AM0009 J-4 DD254 Processor Capacity Services 28 Sep 11.dot

HC1028-11-R-0104

Atch J-4

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

SECRET

b. LEVEL OF SAFEGUARDING REQUIRED

SECRET

FORMCHECKBOX

a. PRIME CONTRACT NUMBER

FORMCHECKBOX

11 May 110

FORMCHECKBOX

b. SUBCONTRACT NUMBER

FORMCHECKBOX

b. REVISED (Supersedes all previous specs) Revision No.

DATE (YYYYMMDD)

FORMCHECKBOX

c. SOLICITATION OR OTHER NUMBER

HC1028-11-R-0104

DUE DATE (YYYYMMDD)

FORMCHECKBOX

4. IS THIS A FOLLOW-ON CONTRACT?

FORMCHECKBOX

YES

FORMCHECKBOX

NO.

If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254?

FORMCHECKBOX

YES

FORMCHECKBOX

NO.

If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR

8. ACTUAL PERFORMANCE

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Processor Capacity Services - The purpose of this contract is to obtain reliable, responsive, and cost effective processor infrastructure services of “on-demand” processing capabilities for specified chipset architecture in both DISA and other DISA-approved locations, which are both in the continental United States (CONUS) and outside of the continental United States (OCONUS). DISA's goal is to obtain a dynamically scalable processing capability utilizing an on-demand service approach, for new equipment, that will readily adjust to changes in processing and throughput requirements, both increases and decreases, and is priced on a utility ("as used") basis or tiered structure.

The service provider will acquire, install, deinstall, transport, configure, and provide the necessary hardware (including cabinets/racks/cabling/cable management/PDUs), hardware maintenance, operating system software and services to support the processor infrastructure associated with this contract. The Government will maintain day-to-day operational control of the processing environment and complete oversight responsibility. This operational control includes the installation of all software updates after the initial delivery. However, all operating system software, maintenance, and licensing shall be included under this contract.

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

X

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

d. FORMERLY RESTRICTED DATA

e. INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

X

(2) Non-SCI

X

f. SPECIAL ACCESS INFORMATION

X

g. NATO INFORMATION

X

h. FOREIGN GOVERNMENT INFORMATION

X

i. LIMITED DISSEMINATION INFORMATION

X

l. OTHER (Specify)

k. OTHER (Specify)

SIPRNET

IT Level 1 Access

DD Form 254, DEC 1999 (EF)

PREVIOUS EDITIONS ARE OBSOLETE

12. PUBLIC RELEASE. Any Information (Classified Or Unclassified) Pertaining To This Contract Shall Not Be Released For Public Dissemination Except As Provided By The Industrial Security Manual Or Unless It Has Been Approved For Public Release By Appropriate U.S. Government Authority. Proposed Public Releases Shall Be Submitted For Approval Prior To Release

FORMCHECKBOX

Direct

FORMCHECKBOX

Through (Specify):

DISA HQ – Public Affairs Office P.O. Box 4502

Arlington, VA 22204-4502

Public Release of unclassified or classified information is not authorized.

to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs) * for review.

* In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

Public Release of unclassified or classified information is not authorized.

Additional security requirements may be contained within the DD Form 254 upon award of contract.

Reference Item 11e - Equipment Maintenance Services: Contract is for equipment maintenance services on equipment which processes classified information. Actual knowledge, generation or production of classified information is not required for performance of this contract.

Cleared personnel are required to perform this service because escorting personnel cannot preclude access to classified information. Any classification guidance needed will be provided by the using activity.

Reference Item 13 - SEE ATTACHED for additional security guidance.

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use item 13 if additional space is needed.)

FORMCHECKBOX

YES

FORMCHECKBOX

NO

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use item 13 if additional space is needed.)

