522022ms1front.pdf

DoD 5220.22-M-Sup 1, Feb. 1995

3 FOREWORD

TABLE OF CONTENTS

Page

FOREWORD 2

TABLE OF CONTENTS 4

DEFINITIONS 7

AIS ACRONYMS 16

CHAPTER 1 - GENERAL PROVISIONS AND REQUIREMENTS 18

C1.1. FACILITY CLEARANCES 18

C1.2. GENERAL REQUIREMENTS 20

C1.3. REPORTING REQUIREMENTS 23

CHAPTER 2 - SECURITY CLEARANCES 27

C2.1. FACILITY CLEARANCES 27

C2.2. PERSONNEL CLEARANCES AND ACCESS 28

CHAPTER 3 - SECURITY TRAINING AND BRIEFINGS 32

C3.1. SECURITY TRAINING AND BRIEFINGS 32

CHAPTER 4. - CLASSIFICATION AND MARKING 37

C4.1. CLASSIFICATION 37

C4.2. MARKING REQUIREMENTS 37

CHAPTER 5 - SAFEGUARDING CLASSIFIED INFORMATION 39

C5.1. GENERAL SAFEGUARDING REQUIREMENTS 39

C5.2. CONTROL AND ACCOUNTABILITY 39

C5.3. STORAGE AND STORAGE EQUIPMENT 39

C5.4. TRANSMISSION 40

C5.5. DISCLOSURE 40

C5.6. REPRODUCTION 41

C5.7. DISPOSITION AND RETENTION 41

C5.8. CONSTRUCTION REQUIREMENTS 42

4 TABLE OF CONTENTS

TABLE OF CONTENTS, Continued

CHAPTER 6 - VISITS AND MEETINGS 46

C6.1. VISITS 46

C6.2. MEETINGS 48

CHAPTER 7 - SUBCONTRACTING 49

C7.1. PRIME CONTRACTOR RESPONSIBILITIES 49

CHAPTER 8 - AUTOMATED INFORMATION SYSTEM SECURITY 52

C8.1. RESPONSIBILTIIES 52

C8.2. SECURITY MODES 59

C8.3. SYSTEM ACCESS AND OPERATION 69

C8.4. NETWORKS 74

C8.5. SOFTWARE AND DATA FILES 78

C8.6. AIS ACQUISITION, MAINTENANCE, AND RELEASE 84

C8.7. DOCUMENTATION AND TRAINING 88

CHAPTER 9 - RESTRICTED DATA 91

C9.1. INTRODUCTION 91

C9.2. SECURE WORKING AREAS 93

C9.3. STORAGE REQUIREMENTS 95

CHAPTER 10 - INTERNATIONAL SECURITY REQUIREMENTS 97

CHAPTER 11 - MISCELLANEOUS 98

C11.1. TEMPEST 98

C11.2. GOVERNMENT TECHNICAL LIBRARIES 98

C11.3. INDEPENDENT RESEARCH AND DEVELOPMENT 98

C11.4. OPERATIONS SECURITY 99

C11.5. COUNTERINTELLEGENCE (CI) SUPPORT 99

C11.6. DECOMPARTMENTATION, DISPOSITION, AND TECHNOLOGY TRANSFER 99

C11.7. OTHER TOPICS 101

5 TABLE OF CONTENTS

TABLE OF CONTENTS, Continued

FIGURES

C1.F1. SAP GOVERNMENT/CONTRACTOR

RELATIONSHIPS

TABLES

C8.T1. CLEARING AND SANITIZATION DATA STORAGE 82

C8.T2. SANITIZING AIS COMPONENTS 83

APPENDICES

AP1. APPENDIX 1 - AISSP OUTLINE 102

AP2. APPENDIX 2 - AIS CERTIFICATION AND ACCREDITATION 110

AP3. APPENDIX 3 - REFERENCES 112

6 TABLE OF CONTENTS

DL1. DEFINITIONS

DL1.1.1. Access Approval Authority. Individual responsible for final access approval and/or denial determination.

DL1.1.2. Access Roster. A database or listing of individuals briefed to a special access program.

DL1.1.3. Access Termination. The removal of an individual from access to SAP or other Program information.

DL1.1.4. Accrediting Authority. A Customer official who has the authority to decide on accepting the security safeguards prescribed or who is responsible for issuing an accreditation statement that records the decision to accept those safeguards.

DL1.1.5. Acknowledged Special Access Program. A SAP whose existence is publicly acknowledged.

DL1.1.6. Acquisition Special Access Program (AQ-SAP). A special access program established primarily to protect sensitive research, development, testing, and evaluation (RDT&E) or procurement activities in support of sensitive military and intelligence requirements.

DL1.1.7. Agent of the Government. A contractor employee designated in writing by the Government Contracting Officer who is authorized to act on behalf of the Government.

DL1.1.8. Authentication

DL1.1.8.1. To establish the validity of a claimed identity.

DL1.1.8.2. To provide protection against fraudulent transactions by establishing the validity of message, station, individual, or originator.

DL1.1.9. Automated Information System (AIS). A generic term applied to all electronic computing systems. AISs are composed of computer hardware (i.e., automated data processing (ADP) equipment and associated devices that may include communication equipment), firmware, operating systems, and other applicable software. AISs collect, store, process, create, disseminate, communicate, or control data or information.

7 DEFINITIONS

DL1.1.10. Billets. A determination that in order to meet need-to-know criteria, certain SAPs may elect to limit access to a predetermined number of properly cleared employees. Security personnel do not count against the billet system.

DL1.1.11. Boundary. The boundary of an AIS or network includes all users that are directly or indirectly connected and who can receive data from the system without a reliable human review by an appropriately cleared authority.

