RFP-19R0002-0001_Atch-1_DD254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

PROTECTING SPECIAL ACCESS PROGRAM (SAP) INFORMATION

(2 January 2018 edition)

Special Access Program (SAP) discussion, storage, and processing associated with this effort will be conducted in SAP Facilities (SAPF) specifically approved, in writing, by the USSOCOM SAPCO or designated USSOCOM Program Security Officer (PSO). Contact the individual in Block 16 for approved SAPF locations.

SAP activities are governed by Revision 1, of the Department of Defense Overprint to the National Industrial Security Program Operating Manual (NISPOM) Supplement; DOD Manual 5200.01 (DOD Information Security Program) Volumes 1-4, DOD Directive 5205.07 (Special Access Program Policy); DOD Manual 5205.07 (DOD Special Access Program Security Manual), Volumes 1-4; DOD Instruction 5205.11, (Joint SAP Implementation Guide (JSIG)); USSOCOM Manual 380-2 (SAP Security Guide); USSOCOM Manual 380-7 (USSOCOM Arms Control Readiness Inspection Program) and applicable program security classification guides and subsequent versions. Applicable documents will be provided to the contractor by the PSO under separate cover.

Access to SAP information requires employees to undergo additional personnel security screening and meet the requirements of DoD SAP accessing directives and policies in accordance with DODM 5205.07, Volume 2. The individual must meet applicable eligibility requirements and possess a final Secret or Top Secret security clearance depending on the level of access required in performance of this contract. Program Access Requests (PAR) for contractor personnel must be submitted by the Contractor’s Program Security Officer (CPSO) to the PSO for approval by the designated Access Approval Authority (AAA). Personnel approved for access will receive a program indoctrination briefing and must sign a SAP Indoctrination Agreement (PIA) prior to receiving access to program information or material. The CPSO will maintain the signed PIA and forward a copy to the PSO for entry into the appropriate database system.

SAP inspections and security oversight while in USSOCOM or Component government facilities are under the cognizance of the USSOCOM PSO or SAPCO representative, as appropriate. Additional Component SAP security requirements may apply for activities conducted at Service Component or Sub-unified command locations. The Performance Monitor or component command COR at these locations/facilities will provide specific or additional guidance. SAP reviews conducted at contractor facilities are under the security oversight of the Defense Security Service (DSS) unless officially relieved of oversight responsibilities.

OPSEC-sensitive or classified communication will be conducted via PSO-approved secure channels from within the SAPF. Transmission of documents via secure facsimile between terminals within SAPFs may be approved by the PSO. Only the U.S. Postal Service Register or Certified mail, if authorized, will be used to mail program material unless an alternate method is approved by the PSO. Briefed personnel are authorized to courier classified information within the continental United States with written approval from the CPSO or PSO. Two (program briefed) personnel are required to courier Top Secret material unless prior approval is obtained from the PSO. Couriers will be in the possession of PSO-issued courier authorization letters prior to travel. All material, to be mailed or carried, will be wrapped and transmitted in accordance with DODM 5205.07, Volume 1.

Prior to processing SAP information on any Automated Information System (AIS), the contractor will provide the PSO with a System Security Plan (SSP) and other documentation required in JSIG for Assessment & Authorization (A&A) from the Authorizing Official (AO), or subsequent policy. The PSO will issue program specific Security Authorization following verification of the A&A process. USSOCOM Special Access Program (SAP) Policy Memorandum: Removable Media and Two-Person Integrity Control Policy is applicable for this contract.

Destruction of program material will be conducted only by program indoctrinated personnel using destruction equipment and procedures approved by the PSO. A single person may destroy non-accountable classified material. Accountable material must be destroyed, and documented, by two program cleared individuals.

The PSO will be advised of any reports which affect the baseline facility clearance or any incident that has an adverse impact on a personnel security clearance. All briefed personnel are required to report any information that could have an impact on their ability to protect classified information. Reportable items include: foreign travel, contacts, or associations; criminal, civil, financial, or mental health issues; and changes in personal status such as marriage, divorce, or employment. CPSOs are reminded of their responsibilities to diligently report any significant action or any change in an employee’s eligibility to the PSO immediately.