FORMCHECKBOX

YES

FORMCHECKBOX

NO

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

2300 E Drive

Scott AFB, Ill 62225

b. SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

DD Form 254 (BACK), DEC 1999

Item 8 –

CHAMBERSBURG:

DISA PE Chambersburg

1 Overcash Ave., Bldg. 3 South

Letterkenny Army Depot

Chambersburg, PA 17201-4186

COLUMBUS:

DISA ISC Columbus

3990 East Broad St., Bldg. 23

Columbus, OH 43213

DAYTON:

DISA PE Dayton

2721 Sacramento St., Bldg. 271

Suite 1, Wright-Patterson AFB

Dayton, OH 45433-5061

DENVER:

DISA Computing Services Operations-Denver

5775 DTC Blvd., Suite 350

Greenwood Village, CO 80111-3209

FORT MEADE:

DISA Advance Party Bldg 4215 Roberts Avenue Fort Meade, MD 20755

HUNTSVILLE:

DISA PE Huntsville

Bldg. 5201, Martin Road

Redstone Arsenal, AL 35898-7340

JACKSONVILLE:

DISA CFE82

Bldg. 919, Langley St.

Jacksonville Naval Air Station

Jacksonville, FL 32212-0070

PENSACOLA:

DISA Chief Financial Executive (CFE82)

45 Industrial Blvd, Suite C

Pensacola, FL 32503

MECHANICSBURG:

DISA SMC Mechanicsburg

Bldg. 308 North End, 5450 Carlisle Pike

Mechanicsburg, PA 17050-0975

MONTGOMERY:

DISA SMC Montgomery

401 East Moore Drive, Bldg. 857

Maxwell AFB/Gunter Annex

Montgomery, AL 36114-3001

OGDEN:

DISA SMC Ogden

7879 Wardleigh Road, Bldg. 891

Hill AFB, UT 84056-5996

OKLAHOMA CITY:

DISA SMC Oklahoma City

Gate 33, SE59 and Air Depot Rd

8705 Industrial Blvd., Bldg. 3900

Tinker AFB, Oklahoma City, OK 73145-3064

SAN ANTONIO:

DISA ISC San Antonio

3326 General Hudnell Dr

San Antonio, TX 78226-2023

ST LOUIS:

DISA ISC St. Louis

Bldg. 103, 2nd Floor, Post D-2

4300 Goodfellow Blvd.

St. Louis, MO 63120-0012

WARNER ROBINS:

DISA PE Warner Robins

205 Perry St., Bldg. 228

Robins AFB, GA 31098-1607

PATCH BARRACKS, VAIHINGEN, GERMANY:

DECC Europe

Room 157, Bldg 2340, Patch Barracks

Stuttgart, GE 70569

DECC PACIFIC:

DISA DECC Pacific

1942 Gaffney St., Suite 200

Bldg 475, 3rd Floor

Pearl Harbor, HI 96860

BAHRAIN:

DISA CENT Field Office NSA Bahrain

PSC 451 Box 200

FPO, AE 09834

Item 13 –

13.0 Security. Comply with all applicable security directives, including the DoD Directive 8500.1, "Information Assurance (IA)"; DoD Instruction 8500.2, "Information Assurance (IA) Implementation"; the Assistant Secretary of Defense Memorandum, Subject: Disposition of Unclassified DoD Computer Hard Drives, dated June 4, 2001; DISA Security Technical Implementation Guides (STIGs).

13.1 Information Assurance. DoD and DISA is intensely aware of our adversaries' desires to exploit our networks and systems, and therefore takes system and network security very seriously. Our ability to monitor and protect systems is primarily focused on using the network capabilities to do so and consequently the majority of our efforts are network-based. With the exception of host-based security systems, virtually all other computing assets associated with security and network defense are considered to be processor assets are therefore expected to be covered under this contract.

13.2 Department of Defense (DoD) Directive 8500.1, Information Assurance, and DoD Instruction 8500.2, "Information Assurance (IA) Implementation requires that "all IA and IA-enabled IT products incorporated into DoD information systems shall be configured in accordance with DoD-approved security configuration guidelines." DISA Instruction 630 230 31 assigns the DISA Deputy Director for Operations with the responsibility to develop and maintain Security Technical Implementation Guides (STIGs). These STIGs (or Addendum, as appropriate) serve as the security configuration guidelines required by DoDD 8500.1. DoDD 8500.1 has been supplemented with additional information concerning specific operating system environments including the Microsoft Windows NT, Windows 2000, Windows 2003, and Windows XP operating systems.

Additionally, all equipment that provides an information assurance function, such as SSL termination meet specific guidelines such as Federal Information Protection Standards (FIPS) 140-2, or National Institute of Standards and Technology (NIST) Common Criteria EAL-4 evaluation. The service provider and Government will work together to ensure that all equipment provided meets all required federal, DoD, and/or DISA standards as appropriate.