DL1.1.12. Certification. A statement to an accrediting authority of the extent to which an AIS or network meets its security criteria. This statement is made as part of and in support of the accreditation process.

DL1.1.13. Clearing. The removal of information from the media to facilitate continued use and to prevent the AIS system from recovering previously stored data.

However, the data may be recovered using laboratory techniques. Overwriting and degaussing are acceptable methods of clearing media.

DL1.1.14. Codeword. A single classified word assigned to represent a specific SAP or portions thereof.

DL1.1.15. Collateral Information. Collateral information is National Security Information created in parallel with Special Access Information under the Provisions of E.O. 12356 (et al) but which is not subject to the added formal security protection required for Special Access Information (stricter access controls, need-to-know, compartmentation, stricter physical security standards, etc.).

DL1.1.16. Compelling Need. A requirement for immediate access to special program information to prevent failure of the mission or operation or other cogent reasons.

DL1.1.17. Contractor Program Security Officer (CPSO). An individual appointed by the contractor who performs the security duties and functions for Special Access Programs.

DL1.1.18. Contractor Program Manager (CPM). A contractor-designated individual who has overall responsibility for all aspects of a Program.

DL1.1.19. Counterintelligence Awareness. A state of being aware of the sensitivity of classified information one possesses, collaterally aware of the many modes of operation of hostile intelligence persons and others whose interests are inimical to the United States while being able to recognize attempts to compromise

8 DEFINITIONS

one's information, and the actions one should take, when one suspects he has been approached, to impart the necessary facts to trained counterintelligence personnel.

DL1.1.20. Customer. The Government organization that sponsors the processing.

DL1.1.21. Data Integrity

DL1.1.21.1. The state that exists when computerized data is the same as that in the source documents and has not been exposed to accidental or malicious alteration or destruction.

DL1.1.21.2. The property that data has not been exposed to accidental or malicious alteration or destruction.

DL1.1.22. Debriefing. The process of informing a person his need-to-know for access is terminated.

DL1.1.23. Declassification (Media). An administrative step that the owner of the media takes when the classification is lowered to UNCLASSIFIED. The media must be properly sanitized before it can be downgraded to UNCLASSIFIED.

DL1.1.24. Degauss

DL1.1.24.1. To reduce the magnetization to zero by applying a reverse (coercive) magnetizing force, commonly referred to as demagnetizing; or

DL1.1.24.2. To reduce the correlation between previous and present data to a point that there is no known technique for recovery of the previous data.

DL1.1.25. Degausser. An electrical device or hand-held permanent magnet assembly that generates a coercive magnetic force for degaussing magnetic storage media or other magnetic material.

DL1.1.26. Degaussing (Demagnetizing). Procedure using an approved device to reduce the magnetization of a magnetic storage media to zero by applying a reverse (coercive) magnetizing force rendering any previously stored data unreadable and unintelligible.

DL1.1.27. Digraph and/or Tri-Graph. A two- and/or three-letter acronym for the assigned Codeword or nickname.

9 DEFINITIONS

DL1.1.28. Disclosure Record. A record of names and dates of initial access to any Program information (e.g., for example (exempli gratia)).

DL1.1.29. Eligibility. A determination that a person meets personnel security standards for access to Program material.

DL1.1.30. EPROM. A field-programmable read-only memory that can have the data content of each memory cell altered more than once. An EPROM is bulk-erased by exposure to a high-intensity ultraviolet light. Sometimes referred to as a reprogrammable read-only memory.

DL1.1.31. EEPROM. Abbreviation for electrically erasable programmable read-only memory. These devices are fabricated in much the same way as EPROMs and, therefore, benefit from the industry's accumulated quality and reliability experience. As the name implies, erasure is accomplished by introducing electrical signals in the form of pulses to the device, rather than by exposing the device to ultraviolet light. Similar products using a nitride NMOS process are termed EAROMS (for electrically alterable read-only memory).

DL1.1.32. Government Program Manager (GPM). The senior Government Program official who has ultimate responsibility for all aspects of the Program (e.g., that is (id est)).

DL1.1.33. Inadvertent Disclosure. A set of circumstances or a security incident in which a person has had involuntary access to classified information to which the individual was or is not normally authorized.

DL1.1.34. Indoctrination. An initial indoctrination and/or instruction provided each individual approved to a SAP prior to his exposure concerning the unique nature of Program information and the policies, procedures, and practices for its handling.

DL1.1.35. Information Systems Security Representative (ISSR). The Provider-assigned individual responsible for the on-site security of the AIS(s) processing information for the Customer.

DL1.1.36. Joint Use Agreement. A written agreement signed by two or more accrediting authorities whose responsibility includes information processed on a common AIS or network. Such an agreement defines a cognizant security authority and the security arrangements that will govern the operation of the network.

10 DEFINITIONS

DL1.1.37. Memorandum of Agreement (MOA). An agreement, the terms of which are delineated and attested to by the signatories thereto MOA and MOU (Memorandum of Understanding) are used interchangeably.

DL1.1.38. Network. A computing environment with more than one independent processor interconnected to permit communications and sharing of resources.

DL1.1.39. Nicknames. A combination of two separate unclassified words assigned to represent a specific SAP or portion thereof.

DL1.1.40. Nonvolatile Memory Components. Memory components that do retain data when all power sources are disconnected.

DL1.1.41. Object Reuse. The reassignment to some subject of a medium (e.g., page frame, disk sector, magnetic tape) that contained one or more objects. To be securely reassigned, such media will contain no residual data from the previously contained object(s).