Per DOD Manual 5205.07 Volume 1, Encl. 11, Sec 3. : “Any (contractual) relationship with a prospective subcontractor requires prior approval by the PSO.” All security requirements levied upon the prime contractor will “flow-down” to the subcontractor. SAP access and other requirements must be pre-coordinated and approved by the PSO prior to implementation.

IAW DODM 5200.01, Vol 3, Encl. 6, any security incident involving the potential loss, compromise, or suspected compromise of classified information must be reported to the PSO immediately using appropriate secure channels. Security infractions will be documented in the individuals personal security file and made available for review during PSO visits.

PROTECTING "FOR OFFICIAL USE ONLY" (FOUO) INFORMATION

(Updated June 2014)

1. GENERAL:

a. The "For Official Use Only" (FOUO) marking is assigned to information at the ti.me of its creation in a DOD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

b. Other non-security markings, such as "Limited Official Use" and "Official Use Only" are used by non-DOD User Agencies for the same type of information and should be safeguarded and handled in accordance with instruction received from such agencies.

c. Use of the above markings does not mean that the information cannot be released to the public under FOIA, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it

2. MARKINGS:

a. Unclassified documents containing FOUO information will be marked "UNCLASSIFIED//For Official Use Only" or "U//FOUO" at the bottom of the front cover (if any), on the first page, on each page containing FOUO information , on the back page, and on the outside of the back cover (if any). Each paragraph containing FOUO information shall be marked as such.

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. Individual paragraphs shall be marked at the appropriate level be it classified, unclassified, or FOUO. An individual page that ONLY contains FOUO and unclassified information shall be marked “FOR OFFICIAL USE ONLY” or the highest classification of the entire document at the top and bottom of the page.

If an individual portion contains FOUO information but no classified information, the portion will be marked, "FOUO."

c. Mark other records, such as computer print outs, photographs, films, tapes, or slides "FOR OFFICIAL USE ONLY" so that the viewer knows the record contains FOUO information.

d. Removal of the "For Official Use Only" marking can only be accomplished by the originator or other competent authority. When the "For Official Use Only" status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: "For Official Use Only" information may be disseminated between officials of DOD Components, DOD contractors, consultants, and grantees to conduct official business for the DOD. FOUO information may also be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Recipients shall ·be made aware of the special handling instructions detailed in this document and that it's exempt from public disclosure under the FOIA utilizing the following statement: "This document contains information EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FOIA".

4. STORAGE: During working hours, "For Official Use Only" information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after- hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: "For Official Use Only" information may be sent in the following ways:

a. Mail - FOUO may be sent via first-class mail or parcel post. Bulky shipments may be sent by fourth-class mail.

b. Fax - Normally FOUO may be sent over facsimile equipment. To prevent unauthorized disclosure the following should be considered:

Use of special cover sheets, location of fax machines {both ends), and whether authorized persoru1el are around to receive FOUO information.

c. E-Mail/Websites E-mail may be used on approved secure communication systems or systems utilizing other protective measures such as Public Key Infrastructure (PKI) or transport layer security (e.g., https).

**Make sure documents/methods that transmit FOUO material call attention to any FOUO attachments. **

6. DISPOSITION: When no longer needed, FOUO information must be disposed of in a way that will preclude its disclosure to unauthorized individuals.

7. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of "For Official Use Only" information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions and disciplinary action may be taken against those responsible.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

7701 Tampa Point Blvd MacDill AFB, FL 33621 813-826-4333 IndustrialSecurity@socom.mil CSO: USSOCOM, Crystal City 2231 Crystal Drive Arlington, VA 22202

CSO: JIATF

2733 Crystal Drive Arlington, VA 22202

CSO: Commanding Officer, NSW 2000 Trident Way San Diego, CA 92155

CSO: Commanding Officer, NSW Center 2446 Trident Way San Diego, CA 92155-5494 CSO: Commanding Officer, NSWG-1 3632 Guadalcanal Road San Diego, CA 92155-5583 CSO: Commanding Officer, NSWG-2 1300 Helicopter Road Bldg. 3854 Virginia Beach, VA 23459-294 CSO: Commanding Officer, NSWG-3 455 Hornet Ave. Suite 101

JBPHH, HI 96860-3530

CSO: Commanding Officer, NSWG-4 2220 Schofield Road Virginia Beach, VA 23459-2846 CSO: Commanding Officer, NSWG-10 1600 Seabee Drive Bldg. 3889 Virginia Beach, VA 23459-284 CSO: Commanding Officer, NSWG-11 3322 Guadalcanal Road Bldg. 309 San Diego, CA 92155-5583 CSO: Commanding Officer, NSWDG 1636 Regulus Ave.

Virginia Beach, VA 23461-2299 CSO: Special Boat Team 22 2603 Lower Gainesville Rd Stennis Space Center, MS 39529 CSO: Bethesda, National Military Attn: Walter Reed Security Manager 8901 Rockville Pike Bethesda, MD 20889 CSO: Commander, BAMC 3551 Roger Brooke Dr.

Ft Sam Houston, TX 78234 CSO: Department of Veterans Affairs VA Palo Alto Healthcare Systems (Attn: Security Mgr) 301 Miranda Ave. (PSC 117) Palo Alto, CA 94304-1290 CSO: Commander, MARSOC RR400 Rifle Range Road PSC Box 20116 Camp Lejeune, NC 28542-0116 CSO: Commander, 1st Marine Raider Battalion MCB Box 555341 Camp Pendleton, CA 92055-5341 CSO: Commander, USASOC, AOIN-SOD 2929 Desert Storm Dr.

Ft. Bragg, NC 28310 CSO: Commander, 75th Ranger Regiment 6420 Dawson Loop, Bldg. 2933 Fort Benning, GA 31905 CSO: Commander, 1/75th Ranger Regiment 248 Stephen Douglas St. Bldg. 405 Hunter Army Airfield, GA 31409 CSO: Commander, 2/75th Ranger Regiment Bldg. 3486, 3rd Division Drive

JBLM, WA 98433

CSO: Commander 4th Bn, 160th SOAR 41st Division Dr.

JBLM, WA 98433

CSO: Commander, 1st SFG Bldg. 9190 Chapman Circle

JBLM, WA 98433

CSO: Commander, 10th Special Forces Group 7811 Bad Tolz Rd, Bldg. 7400 Ft. Carson, CO 80913 CSO: Commander, 5th Special Forces Group 6101 Tennessee Ave Ft. Campbell, KY 42223 CSO: Commander, 7th Special Forces Group 4545 Memorial Loop Parkway Eglin AFB, FL 32532 CSO: Commander, JSOC Bldg. 3-2744 Malvesti St.

Fort Bragg, NC 28307 (PO Box 70239) CSO: Commander, SOTF Lamont Road, Bldg. 1900 Fort Bragg, NC 28310-0660 (PO Box 70660) CSO: Commander AFSOC 229 Cody Ave Ste 103 Hurlburt Field, FL 32544 CSO: Commander, 22nd Special Tactics Squadron Bldg. 305 McChord Field, WA 98438 CSO: Commander, 26th STS 118 Levitow Ave.

Cannon AFB, NM 88103 CSO: Commander, 21st STS 1520 Hurst Dr.

Pope Army Airfield, NC 28308 CSO: Commander, 24th STS 1526 Hurst Dr.