13.3 DISA utilizes classified and controlled unclassified information to accomplish mission objectives. Vendor personnel exposed to this level of information must protect the data through the use of the security features inherent to software loaded, strong authentication and physical constraints as outlined below. Any deviation from standard practices may compromise data resulting in harm to the government. When hardware is no longer required, the Government will ensure the media (tapes, hard drives, mass storage devices, etc.) is sanitized in accordance with appropriate regulations, media will be maintained by the government.

13.4 DISA operating facilities' security is multifaceted and implemented utilizing the layered approach. The traditional security requirements such as perimeters being patrolled, stationary guards assigned, approved access devices such as locks, card readers, badges, access logs and detection devices are physical controls implemented to deter unauthorized access. Information controls render a different challenge by protecting automated sensitive data and associated resources from unauthorized access. Accounts are established after registered personnel meet access and/or clearance levels necessary for position. Through awareness training, directives and local policy contracted personnel are expected to comply with local security requirements upholding physical and information system security disciplines. When hardware is no longer required, the Government will ensure the media (tapes, hard drives, mass storage devices, etc.) is sanitized or destroyed in accordance with appropriate regulations. If the media cannot be sanitized and rendered to the unclassified level, the media may or may not be returned to the Vendor in an unusable state. This process is to ensure the protection of controlled both sensitive but unclassified and classified information. (SBU)

13.5 All systems; components and/or writeable media being removed from the site (tapes, hard drives, mass storage devices, etc.) will be sanitized or may be retained by the government for destruction in accordance with DoD, DISA and CSD Security guidance. The contractor must be aware that the sanitation process is to prevent any compromise of classified and/or controlled unclassified data and may render the system components and/or writeable media unserviceable and/or completely destroyed. The Government will make the determination as to whether drives can be sanitized or destroyed.

13.6 Personnel under this contract may have maintenance responsibilities for and access to systems with a relatively high risk for causing damage to Government facilities, systems and/or data if compromised. All personnel performing on this contract must a have a minimum of a Secret clearance and an IT position sensitivity of IT-I. The minimum investigation required is a Single Scope Background Investigation (SSBI).

13.6.1 In accordance with DISA Memorandum, Subject: Requesting Investigations for Secret Eligibility and Information Technology I Access, 26 January 2009: Requests for investigative services for contract employees requiring Information Technology 1 (IT-1) access and a Secret security clearance will be managed by the DISA Security Office. This change is necessitated due to the Defense Industrial Security Clearance Office (DISCO) under the direction of the Defense Security Service (DSS) is no longer accepting the Single Scope Background Investigation (SSBI) for contract positions requiring the IT-1/Secret eligibility. The DISA Security Office will review, submit and where possible, grant interim eligibility on the nominated contract employee.

13.6.2 Program managers of these contractual efforts will be required to substantiate the requirement for the investigation. Each program will fund the cost of the contract investigation, so due diligence is required to ensure only the proper amounts of investigations are submitted to meet mission needs. Contracting Officer Representatives (COR), Task Monitors (TM), or Security Managers will submit requests for investigative service to DISA Security (MPS6) utilizing the attached format. MPS will work directly with organization Resource Managers to arrange reimbursement when the invoice for Personnel Security Investigations is received each month.

13.6.3 Upon receipt of the request for investigative service, the DISA Security Office will take on a servicing relationship of the contract employee within the Joint Personnel Adjudication System (JPAS) and initiate the investigative request. The DISA Security Office (MPS6) will review the submission and, when favorable, grant both the interim IT access and interim security clearance eligibility. The results of this will be recorded in JPAS and subsequently in CMIS. COR/TMs and Security Managers will follow all other established procedures for submitting the Visitor Access Requests (VARs) once access has been granted.