DL1.1.42. Office Information System (OIS). An OIS is a special purpose AIS oriented to word processing, electronic mail, and other similar office functions. An OIS is normally comprised of one or more central processing units, control units, storage devices, user terminals, and interfaces to connect these components.

DL1.1.43. Overwrite (Re-Recording) Verification

DL1.1.43.1. An approved procedure to review, display, or check the success of an overwrite procedure; or

DL1.1.43.2. The successful testing and documentation through hardware and random hard-copy readout of the actual overwritten memory sectors.

DL1.1.44. Perimeter. The perimeter of an AIS or network is the extent of the system that is to be accredited as a single system.

DL1.1.45. Peripheral Devices. Any device attached to the network that can store, print, display, or enhance data (e.g., disk and/or tape, printer and/or plotter, an optical scanner, a video camera, a punched-card reader, a monitor, or card punch).

DL1.1.46. Personal Computer System (PC). A PC is a system based on a microprocessor and comprised of internal memory (ROMs and RAMs), input and for output, and associated circuitry. It typically includes one or more read/write device(s)

11 DEFINITIONS

for removable magnetic storage media (e.g., floppy diskettes, tape cassettes, hard disk cartridges), a keyboard, CRT or plasma display, and a printer. It is easily transported and is primarily used on desk tops for word processing, database management, or engineering analysis applications.

DL1.1.47. Program Access Request (PAR). A formal request used to nominate an individual for Program access.

DL1.1.48. Program Channels Or Program Security Channels. A method or means expressly authorized for the handling or transmission of classified or unclassified SAP information whereby the information is provided to indoctrinated persons.

DL1.1.49. Program Executive Agent. The highest ranking military or civilian individual charged with direct responsibility for the Program and usually appoints the Government Program Manager.

DL1.1.50. Program Material. Program material and information describing the service(s) provided, the capabilities developed, or the item(s) produced under the SAP.

DL1.1.51. Program Security Officer (PSO). The Government official who administers the security policies for the SAP.

DL1.1.52. Program Sensitive Information. Unclassified information that is associated with the Program. Material or information that, while not directly describing the Program or aspects of the Program, could indirectly disclose the actual nature of the Program to a non-Program-briefed individual.

DL1.1.53. Provider. The Contractor or Government-support organization (or both) that provides the process on behalf of the Customer.

DL1.1.54. Sanitizing. The removal of information from the media or equipment such that data recovery using any known technique or analysis is prevented. Sanitizing shall include the removal of data from the media, as well as the removal of all classified labels, markings, and activity logs. Properly sanitized media may be subsequently declassified upon observing the organization's respective verification and review procedures.

DL1.1.55. Secure Working Area. An accredited facility or area that is used for handling, discussing and/or processing, but not storage of SAP information.

DL1.1.56. Security Level. A clearance or classification and a set of designators of special access approvals; i.e., a clearance and a set of designators of special access

12 DEFINITIONS

approval or a classification and a set of such designators, the former applying to a user, the latter applying, for example, to a computer object.

DL1.1.57. Security Policy. The set of laws, rules, and practices that regulate how an organization manages, protects, and distributes sensitive information. A complete security policy will necessarily address many concerns beyond the scope of computers and communications.

DL1.1.58. Security Profile. The approved aggregate of hardware/software and administrative controls used to protect the system.

DL1.1.59. Security Testing. A process used to determine that the security features of a system are implemented as designed and that they are adequate for a proposed application environment. This process includes hands on functional testing, penetration testing, and verification. See also: Functional Testing, Penetration Testing, Verification.

DL1.1.60. Sensitivity Label. A collection of information that rep resents the security level of an object and that describes the sensitivity of the data in the object. A sensitivity label consists of a sensitivity level (classification and compartments) and other required security markings (e.g., Code words, handling caveats) to be used for labeling data.

DL1.1.61. Sensitive Activities. Sensitive activities are special access or Codeword programs, critical research and development efforts, operations or intelligence activities, special plans, special activities, or sensitive support to the customer or customer contractors or clients.

DL1.1.62. Sensitive Compartmented Information (SCI). SCI is classified information concerning or derived from intelligence sources and methods or analytical processes that is required to be handled within a formal control system established by Director of Central Intelligence.

DL1.1.63. Sensitive Compartmented Information Facility (SCIF). SCIF is an area, room(s), building installation that is accredited to store, use, discuss, or electronically process Sensitive Compartmented Information (SCI). The standards and procedures for a SCIF are stated in DCIDs 1/19and 1/21.

DL1.1.64. Special Access Program Facility (SAPF). A specific physical space that has been formally accredited in writing by the cognizant PSO that satisfies the criteria for generating, safeguarding, handling, discussing, and storing CLASSIFIED and/or UNCLASSIFIED Program information, hardware, and materials.

13 DEFINITIONS

DL1.1.65. Special Program Document Control Center. The component's activity assigned responsibility by the ISSR for the management, control, and accounting of all documents and magnetic media received or generated as a result of the special program activity.

DL1.1.66. Stand-Alone AIS. A stand-alone AIS may include desktop, laptop, and notebook personal computers, and any other hand-held electronic device containing classified information. Stand-alone AISs by definition are not connected to any LAN or other type of network.

DL1.1.67. System. An assembly of computer and/or communications hardware, software, and firmware configured for the purpose of classifying, sorting, calculating, computing, summarizing, transmitting and receiving, storing, and retrieving data with a minimum of human intervention.

DL1.1.68. Tri-Graph. (See Digraph and/or Tri-Graph.)

DL1.1.69. Trojan Horse. A computer program with an apparently or actually useful function that contains additional (hidden) functions that surreptitiously exploit the legitimate authorizations of the invoking process to the detriment of security (for example, making a "blind copy" of a sensitive file for the creator of the Trojan horse).