Pope Army Airfield, NC 28308 CSO: Commander PACOM

PO BOX 64031

Camp H.M. Smith, HI 96861 CSO: Commander, SOCPAC ATTN: Care Coalition Bldg. 20 Rm. 212 Box 64046 Camp H.M. Smith,, HI 96861-4046 CSO: Commander, SOCSOUTH 29401 SW 125th Ave, Bldg. 600 Homestead ARB, FL 33039 CSO: Commander, SOCEUR 70569 Stuttgart, Germany Geb. 2302 Patch Barracks

CSO: SOCAFRICA

ATTN: SOCFRICA SSO Unit 30401

APO, AE 09107

CSO: 7701 Telephone Rd Alexandria, VA 22315 703-664-5000 Ext 5531

7701 Tampa Point Blvd MacDill AFB, FL 33621 Location: USSOCOM/Crystal City Crystal City, VA 22202 Location: JIATF Arlington, VA (Crystal City)

Location: Naval Special Warfare (NSW) Command San Diego, CA

Location: NSW Center San Diego, CA Location: NSW Group (NSWG)-1 San Diego, CA Location: NSWG-2 Virginia Beach, VA Location: NSWG-3

JBPHH, HI

Location: NSWG-4 Virginia Beach, VA Location: NSWG-10 Virginia Beach, VA Location: NSWG-11 San Diego, CA Location: NSW Development Group Virginia Beach, VA Location: Special Boat Team 22 Stennis Space Center, MS Location: Bethesda, National Military Medical Center, Walter Reed

Palo Alto, CA Location: Marine Special Operations Command (MARSOC) Camp Lejeune, NC Location: 1st Marine Raider Battalion Camp Pendleton, CA Location: U.S. Army Special Operations Command (USASOC) Ft. Bragg, NC Location: 75th Ranger Regiment Fort Benning, GA Location: 1/75th Ranger Regiment Hunter AAF, GA Location: 2/75th Ranger Regiment Joint Base Lewis-McChord (JBLM) Location: 4th Bn Special Operations Aviation Regiment (SOAR)

JBLM

Location: 1st Special Forces Group (SFG)

JBLM

Location: 10th SFG Ft. Carson, CO Location: 5TH SFG Ft. Campbell, KY Location: 7TH SFG Eglin AFB, FL Location: Joint Special Operations Command (JSOC) Fort Bragg, NC Location: U.S. Army Security Operations Training Facility (SOTF) Fort Bragg, NC Location: AFSOC/SG Hurlburt Field, FL 32544 Location: 22nd Special Tactics Squadron McChord Field, WA Location: 26th Special Tactics Squadron (STS) Cannon AFB, NM Location: 21st STS Pope Army Airfield, NC Location: 24th STS Pope Army Airfield, NC Location: U.S. Pacific Command (PACOM) Camp H.M. Smith, HI Location: Special Operations Command Pacific (SOCPAC) Camp H.M. Smith, HI Location: Special Operations Command South (SOCSOUTH) Homestead ARB, FL Location: Special Operations Command Europe (SOCEUR) Stuttgart, Germany Location: Special Operations Command Africa (SOCAFRICA) Stuttgart, Germany Location: Intelligence Support Unit Ft. Belvoir, VA Block9: DD254 VALID: 01-DEC-2019 to 30-NOV-2020 (ANNUAL DD254 REVIEW REQUIRED) Description of Service: SOCS-WCP Warrior Care Global Support (WCGS) Services Contract Period(s) of Performance: 01-DEC-2019 to 31-MAY-2025 Base Period: 01-DEC-2019 to 30-NOV-2020 Option Period 1: 01-DEC-2020 to 30-NOV-2021 Option Period 2: 01-DEC-2021 to 30-NOV-2022 Option Period 3: 01-DEC-2022 to 30-NOV-2023 Option Period 4: 01-DEC-2023 to 30-NOV-2024 Extension Period: 01-DEC-2024 to 31-MAY-2025

Ref 2b: Subcontracting of this effort must be approved by HQ USSOCOM prior to award. Forward requests and draft Subcontract DD FM 254s to the Contracting Officer’s Representative/Program Manager and USSOCOM Industrial Security (IndustrialSecurity@socom.mil).

(IAW USSOCOM R 380-9, Industrial Security, please allow 10 duty days for review/approval).

Ref 7: See guidance in Ref 2b.

Ref 10e(1): See attached SCI Addendum.

Ref 10f: See attached SAP Addendum.

