67. Individuals not meeting these requirements shall not be granted access to the classified ASOCNet.

o (Ref Item 11.l.) The contractor is only authorized to access the appropriate government network as identified in the DD Form 254, Item 11.l. (i.e., the Enterprise NIPRNet as required for performance of this contract).

o (Ref Item 11.l.) Access by Non-U.S. Citizens.

(1) Minimize employment of non-U.S. citizens in IT positions. However, compelling reasons may exist to grant access to DoD IT resources in those circumstances in which a non-U.S.

citizen possesses a unique or unusual skill or expertise that is urgently needed for a specific

DoD requirement and for which a suitable U.S. citizen is not available.

(2) Non-U.S. citizens may hold IT positions under the conditions described in AR 25-2 and AR

380-67 if:

(a) There is written compelling-reason justification.

(b) It is in accordance with applicable disclosure policies and authorized for foreign disclosure (for example, National Disclosure Policy 1, DoDD 5230.9, DoDD 5230.25) and U.S. statutes (for example, the Arms Export Control Act, 22 USC 2551, et. seq.).

(c) The required documentation is in the C&A package. (NOTE: The written approval must be on file and provided as an artifact to the C&A package, before requesting the required investigation.)

(d) The required investigation must be completed and favorably adjudicated before authorizing access to DoD systems or networks. Interim access is prohibited.

(e) The DAA that accredited the system approves the assignment requirement(s) in writing.

(f) The data owners approve the assignment requirement(s) in writing.

(g) The Industrial Security POC (identified in the DD Form 254, Item 13) approves the assignment requirement(s) in writing.

(Ref Item 11.l.) Contractor personnel performing under this contract shall be in the following

Information Technology (IT) position(s) (as defined in AR 25-2):

o IT-III Positions. IT -III Positions are defined as IA positions, for example, power users or a SA on individual systems for configuration or management with limited privileged-level access to that Information System(s) (IS(s)) or device(s). This is a position of higher trust.

(1) Personnel with roles, responsibilities, and access authorization of normal users with non-privileged level access to the IS or device.

(2) Personnel with non-privileged level access authorization in the role of official or statutory volunteers. The provisions for statutory volunteers are covered in AR 608–1.

Investigative Levels:

(1) A favorable review of local personnel, base and military, medical, and other security records, as appropriate.

(2) Initiation of a National Agency Check (NAC) (for contractors), as appropriate and favorable review of SF85P and Supplemental Questionnaire.

o No contractor under this contract performance shall be required to fill an IT-I, IT-II, or IT-IV

Position.

(1) An IT-I Position is an IA Positions (for example, SAs/NAs for infrastructure devices, IDSs, VPNs, routers; SAs/NAs for classified systems and devices) with privileged-level access to control, manage, or configure IA tools or devices, individual and networked IS and devices, and enclaves.

(2) An IT-II Position is an IA Positions (for example, operating system administration of common network applications or enclaves, back-up operators) with limited privileged-level access to control, manage, or configure ISs and devices, with very limited (single device) or no IA device access or management.

(3) An IT-IV Position is a non-IT Positions that are temporary, intermittent, or seasonal, for example, unofficial volunteers or summer hire positions, requiring restricted user-level access to unclassified, non-sensitive ISs only.

o Personnel Security Controls:

(1) Information Systems (IS) Access:

(a) Individuals assigned to IT–I, IT–II, or IT–III Positions who lose their clearance, or have access to classified systems suspended pending the results of an investigation, shall be barred access to all ISs until favorable adjudication of that investigation.

(b) Contractor personnel assigned to any IT Positions who have their unclassified system or network accesses revoked or suspended for derogatory reasons shall be barred access to the ISs until favorable adjudication of that investigation.

(2) The organization’s IASO/IANO/IAM (as appropriate) shall identify any other official systems/networks for which that individual has an account (for example, AKO, JPAS, ACAVS, DSS ISFD, DTIC, etc.) and have it temporarily disabled or suspended.

(3) The servicing legal office should be consulted for advice concerning personnel, security, contract and labor relations issues that may impact the final determination. Recheck local records to identify any issues that may be a deciding factor in the waiver process.

Contractor working for the Government o While employed under the provisions of this contract, contractor employees shall explicitly identify themselves as a "Contractor working for the Government" to all organizations and individuals when conducting mission related support; attending meetings, conferences, and seminars; in message traffic and emails, signature blocks; and on the phone.