DL1.1.70. Trusted Computer System. A system that employs sufficient hardware and software integrity measures to allow its use for processing simultaneously a range of sensitive or classified information.

DL1.1.71. Trusted Path. A mechanism by which a person at a terminal can communicate directly with the trusted computing base. This mechanism can only be activated by the person or the trusted computing base and cannot be limited by un-trusted software.

DL1.1.72. Two-Person Integrity. A provision that prohibits one person from working alone.

DL1.1.73. Unacknowledged Special Access Program. A SAP with protective controls that ensures the existence of the Program is not acknowledged, affirmed, or made known to any person not authorized for such information. All aspects (e.g., technical, operational, logistical, etc.) are handled in an unacknowledged manner.

DL1.1.74. Users. Any person who interacts directly with an AIS or a network system. This includes both those persons who are authorized to interact with the

14 DEFINITIONS

system and those people who interact without authorization (e.g., active or passive wire-tappers).

DL1.1.75. Vendor. The manufacturer or sellers of the AIS equipment and/or software used on the special program.

DL1.1.76. Virus. Malicious software. A form of Trojan horse that reproduces itself in other executable code.

DL1.1.77. Volatile Memory Components. Memory components that do not retain data after removal of all electrical power sources and when reinserted into a similarly configured AIS do not contain residual data.

DL1.1.78. Workstation. A high-performance, microprocessor-based platform that uses specialized software applicable to the work environment.

15 DEFINITIONS

AL1. AIS ACRONYMS

Many computer security-related acronyms are used in this Supplement. These acronyms, after first being defined, are used throughout this document to reduce its length. The acronyms used in this document are defined below:

AL1.1. AIS Automated Information System AL1.2. AISSP AIS Security Plan AL1.3. CM Configuration Management AL1.4. CCB Configuration Control Board AL1.5. CPU Central Processing Unit AL1.6. CRT Cathode Ray Tube (Monitor Screen Tube) AL1.7. CSA Cognizant Security Agency (Customer) AL1.8. DAC Discretionary Access Control AL1.9. DCID Director of Central Intelligence Directive AL1.10. DoD Department of Defense AL1.11. E.O. Executive Order AL1.12. EPROM Erasable Programmable

Read-Only Memory AL1.13. EAPROM Electrically Alterable Programmable

Read-Only Memory AL1.14. EEPROM Electrically Erasable Programmable

Read-Only Memory AL1.15. I/O Input and/or Output AL1.16. ISSR Information System Security Representative AL1.17. K Thousand (kilo) AL1.18. LAN Local Area Network AL1.19. LOGON Log On AL1.20. MAC Mandatory Access Control AL1.21. MODEM Modulator and/or Demodulator AL1.22. NCSC National Computer Security Center AL1.23. NSA National Security Agency AL1.24. OMB Office of Management and Budget AL1.25. PC Personal Computer (i.e., desktop, laptop, notebook, or hand-held computer)

16 ACRONYMS

AL1.26. PL Public Law AL1.27. PROM Programmable Read-Only Memory AL1.28. RAM Random Access Memory AL1.29. ROM Read Only Memory AL1.30. SAN Separately Accredited Network AL1.31. SAP Special Access Program AL1.32. SAPF Special Access Program Facility AL1.33. SCI Sensitive Compartmented Information AL1.34. STD Standard AL1.35. TS Top Secret AL1.36. USER ID User Identification

17 ACRONYMS

C1. CHAPTER 1

GENERAL PROVISIONS AND REQUIREMENTS

C1.1. INTRODUCTION

C1.1.1. Purpose.

C1.1.1.1. This Supplement provides special security measures to ensure the integrity of SAPs, Critical SECRET Restricted Data (SRD), and TOP SECRET Restricted Data (TSRD) and imposes controls supplemental to security measures prescribed in the NISPOM for classified contracts. Supplemental measures fall under the cognizance of the Department of Defense, DCI, DOE, NRC or other CSA as appropriate. See Figure C1.F1., "SAP Government and Contractor Relationships." Additionally, specific contract provisions pertaining to these measures applicable to associated unacknowledged activities will be separately provided. Any Department, Agency, or other organizational structure amplifying instructions will be inserted immediately following the applicable security options selected from the NISPOMSUP. This will facilitate providing a contractor with a supplement that is overprinted with the options selected.

C1.1.1.2. Security Options. This Supplement contains security options from which specific security measures may be selected for individual programs. The options selected shall be specifically addressed in the Program Security Guide (PSG) and/or identified in the Contract. The PSG shall be endorsed by the CSA or his/her designee, establishing the program, although, as a rule, the DCIDs sets the upper limits. In some cases, security or sensitive factors may require security measures that exceed DCID standards. In such cases, the higher standards shall be listed separately and specifically endorsed by the CSA creating the program and may be reflected as an overprint to this Supplement.

C1.1.2. Scope

C1.1.2.1. The policy and guidance contained herein and imposed by contract is binding upon all persons who are granted access to SAP information. Acceptance of the contract security measures is a prerequisite to any negotiations leading to Program participation and accreditation of a Special Access Program Facility (SAPF).

C1.1.2.2. The following is restated from the baseline for clarity. If a contractor determines that implementation of any provision of this Supplement is more

18 CHAPTER 1

costly than provisions imposed under previous U.S. Government policies, standards, or requirements, the contractor shall notify the Cognizant Security Agency. Contractors shall, however, implement any such provision within three years from the date of this Supplement, unless a written exception is granted by the CSA.