Ref 10g: The contractor is permitted access to North Atlantic Treaty Organization (NATO) information in performance of this contract. Access to NATO information requires a final U.S. Government clearance at the appropriate level. The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees are NATO briefed prior to access being granted. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM Chapter 10, Section 7. Prior approval from the contracting activity is required for subcontracting.

Ref 10i: Alternative Compensatory Control Measures (ACCM) Program information is governed by DoD M 5200.01-V3, DoD Information Security Program: Protection of Classified Information, Enclosure 2, Section 18; CJCS Manual 3213.02D, Joint Staff Alternative Compensatory Control Measures Program Management Manual, and supporting documentation for each ACCM sub-system, including security classification guides, program security plans, and governing directives. Inspections of ACCM information in USSOCOM, Component (JSOC, AFSOC, NSWC, MARSOC, or USASOC), or Theater Special Operation Command (SOCNORTH, SOCAFRICA, SOCCENT, SOCEUR, SOCPAC, SOCSOUTH, or SOCKOR) owned and operated facilities are under the auspices of the respective Command or Component ACCM Coordinator/ACCM Program Control Officer (ACCM Coord/ACCM PCO). If applicable, ACCM material maintained by the Contractor within their facility must be afforded protection commensurate with DOD requirements and strictly controlled based on need-to-know and required briefings. DSS personnel conducting inspections of the Contractor must be briefed on to the specific program by the appropriate government ACCM Coord/ACCM PCO responsible for the material prior to being granted access.

Ref 10j: Controlled Unclassified Information (CUI) provided under this contract shall be safeguarded as specified in the FOUO Addendum included with this specification.

Ref 10k: NIPRNET/SIPRNET/JIANT access required at government facilities only.

Ref 10k: Commercial Solutions for Classified (CSfC) Mobile Device may be required by select individuals for use outside of secure government and/or contractor facilities. Authorization requires USSOCOM Industrial Security receipt of USSOCOM IMT 33, CSfC Device User Agreement and Hand Receipt, and Director, HQ Directorate/Special Staff endorsed Authorization of Issuance Memorandum.

Ref 11a: Contractor performance is restricted to the Government Performance Locations identified in Item 8. Government agency or activity will provide security classification guidance for performance of this contract. Submit visit request to COR and/or Security Management Office for need-to-know verification.

Ref 11f: Classified performance in locations other than the United States, Puerto Rico, U.S. Possessions and Trust Territories is restricted to SOCAFRICA and SOCEUR, Stuttgart Germany.

Ref 11l: Controlled Unclassified Information (CUI) provided under this contract shall be safeguarded as specified in the FOUO Addendum included with this specification.

Ref 11m: Access to all USSOCOM facilities requires contractors to possess a minimum of a SECRET clearance.

Ref 11m: Contractor will not be authorized to courier classified information.

Ref 12: Requests must be forwarded through the responsible Contracting Officer’s Representative/Program Manager, Contracting Official (Item 16) and the HQ USSOCOM Special Operations Communication Office (SOCS-SOCO) prior to public release.

SCI ADDENDUM

This supplement applies to:

Prime Contract Number: RFP# H9240019R0002 Subcontract Number: N/A Delivery/Task Order Number: N/A Expiration Date: 30 November 2020

The following controls will apply to Sensitive Compartmented Information (SCI) provided under this contract.

1. Item 10e (2): Security clearances for contractors working within SCIF spaces must be adjudicated meeting Intelligence Community Policy Guidance (ICPG) 704.1, 704.2, 704.3, 704.4, 704.5 eligibility requirements. Prior approval of the contracting activity is required for sub-contracting. Access to intelligence information requires special briefings and a final U.S. Government clearance at the appropriate level.

2. Item 13: Department of Defense (DOD) Manual 5105.21, Volumes 1-3, Intelligence Community Policy Guidance (ICPG) 704.1, 704.2, 704.3, 704.4, 704.5, Intelligence Community Standard (ICS) 705-1&2 including the Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities (IC Tech Spec-for ICD/ICS 705, and Headquarters, United States Special Operations Command (HQ USSOCOM) 380-6, provide the necessary guidance for physical and information security measures and are part of the SCI security specifications for the contract.