(1) When working in any situation where their contractor employee status is not obvious to third parties, contractor employees are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials.

(2) Contractors must also ensure that all documents or reports produced by contractor employees are suitably marked as contractor products or that contractor participation is appropriately disclosed.

o They shall NOT represent themselves as a government (GG, GS, SES, WG, WS, or WL) employee (of USAJFKSWCS, HQ USASOC, HQ USSOCOM, the Department of the Army, or of any other government agency).

o Representation means to “represent.” Contractors may be placed in a position where they

“represent” the government at meetings, conferences, and/or seminars. However, Contractors are not authorized to provide the “final” position or “approval” of an action; that is the responsibility of government personnel and the responsibility shall not be delegated.

o Contractors shall not be empowered to act in place of the government. Contractors shall consider themselves as “limited agent,” with set limits when acting as a government representative.

(1) Limits and responsibilities shall be set beforehand and the contractor shall be thoroughly briefed concerning their responsibilities and the limit of their authority.

(2) The User Organization COR (TRep/FRep/POC) shall provide a written statement outlining these responsibilities and the limit of their authority to the contractor.

(3) A signed copy shall be kept as part of the User Organization COR’s

(TRep’s/FRep’s/POC’s) file for the contract.

Contractor Visits: Any visits or meetings conducted/attended by the contractor shall be IAW the

NISPOM; AR 380-5; Memorandum, Office Of The Under Secretary Of Defense, 1 Apr 05, subject:

Facilitating Classified Visits within the Department of Defense; and other applicable directives/regulate (i.e., DoD 5220.22-M) as required.

o The Joint Personnel Adjudication System (JPAS) is the personnel security system of record for the Department of Defense (DoD), and shall be used to verify the ACCESS level (based on

AFFILIATION, i.e., the company employing the individual contractor) for visitors requiring access to classified information.

o Visit Authorization Letters (VALs) are no longer required for personnel whose ACCESS level and AFFILIATION are accurately reflected (listed) in JPAS. Use of JPAS fulfills the requirements of paragraph 6-202 of the Information Security Program Regulation (DoD 5200.1-

R).

o All contractors who participate in the National Industrial Security Program (NISP) are authorized to use JPAS in lieu of sending VALs for classified visits. Paragraphs 6- 101 and 6-103 of the

NISPOM that require advance notification and VALs for classified visits within DoD are hereby waived. VALs shall still be required for visits outside of the Department of Defense, and for locations/facilities not having JPAS access or capabilities.

o See DD Form 254 Attachment 3.

The contractor is responsible for ensuring employees meet (and continues to meet) the security criteria for this contract, and incur all costs associated with obtaining the required clearances.

Contractor personnel shall ensure their clearance investigations do not expire (i.e., Periodic

Reinvestigations [PRs] submitted prior to the 10 year point for Secret).

Adverse Information:

o Due to the sensitive nature of the end user(s) and/or their mission, Any/All Adverse Information obtained concerning contractor personnel assigned to/working under/or to be assigned this contract shall be reported in an expeditious manner through appropriate G-2/S-2/J-2 security channels (the use of secure communications channels may be required):

o The report shall contain the:

(1) The contractor’s Name/SSAN.

(2) The complete name of the company employing the contractor. Please include the Company

Facility Security Officer (FSO) name and contact information, and the CAGE Code (if known).

(3) The Contract Number the contractor is assigned to/working under/or to be assigned to.

(4) Information concerning the Adverse Information being reported.

o The report shall be provided to the:

(1) User Organization COR (TRep/FRep/POC);

(2) USAJFKSWCS, Acting G-2 and Industrial Security POC

(3) HQ USASOC DCS, G-2, Security Operations Division

(a) Personnel Security Branch (AOIN-SOD-PS);

(b) Information Systems Security Branch (AOIN-SOD-SS), Industrial Security Office.

o The HQ USASOC DCS, G-2, Security Operations Division, Information Systems Security

Branch (AOIN-SOD-SS), Industrial Security Office shall be responsible to promptly forward the information to the contractor’s Facility Security Officer (FSO) and other locations as necessary.

o Due to the sensitive nature of the end user(s) and/or their mission, Any/All Adverse Information identified/occurring at the Contractor Location(s)/Facility(ies) involving contractor personnel assigned to/working under this contract shall be reported to the Contractor’s FSO. This is also required for a contractor who shall be assigned to this contract, but is currently working on another contract, or at another location. The Contractor FSO shall:

(1) Be responsible to take appropriate action IAW the NISPOM.