C1.1.2.3. The DCIDs apply to all SCI and DCI programs and any other SAP that selects them as the program security measures.

C1.1.3. Agency Agreement SAP Program Areas. The Government Agency establishing a SAP will designate a Program Executive Agent for the administration, security, execution, and control of the SAP. The Program Security Officer (PSO), rather than the Facility CSA, will be responsible for security of the program and all program areas.

C1.1.4. Security Cognizance. Those Heads of Agencies authorized under E.O.

12356 or successor order to create SAPs may enter into agreements with the Secretary of Defense that establish the terms of the Secretary of Defense's responsibilities for the SAP. When a Department or Agency of the Executive Branch retains cognizant security responsibilities for its SAP, the provisions of this Supplement will apply.

C1.1.5. Supplement Interpretations. All contractor requests for interpretation of this Supplement will be forwarded to the PSO.

C1.1.6. Supplement Changes. Users of this Supplement are encouraged to submit recommended changes and comments through their PSO in concurrence with the baseline.

C1.1.7. Waivers and Exceptions. The purpose of having a waiver and exception policy is to ensure that deviations from established SAP criteria are systematically and uniformly identified to the Government Program Manager (GPM). Every effort will be made to avoid waivers to established SAP policies and procedures unless they are in the best interest of the Government. In those cases where waivers are required, a request will be submitted to the PSO. As appropriate, the PSO, and if necessary the GPM (if a different individual) will assess the request for waiver and provide written approval. If deemed necessary, other security measures which address the specific vulnerability may be implemented.

C1.1.8. Special Access Programs Categories and Types

C1.1.8.1. There are four generic categories of SAPs:

C1.1.8.1.1. Acquisition SAP (AQ-SAP);

19 CHAPTER 1

C1.1.8.1.2. Intelligence SAP (IN-SAP);

C1.1.8.1.3. Operations and Support SAP (OSSAP); and

C1.1.8.1.4. SCI Programs (SCI - SAP) or other DCI programs that protect intelligence sources and methods.

C1.1.8.2. There are two types of SAPs, acknowledged and unacknowledged.

An acknowledged SAP is a program which may be openly recognized or known; however, specifics are classified within that SAP. The existence of an unacknowledged SAP or an unacknowledged portion of an acknowledged program, will not be made known to any person not authorized for this information.

Figure C1.F1. SAP Government/Contractor Relationships

C1.2. GENERAL REQUIREMENTS

C1.2.1. Responsibilities. A SAP Contractor Program Manager (CPM) and Contractor Program Security Officer (CPSO) will be designated by the contractor. These individuals are the primary focal points at the contractor facility who execute the contract. They are responsible for all Program matters. The initial

20 CHAPTER 1

nomination or appointment of the CPSO and any subsequent changes will be provided to the PSO in writing. The criteria necessary for an individual to be nominated as the CPSO will be provided in the Request for Proposal (RFP). For the purposes of SAPs, the following responsibilities are assigned:

C1.2.1.1. The CPM is (sometimes the same as, or in addition to a Contract Project Manager) the contractor employee responsible for:

C1.2.1.1.1. Overall Program management.

C1.2.1.1.2. Execution of the statement of work, contract, task orders and all other contractual obligations.

C1.2.1.2. The CPSO oversees compliance with SAP security requirements.

The CPSO will:

C1.2.1.2.1. Possess a personnel clearance and Program access at least equal to the highest level of Program classified information involved.

C1.2.1.2.2. Provide security administration and management for his/her organization.

C1.2.1.2.3. Ensure personnel processed for access to a SAP meet the prerequisite personnel clearance and/or investigative requirements specified.

C1.2.1.2.4. Ensure adequate secure storage and work spaces.

C1.2.1.2.5. Ensure strict adherence to the provisions of the NISPOM and its Supplement.

C1.2.1.2.6. When required, establish and oversee a classified material control program for each SAP.

C1.2.1.2.7. When required, conduct an annual inventory of accountable classified material.

C1.2.1.2.8. When required, establish a SAPF.

C1.2.1.2.9. Establish and oversee visitor control program.

C1.2.1.2.10. Monitor reproduction and/or duplication and destruction capability of SAP information.

21 CHAPTER 1

C1.2.1.2.11. Ensure adherence to special communications capabilities within the SAPF.

C1.2.1.2.12. Provide for initial Program indoctrination of employees after their access is approved; debrief and debrief personnel as required.

C1.2.1.2.13. Establish and oversee specialized procedures for the transmission of SAP material to and from Program elements.

C1.2.1.2.14. When required, ensure contractual specific security requirements such as TEMPEST, Automated Information System (AIS), and Operations Security (OPSEC) are accomplished.

C1.2.1.2.15. Establish security training and briefings specifically tailored to the unique requirements of the SAP.

C1.2.2. *Standard Operating Procedures (SOP). The CPSO may be required to prepare a comprehensive SOP to implement the security policies and requirements for each SAP. When required, SOPs will address and reflect the contractor's method of implementing the PSG. Forward proposed SOPs to the PSO for approval. SOPs may be a single plan or series of individual documents each addressing a security function.

Changes to the SOP will be made in a timely fashion, and reported to the PSO as they occur.

C1.2.3. Badging. Contractors performing on Programs where all individuals cannot be personally identified, may be required to implement a PSO-approved badging system.

C1.2.4. Communications Security (COMSEC). Classified SAP information will be electronically transmitted only by approved secure communications channels authorized by the PSO.

C1.2.5. *Two-Person Integrity (TPI) Requirement. The TPI rule may be required and exercised only with the Program CSA approval. This requirement does not apply to those situations where one employee with access is left alone for brief periods of time, nor dictate that those employees will be in view of one another.