3. Item 13: Inquiries pertaining to classification guidance will be directed to the responsible USSOCOM Contracting Officer’s Representative/Program Manager/Contract Monitor (Diego Esguerra, GS-12, 813-826-2986).

4. Item 13: All SCI furnished to the contractor in support of this contract / delivery / task order remains the property of the DOD or the agency or command that releases the information. Upon termination of the contract, all furnished SCI will be returned to the HQ USSOCOM Special Security Office (SSO) or the prime contractor.

5. Item 14: This contract / delivery / task order requires that THIRTEEN (13) contract billets be established in order to fulfill the contractual obligations incurred. Access will be granted by the government agency. Upon completion or cancellation of the contract, the Contractor SSO (CSSO) will debrief or notify the HQ USSOCOM SSO to debrief all personnel not required for contract closeout and those billets will be disestablished.

6. Item 14: Names of contractor personnel requiring access to SCI and justification for SCI billets will be submitted to HQ USSOCOM SSO after contract monitor coordination. Billet justifications will include the contract statement of work. If a Single-Scope Background (SSBI) Investigation has not been completed upon approval of billets by the HQ USSOCOM SSO, the CSSO will submit necessary forms to the Personnel Security Management Office for Industry (PSMO-I) for an SSBI. An SSBI and access to SCI will comply with the National Industrial Security Program Manual. Upon completion of the SSBI, a nomination for SCI access will be submitted to HQ USSOCOM SSO.

7. Item 14: The CSSO will advise HQ USSOCOM SSO, through the contract monitor, upon reassignment of personnel to other duties not associated with this contract.

8. Item 14: The CSSO must coordinate with the SCI contract monitor before subcontracting any portion of SCI efforts involved in the contract. A separate DD Form 254 for the subcontractor will be processed and a copy provided to HQ USSOCOM SSO.

9. Item 14: The contractor will not use references to SCI access, even by unclassified acronyms, in advertisements, promotional efforts, or recruitment of employees.

10. Item 14: All SCI work will be performed at the locations specified below and in subsequent Task Orders.

a. HQ USSOCOM

b. HQ USSOCOM/NCR

c. HQ USASOC

d. HQ SOCPAC

e. JSOC

f. NSWC

11. Item 15: HQ USSOCOM SSO has exclusive security responsibility for all SCI released to the contractor or developed under this contract. Defense Intelligence Agency and HQ USSOCOM SSO retain authority for all inspections of the contractor to ensure compliance with SCI directives, regulations, and instructions.

12. In accordance with DODM 5105.21 Volume 1-3, the following activity is designated User Agency Special Security Office for SCI requirement:

HQ USSOCOM

Special Security Office (SSO) 7701 Tampa Point Boulevard Telephone: DSN 299-1287 CNP@SOCOM.MIL MacDill AFB, Florida 33621-5323 Commercial: (813) 826-1287

PROTECTING SPECIAL ACCESS PROGRAM (SAP) INFORMATION

SAP ADDENDUM

(2 January 2018 Edition)

Special Access Program (SAP) discussion, storage, and processing associated with this effort will be conducted in SAP Facilities (SAPF) specifically approved, in writing, by the USSOCOM SAPCO or designated USSOCOM Program Security Officer (PSO). Contact the individual in Block 16 for approved SAPF locations.

SAP activities are governed by Revision 1, of the Department of Defense Overprint to the National Industrial Security Program Operating Manual (NISPOM) Supplement; DOD Manual 5200.01 (DOD Information Security Program) Volumes 1-4, DOD Directive 5205.07 (Special Access Program Policy); DOD Manual 5205.07 (DOD Special Access Program Security Manual), Volumes 1-4; DOD Instruction 5205.11, (Joint SAP Implementation Guide (JSIG)); USSOCOM Manual 380-2 (SAP Security Guide); USSOCOM Manual 380-7 (USSOCOM Arms Control Readiness Inspection Program) and applicable program security classification guides and subsequent versions. Applicable documents will be provided to the contractor by the PSO under separate cover.