(2) Promptly forward Any/All reports of Adverse Information through appropriate secure channels to the:

(a) User Organization COR (TRep/FRep/POC);

(b) USAJFKSWCS, Acting G-2 and Industrial Security POC

(c) HQ USASOC DCS, G-2, Security Operations Division, Personnel Security Branch

(AOIN-SOD-PS); and the

(d) HQ USASOC DCS, G-2, Security Operations Division, Information Systems Security

Branch (AOIN-SOD-SS), Industrial Security Office.

Security Incidents:

o A Security Infraction is any knowing, willful, or negligent action contrary to the requirements of

EO 12958 or it’s implementing directives (that does not comprise a Security Violation).

o A Security Violation is any knowing, willful, or negligent action contrary to the requirements of

EO 12958 or it’s implementing directives.

o Due to the sensitive nature of the end user(s) and/or their mission(s), Any/All Security

Infraction(s)/Security Violation(s) (whether suspected, possible, potential, or actual) at a

USASOC Location(s)/Facility(ies) involving contractor personnel assigned/or to be assigned to this contract shall be reported immediately through appropriate G-2/S-2/J-2 security channels

(the use of secure communications channels may be required):

o The report shall contain the:

(1) The contractor’s Name/SSAN.

(2) The complete name of the company employing the contractor. Please include the Company

Facility Security Officer (FSO) name and contact information, and the CAGE Code (if known).

(3) The Contract Number the contractor is assigned to/working under/or to be assigned to.

(4) Information concerning the incident being reported.

o The report shall be provided to the:

(1) User Organization COR (TRep/FRep/POC);

(2) USAJFKSWCS, Acting G-2 and Industrial Security POC

(3) HQ USASOC DCS, G-2, Security Operations Division,

(a) Information Security Branch (AOIN-SOD-IS);

(b) Personnel Security Branch (AOIN-SOD-PS);

(c) Information Systems Security Branch (AOIN-SOD-SS), Industrial Security Office.

o If the Security Infraction(s)/Security Violation(s) occurs at a non-USASOC

Location(s)/Facility(ies): The appropriate Security Management Office/Branch (G-2/S-2/J-2) and Industrial Security POC at that Location(s)/Facility(ies) shall be informed/advised of the situation.

(1) They are responsible to inform/advise/notify the:

(a) User Organization COR (TRep/FRep/POC);

(b) USAJFKSWCS, Acting G-2 and Industrial Security POC

(c) HQ USASOC DCS, G-2, Security Operations Division,

(i) Information Security Branch (AOIN-SOD-IS);

(ii) Personnel Security Branch (AOIN-SOD-PS);

(iii) Information Systems Security Branch (AOIN-SOD-SS), Industrial Security

Office.

o Due to the sensitive nature of the end user(s) and/or their mission, Any/All the Security

Infraction(s)/Security Violation(s) identified/occurring at the Contractor

Location(s)/Facility(ies) involving contractor personnel assigned to/working under/or to be assigned to this contract shall be reported to the Contractor’s FSO. The Contractor FSO shall:

(1) Be responsible to take appropriate action IAW the NISPOM.

(2) Promptly forward reports of Any/All the Security Infraction(s)/Security Violation(s) through appropriate secure channels to the:

(a) User Organization COR (TRep/FRep/POC);

(b) USAJFKSWCS, Acting G-2 and Industrial Security POC

(c) HQ USASOC DCS, G-2, Security Operations Division,

(i) Information Security Branch (AOIN-SOD-IS);

(ii) Personnel Security Branch (AOIN-SOD-PS);

(iii) Information Systems Security Branch (AOIN-SOD-SS), Industrial Security

Office.

While performing duties under this contract:

o The contractor shall adhere to:

(1) Fort Bragg,

(2) The User Organization’s Security Branch (G-2/S-2), and

(3) HQ USASOC security regulations;

o The User Organization COR (TRep/FRep/POC) shall provide these regulations.

The contractor is responsible to ensure they provide continuing security education to their employees as required by the NISPOM.

Contractors are to be familiar with AR 381-12, Subversion and Espionage Directed Against the U.S.

Army (SAEDA). Contractors are required to attend annual SAEDA training.

o The User Organization COR (TRep/FRep/POC) is responsible to arrange for the contractor(s) to be provided SAEDA training.

o Contractors shall be briefed that any involvement or knowledge of a SAEDA incident shall be immediately reported to the nearest supporting counterintelligence (CI) office as required by AR

381-12.