C1.2.6. Contractors Questioning Perceived Excessive Security Requirements. All personnel are highly encouraged to identify excessive security measures that they believe have no added value or are cost excessive and should report this information to

22 CHAPTER 1

their industry contracting officer for subsequent reporting through contracting channels to the appropriate GPM/PSO. The GPM/PSO will respond through appropriate channels to the contractor questioning the security requirements.

C1.2.7. Security Reviews.

C1.2.7.1. General. The frequency of Industrial Security Reviews (e.g., Reviews, evaluations, and security surveys) is determined by the NISPOM and will be conducted by personnel designated by the CSA.

C1.2.7.2. Joint Efforts. In certain cases, an individual Program may be a joint effort of more than one component of the U.S. Government or more than one element of the same component. In such a case, one element will, by memorandum of agreement, take the lead as the Cognizant Security Agency and may have security review responsibility for the Program facility. In order to ensure the most uniform and efficient application of security criteria, review activities at contractor facilities will be consolidated to the greatest extent possible.

C1.2.7.3. Prime Contractor Representative. A security representative from the prime contractor may be present and participate during reviews of subcontractors, but cannot be the individual appointed by the CSA to conduct security reviews specified in subparagraph C1.2.7.1.

C1.2.7.4. Review Reciprocity. In order to ensure the most uniform and efficient application of security reviews, review reciprocity at contractor facilities will be considered whenever possible.

C1.2.7.5. Contractor Reviews. When applicable, the U.S. Government may prescribe the intervals that the contractor will review their systems.

C1.2.7.6. Team Reviews. Team Reviews may be conducted by more than one PSO based on mutual consent and cooperation of both the Government and the contractor.

C1.3. REPORTING REQUIREMENTS

C1.3.1. General. All reports required by the NISPOM will be made through the PSO. In those instances where the report affects the baseline facility clearance or the incident is of a personnel security clearance nature, the report will also be provided to the Facility CSA. In those rare instances where classified program information must

23 CHAPTER 1

be included in the report, the report will be provided only to the PSO, who will sanitize the report and provide the information to the CSA, if appropriate.

C1.3.1.1. Adverse Information. Contractors will report to the PSO any information that may adversely reflect on the Program-briefed employee's ability to properly safeguard classified Program information.

C1.3.1.2. SAP Non-Disclosure Agreement (NDA). A report will be submitted to the PSO on an employee who refuses to sign a SAP NDA.

C1.3.1.3. Change in Employee Status. A written report of all changes in the personal status of SAP indoctrinated personnel will be provided to the PSO.

In addition to those changes identified in NISPOM subparagraph C1.3.3.3., include censure or probation arising from an adverse personnel action, and revocation, or suspension downgrading of a security clearance or Program access for reasons other than security administration purposes.

C1.3.1.4. Employees Desiring Not to Perform on SAP Classified Work. A report will be made to the PSO upon notification by an accessed employee or an employee for whom access has been requested that they no longer wish to perform on the SAP. Pending further instructions from the PSO, the report will be destroyed in 30 days.

C1.3.1.5. *Foreign Travel. The PSO may require reports of all travel outside the continental United States, Hawaii, Alaska and the U.S. possessions (i.e., Puerto Rico) except same-day travel to border areas (i.e., Canada, Mexico) for Program-accessed personnel. Such travel is to be reported to the CPSO, and retained for the life of the Contract/Program travel. Travel by Program-briefed individuals into or through countries determined by the CSA as high-risk areas, should not be undertaken without prior notification. A supplement to the report outlining the type and extent of contact with foreign nationals, and any attempts to solicit information or establish a continuing relationship by a foreign national may be required upon completion of travel.

C1.3.1.6. Arms Control Treaty Visits. The GPM and PSO will be notified in advance of any Arms Control Treaty Visits. Such reports permit the GPM and PSO to assess potential impact on the SAP activity and effectively provide guidance and assistance.

C1.3.1.7. Litigation. Litigation or public proceedings which may involve a SAP will be reported. These include legal proceedings and/or administrative actions in which the prime contractor, subcontractors, or Government organizations and

24 CHAPTER 1

their Program-briefed individuals are a named party. The CPSO win report to the PSO any litigation actions that may pertain to the SAP, to include the physical environments, facilities or personnel or as otherwise directed by the GPM.

C1.3.2. Security Violations and Improper Handing of Classified Information.

Requirements of the NISPOM baseline pertaining to security violation are applicable, except that all communications will be appropriately made through Program Security Channels within 24 hours of discovery to the PSO. The PSO must promptly advise the Facility CSA in all instances where national security concerns would impact on collateral security programs or clearances of individuals under the cognizant of the Facility CSA.

C1.3.2.1. Security Violations and Infractions

C1.3.2.1.1. Security Violation. A security violation is any incident that involves the loss, compromise, or suspected compromise of classified information.

Security violations will be immediately reported within 24 hours to the PSO.

C1.3.2.1.2. Security Infraction. A security infraction is any other incident that is not in the best interest of security that does not involve the loss, compromise, or suspected compromise of classified information. Security infractions will be documented and made available for review by the PSO during visits.

C1.3.2.2. Inadvertent Disclosure. An inadvertent disclosure is the involuntary unauthorized access to classified SAP information by an individual without SAP access authorization. Personnel determined to have had unauthorized or inadvertent access to classified SAP information should be interviewed to determine the extent of the exposing, and may be requested to complete an Inadvertent Disclosure Oath.

C1.3.2.2.1. If during emergency response situations, guard personnel or local emergency authorities (e.g., police, medical, fire, etc.) inadvertently gain access to Program material, they should be inter viewed to determine the extent of the exposure.