13.6.4 The Vendor shall ensure that personnel accessing information systems have the proper and current information assurance certifications to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program (see para 6.6.1)

13.7 ADPE Maintenance Records/DISA CSD Form 7: Records shall be completed in cooperation with site helpdesk personnel, for all maintenance actions including predictive, remedial, preventive maintenance, ECP, install, deinstall, or upgrade action. Records shall be completed using the attached DISA CSD Form 7 (see Appendix A), or electronic equivalent. The completed report shall be returned to the helpdesk or for remote locations to the shift supervisor, prior to the technician departing the site. If the Vendor fails to submit documentation at the time required, it may result in the Government withholding payment. It may be supplied upon contract award. The “Instructions to Complete the ADPE Maintenance Record” lists the information to be entered into the fields by the OST/help desk personnel. Vendor CE personnel should review all fields on the DISA CSD Form 7 for accuracy before they sign the DISA CSD Form 7. Vendor CE personnel will receive a copy of the signed DISA CSD Form 7 before departing the site or upon conclusion of the service call where the machine is repaired and operating within OEM specifications.

13.8 Additional Security Requirements. All personnel under this contract who are required to go to DISA Computing Sites to perform hardware maintenance are required to have a SECRET IT-Level I security clearance. In this regard, they shall be required to comply with applicable portions of the above referenced Security Program Directives. The DD254 will be attached with the RFP. Vendor s shall have a fully adjudicated facility clearance prior to contract award.

13. 8.1 Visit Authorization Letters. The TPOC will coordinate or be copied on all Visit Authorization Requests.

13.8.1.1 Visit Authorization Letters. The Contractor FSO will forward requests for facility visits directly to the DISA Visit Access Request (VAR) Center via the Joint Personnel Adjudication System (JPAS) using SMO Code: DKABAA10.

13.8.1.1.1 The Contractor will also forward a Visit Authorization Letter (VAL) to the Contracting Officer’s Representative/Task Monitor identified in paragraph 1.0 of this PWS for all employees prior to the beginning of each contracting/task order period of performance and as new contractor employees are assigned to the contract.

13.8.1.1.2 The VAL should be sent via one of two methods. The preferred method is to e-mail the VAL. Because it contains sensitive information covered by the Privacy Act, the VAL should be sent using in a locked “Zip” file in one e-mail and then followed-up by another e-mail with the password to unlock the Zipped file. The alternative method to transmit the VAL is via facsimile (Fax) to the number listed. Prior coordination with the COR should be made via phone to ensure the method of transmission is agreed upon and properly secure.

13.8.1.1.3 The VAL shall be on company letterhead or pre-fabricated form and contain the following information:

Contract number with start and end dates

Company point of contact (POC) and telephone number

Government Task Monitor name and telephone number

Complete legal name of employee(s)

Social Security Number

Security Clearance level, date granted, and

Adjudication facility name, i.e. DISCO

Type of personnel security investigation (PSI) pending or completed

Date PSI completed

13.8.2 DISA Security Personnel can be contacted for security related questions as follows:

13.8.2.1 For Industrial Security related issues:

Primary: Regina Lee

DISA Industrial Security Program Manager voice: (703) 681-2570 e-mail: regina.lee@disa.mil

Secondary: Terry Scott

DISA Industrial Security Program Manager voice: (301) 225-1229 e-mail: terry.scott@disa.mil

Defense Information Systems Agency

ATTN: MPS6, Industrial Security

Command Building (MPS6)

6910 Cooper Ave.

Ft. Meade, MD 20755-7088

13.8.2.2 Primary: Anni Otis, phone: (703) 607-7926 or 301-225-1235 Alternate: Colleen Torres, phone: 301-225-1219

Regular Mail:

DISA

Attn: MPS62 Anni Otis

P.O. Box 549

Ft. Meade, MD 20755-0549

FEDEX or UPS:

DISA

Attn: MPS62 Anni Otis

6910 Cooper Avenue

Ft. Meade, MD 20755-0549

13.8.3 Contractor personnel must comply with local security requirements for entry and exit control for personnel and property at the government facility.

13.8.4 Contractor employees will be required to comply with all Government security regulations and requirements. Initial and periodic security training and briefings will be provided by Government security personnel. Failure to comply with security requirements can be cause for termination of employment.

13.8.5 The Contractor shall not divulge any information about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

13.8.6 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government. The reason for removal will be fully documented in writing by the Contracting Officer (CO). When and if such removal occurs, the contractor shall, within 15 working days, assign qualified personnel to the vacancy(ies) thus created.

13.9 Foreign Nationals will not be authorized access to CONUS or OCONUS DISA Computing Service sites.