Antiterrorism (AT) Awareness Training shall be accomplished IAW AR 525-13, Antiterrorism:

o All DoD-employed contractors shall be offered annual AT Awareness Training “under terms and conditions as specified in the contract” (DoDI 2000.16) and IAW AR 525-13.

(1) The Antiterrorism Level 1 Training System may be accessed at:

https://atlevel1.dtic.mil/at/.

(2) While the AT Level I training application is hosted on a ".mil" server, it is not necessary to access this training from a ".mil" computer terminal.

(3) The training may be accessed from any home or non-".mil" government computer.

o Updated Area Of Responsibility (AOR) Training shall be offered prior to traveling outside the

50 United States (OCONUS), its territories and possessions (to include temporary duty and/or deployment). An unclassified AOR Travel Brief may be obtained from the U.S. Department of

State website: http://travel.state.gov/.

o Training Related Downloads: Menu Screen 2, “Level I Training Menu” allows the user to download copies of Joint Pub 5260 Antiterrorism Guide and Joint Pub 5260 pocket card.

o The User Organization COR (TRep/FRep/POC) shall:

(1) Provide information for the contractor’s training and

(2) Shall maintain a memorandum for record documenting the contractor’s training using the

“Course Completion Certificate.”

https://atlevel1.dtic.mil/at/ http://travel.state.gov/

DD Form 254 Attachment 2 (continuation sheet)

PROTECTING "FOR OFFICIAL USE ONLY" (FOUO) INFORMATION

Solicitation Number (from item 2.b.): _______________

General Identification (item 9.): Provide instruction in the Special Operations Forces (SOF)

Medical Courses offered by the Joint Special Operations Medical Training Center (JSOMTC);

perform administrative support for the JSOMTC, US Army John F Kennedy Special Warfare Center and School, US Army Special Operations Command, Fort Bragg, NC. The Period of Performance will be determined upon contract award.

1. GENERAL:

a. The "For Official Use Only" (FOUO) marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking, but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

b. Other non-security markings, such as "Limited Official Use" and "Official Use Only" are used by non-DoD User Agencies for the same type of information and shall be safeguarded and handled in accordance with instruction received from such agencies.

c. Use of the above markings does not mean that the information cannot be released to the public under FOIA, only that the Government originator or other competent authority shall review it prior to its release to determine whether:

(1) A significant and legitimate government purpose is served by withholding the information or portions of it, or

(2) Withheld because disclosure would cause a foreseeable harm to an interest protected by

FOIA.

2. MARKINGS:

a. An unclassified document containing FOUO information shall be marked "For Official Use

Only" in bold letters at least 3/16 of an inch high at the bottom of the front cover (if any), on the first page, on each page containing FOUO information, on the back page, and on the outside of the back cover (if any). No portion markings shall be shown.

b. Within a classified document, an individual page that contains both FOUO and classified information shall be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains FOUO information but no classified information, the portion shall be marked “FOUO.”

c. Any “For Official Use Only" information released to a contractor by a DoD User Agency is required to be marked with the following statement prior to transfer.

“This document contains information EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FOIA. Exemptions ___ apply” (NOTE: You shall specifically identify which exemption(s) apply.)

d. Removal of the "For Official Use Only" marking can only be accomplished by the originator or other competent authority. When the "For Official Use Only" status is terminated, all known holders shall be notified to the extent practical.

3. DISSEMINATION: Contractors may disseminate "For Official Use Only" information to their employees and subcontractors who have a need for the information in connection with the contract.

Contractors shall ensure employees and subcontractors are aware of the special handling instructions detailed below.

4. STORAGE: During working hours, "For Official Use Only" information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms shall provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: "For Official Use Only" information may be sent via first-class mail or parcel post. Bulky shipments may be sent by fourth-class mail. DoD components, officials of DoD components, and authorized DoD contractors, consultants, and grantees send FOUO information to each other to conduct official DoD business. Tell recipients the status of such information, and send the material in a way that prevents unauthorized public disclosure. Make sure documents that transmit FOUO material call attention to any FOUO attachments. Normally, you may send FOUO records over facsimile equipment. To prevent unauthorized disclosure, consider attaching special cover sheets, the location of sending and receiving machines, and whether authorized personnel are around to receive FOUO information. FOUO information may be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function.

Mark the records "For Official Use Only" and tell the…