If circumstances warrant, a preliminary inquiry will be conducted. When in doubt, contact the PSO for advice.

C1.3.2.2.2. Refusal to sign an inadvertent disclosure oath will be reported by the CPSO to the PSO.

25 CHAPTER 1

C1.3.2.2.3. Contractors shall report all unauthorized disclosures involving RD or Formerly Restricted Data (FRD) to Department of Energy (DOE) or Nuclear Regulatory Commission (NRC) through their CSA.

26 CHAPTER 1

C2. CHAPTER 2

SECURITY CLEARANCES

C2.1. FACILITY CLEARANCES

C2.1.1. General. Contractors will possess a Facility Security Clearance to receive, generate, use, and store classified information that is protected in SAPs.

C2.1.1.1. If a facility clearance has already been granted, the SAP Program Executive Agent may carve in the Facility CSA. The agreement entered into by the Secretary of Defense (SECDEF) with the other CSAs will determine the terms of responsibility for the Facility CSA with regard to SAP programs. Due to the sensitivity of some SAPs, the program may be carved out by the Executive Agent designated by the

CSA.

C2.1.1.2. The CPSO shall notify the PSO of any activity that affects the Facility Security Clearance, (FCL).

C2.1.1.3. In certain instances, security and the sensitivity of the project may require the contract and the association of the contractor with the Program CSA be restricted and kept at a classified level. The existence of any unacknowledged effort, to include its SAPF, will not be released without prior approval of the PSO.

C2.1.2. Co-Utilization of SAPF. If multiple SAPs are located within a SAPF, a Memorandum of Agreement (MOA) shall be written between Government program offices defining areas of authorities and responsibilities. The first SAP in an area shall be considered to be the senior program and therefore the CSA for the zone unless authority or responsibility is specifically delegated in the MOA. The MOA shall be executed prior to the introduction of the second SAP into the SAPF.

C2.1.3. Access of Senior Management Officials. Only those Senior Management Of Finials requiring information pertaining to the SAP shall be processed SAP access.

C2.1.4. Facility Clearances for Multifacility Organizations

C2.1.4.1. When cleared employees are located at uncleared locations, the CPSO may designate a cleared management official at the uncleared location who shall:

27 CHAPTER 2

C2.1.4.1.1. Process classified visit requests, conduct initial or recurring briefings for cleared employees, and provide written confirmation of the briefing to the

CPSO.

C2.1.4.1.2. Implement the reporting requirements of the NISPOM and this Supplement for all cleared employees and furnish reports to the CPSO for further submittal to the CSA.

C2.1.4.1.3. Ensure compliance with all applicable measures of the NISPOM and this Supplement by all cleared employees at that location.

C2.1.4.2. If a cleared management official is not available at the uncleared location, the CPSO (or designee) shall conduct the required briefing during visits to the uncleared location or during employee visits to the location or establish an alternative procedure with CSA approval.

C2.2. PERSONNEL CLEARANCES AND ACCESS

C2.2.1. General. This section establishes the requirements for the selection, processing, briefing, and debriefing of contractor personnel for SAPs.

C2.2.2. Program Accessing and Procedures

C2.2.2.1. The individual will have a valid need-to-know (NTK) and will materially and directly contribute to the Program.

C2.2.2.2. The individual will possess a minimum of a current, final SECRET security clearance or meet the investigative criteria required for the level of access. If a person's periodic reinvestigation (PR) is outside the 5-year scope and all other access processing is current and valid, the PSO may authorize access.

However, the individual will be immediately processed for either a Single Scope Background Investigation (SSBI) or National Agency Check with Credit (NACC) as required by the level of clearance or as otherwise required by the contract.

C2.2.2.3. The contractor will nominate the individual and provide a description of the NTK justification. The CPM will concur with the nomination and verify Program contribution by signature on the Program Access Request (PAR). The CPSO will complete the PAR and review it for accuracy ensuring all required signatures are present. The CPSO signature verifies that the security clearance and investigative criteria are accurate, and that these criteria satisfy the

28 CHAPTER 2

requirements of the Program. Information regarding the PAR may be electronically submitted. While basic information shall remain the same, signatures may not be required. The receipt of the PAR package via a preapproved channel shall be considered sufficient authentication that the required approvals have been authenticated by the CPSO and contractor program manager.

C2.2.2.4. Access Criteria and Evaluation Process. In order to eliminate those candidates who clearly will not meet the scope for access and to complete the Personnel Security Questionnaire (PSQ), access evaluation may be required. In the absence of written instructions from the contracting activity, the evaluation process will conform to the following guidelines:

C2.2.2.4.1. Evaluation criteria will not be initiated at the contractor level unless both the employee and contractor agree.

C2.2.2.4.2. Contractors will not perform access evaluation for other contractors.

C2.2.2.4.3. Access evaluation criteria will be specific and will not require any analysis or interpretation by the contractor. Access evaluation criteria will be provided by the Government, as required.

C2.2.2.4.4. Those candidates eliminated during this process will be advised that access processing has terminated.

C2.2.2.4.5. Submit a Letter of Compelling Need or other documentation when requested by the PSO.

C2.2.2.4.6. Formats required for the processing of a SAP access fall into two categories: those required for the conduct of the investigation and review of the individual's eligibility, and those that explain or validate the individual's NTK. These constitute the PAR package. The PAR package used for the access approval and NTK verification will contain the following: the PAR and a recent (within 90 days) PSQ reflecting pen and ink changes, if any, signed and dated by the nominee.

C2.2.2.4.7. Once the PAR package has been completed, the CPSO will forward the candidate's nomination package to the PSO for review:

C2.2.2.4.7.1. The PSO will review the PAR package and determine access eligibility.