Access to SAP information requires employees to undergo additional personnel security screening and meet the requirements of DoD SAP accessing directives and policies in accordance with DODM 5205.07, Volume 2. The individual must meet applicable eligibility requirements and possess a final Secret or Top Secret security clearance depending on the level of access required in performance of this contract. Program Access Requests (PAR) for contractor personnel must be submitted by the Contractor’s Program Security Officer (CPSO) to the PSO for approval by the designated Access Approval Authority (AAA). Personnel approved for access will receive a program indoctrination briefing and must sign a SAP Indoctrination Agreement (PIA) prior to receiving access to program information or material. The CPSO will maintain the signed PIA and forward a copy to the PSO for entry into the appropriate database system.

SAP inspections and security oversight while in USSOCOM or Component government facilities are under the cognizance of the USSOCOM PSO or SAPCO representative, as appropriate. Additional Component SAP security requirements may apply for activities conducted at Service Component or Sub-unified command locations. The Performance Monitor or component command COR at these locations/facilities will provide specific or additional guidance. SAP reviews conducted at contractor facilities are under the security oversight of the Defense Security Service (DSS) unless officially relieved of oversight responsibilities.

OPSEC-sensitive or classified communication will be conducted via PSO-approved secure channels from within the SAPF. Transmission of documents via secure facsimile between terminals within SAPFs may be approved by the PSO. Only the U.S. Postal Service Register or Certified mail, if authorized, will be used to mail program material unless an alternate method is approved by the PSO. Briefed personnel are authorized to courier classified information within the continental United States with written approval from the CPSO or PSO. Two (program briefed) personnel are required to courier Top Secret material unless prior approval is obtained from the PSO. Couriers will be in the possession of PSO-issued courier authorization letters prior to travel. All material, to be mailed or carried, will be wrapped and transmitted in accordance with DODM 5205.07, Volume 1.

Prior to processing SAP information on any Automated Information System (AIS), the contractor will provide the PSO with a System Security Plan (SSP) and other documentation required in JSIG for Assessment & Authorization (A&A) from the Authorizing Official (AO), or subsequent policy. The PSO will issue program specific Security Authorization following verification of the A&A process. USSOCOM Special Access Program (SAP) Policy Memorandum: Removable Media and Two-Person Integrity Control Policy is applicable for this contract.

Destruction of program material will be conducted only by program indoctrinated personnel using destruction equipment and procedures approved by the PSO. A single person may destroy non-accountable classified material. Accountable material must be destroyed, and documented, by two program cleared individuals.

The PSO will be advised of any reports which affect the baseline facility clearance or any incident that has an adverse impact on a personnel security clearance. All briefed personnel are required to report any information that could have an impact on their ability to protect classified information. Reportable items include: foreign travel, contacts, or associations; criminal, civil, financial, or mental health issues; and changes in personal status such as marriage, divorce, or employment. CPSOs are reminded of their responsibilities to diligently report any significant action or any change in an employee’s eligibility to the PSO immediately.

Per DOD Manual 5205.07 Volume 1, Encl. 11, Sec 3. : “Any (contractual) relationship with a prospective subcontractor requires prior approval by the PSO.” All security requirements levied upon the prime contractor will “flow-down” to the subcontractor. SAP access and other requirements must be pre-coordinated and approved by the PSO prior to implementation.

IAW DODM 5200.01, Vol 3, Encl. 6, any security incident involving the potential loss, compromise, or suspected compromise of classified information must be reported to the PSO immediately using appropriate secure channels. Security infractions will be documented in the individuals personal security file and made available for review during PSO visits.

PROTECTING "FOR OFFICIAL USE ONLY" (FOUO) INFORMATION

FOUO ADDENDUM

(Updated June 2014)

1. GENERAL:

a. The "For Official Use Only" (FOUO) marking is assigned to information at the time of its creation in a DOD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

b. Other non-security markings, such as "Limited Official Use" and "Official Use Only" are used by non-DOD User Agencies for the same type of information and should be safeguarded and handled in accordance with instruction received from such agencies.

c. Use of the above markings does not mean that the information cannot be released to the public under FOIA, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions therein.

2. MARKINGS:

a. Unclassified documents containing FOUO information will be marked "UNCLASSIFIED//For Official Use Only" or "U//FOUO" at the bottom of the front cover (if any), on the first page, on each page containing FOUO information , on the back page, and on the outside of the back cover (if any). Each paragraph containing FOUO information shall be marked as such.

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. Individual paragraphs shall be marked at the appropriate level be it classified, unclassified, or FOUO. An individual page that ONLY contains FOUO and unclassified information shall be marked “FOR OFFICIAL USE ONLY” or the highest classification of the entire document at the top and bottom of the page. If an individual portion contains FOUO information but no classified information, the portion will be marked, "FOUO."

c. Mark other records, such as computer print outs, photographs, films, tapes, or slides "FOR OFFICIAL USE ONLY" so that the viewer knows the record contains FOUO information.

d. Removal of the "For Official Use Only" marking can only be accomplished by the originator or other competent authority. When the "For Official Use Only" status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: "For Official Use Only" information may be disseminated between officials of DOD Components, DOD contractors, consultants, and grantees to conduct official business for the DOD. FOUO information may also be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Recipients shall ·be made aware of the special handling instructions detailed in this document and that it's exempt from public disclosure under the FOIA utilizing the following statement: "This document contains information EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FOIA".

4. STORAGE: During working hours, "For Official Use Only" information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after- hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: "For Official Use Only" information may be sent in the following ways:

a. Mail - FOUO may be sent via first-class mail or parcel post. Bulky shipments may be sent by fourth-class mail.

b. Fax - Normally FOUO may be sent over facsimile equipment. To prevent unauthorized disclosure the following should be considered: Use of special cover sheets, location of fax machines (both ends) and whether authorized personnel are available to receive FOUO information

c. E-Mail/Websites - E-mail may be used on approved secure communication systems or systems utilizing other protective measures such as Public Key Infrastructure (PKI) or transport layer security (e.g., https).

**Ensure documents/methods that transmit FOUO material call attention to any FOUO attachments. **

6. DISPOSITION: When no longer needed, FOUO information must be disposed of in a way that will preclude its disclosure to unauthorized individuals.

7. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of "For Official Use Only" information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions and disciplinary action may be taken against those responsible.

text: HQ USSOCOM/SOCS-WCP

813-826-2986/DSN 299-2606

howard.ammerman@socom.mil text: HQ USSOCOM/J2-SSO

813-826-1876/DSN 299-1876

juan.soto@socom.mil text: HQ USSOCOM/SOCS-CORB

813-826-4977/DSN 299-4977

sherita.spencer@socom.mil

Contracting Officer's Representative rep: Juan Soto HQ USSOCOM SSO Industrial Security rep: Jennifer Parrish HQ USSOCOM SAPCO Industrial Security

Training Requirement: Contractors performing on this contract at military installations are required to conduct command and unit specific security training (Initial/Refresher INFOSEC, OPSEC, EMSEC, AT/FP, Intelligence Oversight, etc.). This training will be provided by the responsible military organization.

IA requirements: Specific Information Assurance requirements may be mandated and are authorized by the responsible command/unit where primary performance location is identified.

When no government employee or military member is available the contractor will be required to conduct security related functions (traditionally considered inherently governmental functions) such as opening/closing of security containers, end-of-day checks for processing and safeguarding classified information/material, and arming/de-arming the following government facilities.

- USSOCOM Building 149, Rooms 121 and 122, MacDill AFB FL

In the event that the contractor fails to properly conduct these responsibilities and a security violation/incident occurs, the government will have the option to revoke authorization.

7701 Tampa Point Blvd MacDill AFB, FL 33621

Address: HQ USSOCOM/SOCS-Z-SM 7701 Tampa Point Blvd MacDill AFB, FL 33621