29 CHAPTER 2

C2.2.2.4.7.2. Access approval or denial will be determined by the GPM and/or access approval authority.

C2.2.2.4.7.3. The PSO will notify the contractor of access approval or denial.

C2.2.2.4.7.4. Subcontractors may submit the PAR package to the prime. The prime will review and concur on the PAR and forward the PAR and the unopened PSQ package to the PSO.

C2.2.2.4.8. SCI access will follow guidelines established in DCID 1/14.

C2.2.2.5. Supplementary Measures and Polygraph

C2.2.2.5.1. Due to the sensitivity of a Program or criticality of information or emerging technology, a polygraph may be required. The polygraph examination will be conducted by a properly trained, certified, U.S. Government Polygraph Specialist. If a PR is outside the 5-year investigative scope, a polygraph may be used as an interim basis to grant access until completion of the PR.

C2.2.2.5.2. There are three categories of polygraph: Counterintelligence (CI), Full Scope (CI and life style), and Special Issues Polygraph (SIP). The type of polygraph conducted will be determined by the CSA.

C2.2.2.6. Suspension and Revocation. All PSO direction to contractors involving the suspension or revocation of an employee's access will be provided in writing and if appropriate, through the contracting officer.

C2.2.2.7. Appeal Process. The CSA will establish an appeal process.

C2.2.2.8. Agent of the Government. The Government may designate a contractor-nominated employee as an Agent of the Government on a case-by-case basis. Applicable training and requirements will be provided by the Government to contractors designated as Agents of the Government.

C2.2.2.9. Access Roster or List. Current access rosters of Program-briefed individuals are required at each contractor location. They should be properly protected and maintained in accordance with the PSG The access roster should be continually reviewed and reconciled for any discrepancies. The database or listing may contain the name of the individual organization, position, billet number (if applicable), level of access, social security number, military rank/grade or

30 CHAPTER 2

comparable civilian rating scheme, and security clearance information. Security personnel required for adequate security oversight will not count against the billet structure.

31 CHAPTER 2

C3. CHAPTER 3

SECURITY TRAINING AND BRIEFINGS

C3.1. SECURITY TRAINING AND BRIEFINGS

C3.1.1. General. Every Special Access Program (SAP) will have a Security Training and Briefing Program. As a minimum, SAP-indoctrinated personnel will be provided the same or similar training and briefings as outlined in the baseline NISPOM. In addition, CPSOs responsible for SAPs at contractor facilities will establish a Security Education Program to meet any specific or unique requirements of individual special access programs. Topics that will be addressed, if appropriate to the facility or the SAP(s), include:

C3.1.1.1. Security requirements unique to SAPs.

C3.1.1.2. Protection of classified relationships.

C3.1.1.3. Operations Security (OPSEC).

C3.1.1.4. Use of nicknames and code words.

C3.1.1.5. Use of special transmission methods.

C3.1.1.6. Special test-range security procedures.

C3.1.1.7. Procedures for unacknowledged SAP security. An unacknowledged SAP will require additional security training and briefings, beyond that required in the baseline. Additional requirements will be specified in the Contract Security Classification Specification and will address steps necessary to protect sensitive relationships, locations, and activities.

C3.1.1.8. Specific procedures to report fraud, waste, and abuse.

C3.1.1.9. Computer security education that is to include operational procedures, threats, and vulnerabilities.

C3.1.1.10. Writing unclassified personnel appraisals and reviews.

C3.1.1.11. Third-Party Introductions. The purpose of the Third-Party Introduction is to provide a clearance and/or access verification to other cleared

32 CHAPTER 3

personnel. The introduction is accomplished by a briefed third party, who has knowledge of both individual's access.

C3.1.2. Security Training. The CPSO will ensure that the following security training measures are implemented:

C3.1.2.1. Initial Program Security Indoctrination. Every individual accessed to a SAP win be given an initial indoctrination. The briefing will clearly identify the information to be protected, the reasons why this information requires protection, and the need to execute a NDA. The individual will be properly briefed concerning the security requirements for the Program, understand their particular security responsibilities, and will sign a NDA. This indoctrination is in addition to any other briefing required for access to collateral classified or company proprietary information. It will be the responsibility of the PSO to provide to the contractor information as to what will be included in the initial indoctrination to include fraud, waste, and abuse reporting procedures.

C3.1.2.2. Professionalized AIS training may be required of all contractor Information Systems Security Representatives (ISSRs) to ensure that these individuals have the appropriate skills to perform their job functions in a competent and cost-effective manner. This training will be made available by the CSA. The training should consist of, but not be limited to, the following criteria:

C3.1.2.2.1. Working knowledge of all applicable and national CSA regulations and policies including those contained in this supplement;

C3.1.2.2.2. Use of common Information Security (INFOSEC) practices and technologies;

C3.1.2.2.3. AIS certification testing procedures;

C3.1.2.2.4. Use of a risk management methodology;

C3.1.2.2.5. Use of configuration management methodology.

C3.1.3. Unacknowledged Special Access Programs (SAP). Unacknowledged SAPs require a significantly greater degree of protection than acknowledged SAPs. Special emphasis should be placed on:

C3.1.3.1. Why the SAP is unacknowledged;

C3.1.3.2. Classification of the SAP;

33 CHAPTER 3

C3.1.3.3. Approved communications system;

C3.1.3.4. Approved transmission systems;

C3.1.3.5. Visit procedures;

C3.1.3.6. Specific program guidance.

C3.1.4. Refresher Briefings. Every accessed individual will receive an annual refresher briefing from the CPSO to include the…