HDTRA1-18-R-0025_Attachment_2__Draft_DD254.pdf

Top Secret Top Secret

20180531

HDTRA1-18-R-0025

DTRA Technical Reachback Support

NC2-ESI

Item 13a: The contractor shall comply with the Security Agreement (DD Form 441) including the NISPOM and any revisions to that manual, notice of which has been furnished to the contractor.

Item 13b: The contractor's employees performing work under this contract shall be U.S. citizens and been granted appropriate security clearance, based on the need for access to specific classified information. That is

SECRET clearance based on favorably adjudicated National Agency Check with Law and Credit Check (NACLC) or a TOP SECRET clearance based on a Single Scope Background Investigation (SSBI) favorably adjudicated by the Defense Security Service, DoD Central Adjudicative Facility, Fort Meade, Maryland 20755.

All contractors in privileged user positions must have a completed SSBI in accordance with by DoDI 8500.01, "Cybersecurity “Information Assurance (IA) Implementation”, 14 March 2014, prior to filling the position. Privileged users are defined as, but not limited to, persons in the following roles or positions: Information Assurance Manager/Officer, supervisors of Information Technology positions, System Administrator, maintainers of IA-enabled products such as routers, switches, firewalls, personnel performing system monitoring and testing, and personnel who issue classified Public Key Infrastructure certificates.

Item 13c: Should the contractor visit or perform work in support of this contract at any DTRA facility, the contractor shall submit proof of clearance through JPAS to SMO Code GQDD614 or fax a Visit Authorization

Request (VAR) to The DTRA Security and Counterintelligence Office (ATTN: Visitor Services). VARs shall contain the information specified in paragraph 6-104 of the NISPOM. VARs may be faxed to (703)

767-7857. The term of the VAR shall be for the period of contract performance. All classified visit request by contractors should be forwarded to the Program Manager for approval and need-to-know.

(See continuation page for additional Security Guidance instructions.)

See block 13; Item 10j.

See block 13; Item 10e.

Defense Threat Reduction Agency

HDTRA1

8725 John J Kingman Rd Fort Belvoir, VA 22060

Andrew Grose (703) 767-4260 andrew.m.grose.civ@mail.mil

Gray, Pamela Security Specialist

HDTRA1

8725 John J Kingman Rd.

Fort Belvoir, VA 22060

703-767-7853 pamela.d.gray8.civ@mail.mil mailto:andrew.m.grose.civ@mail.mil mailto:pamela.d.gray8.civ@mail.mil

BLOCK 13 (CONTINUED)

HDTRA1-18-R-0025

Item 10a: Contractor is authorized to receive Government furnished cryptographic equipment. Access to classified

COMSEC information requires a final U.S. Government clearance at the appropriate level. Further disclosure of

COMSEC information by a contractor, to include subcontracting, requires prior approval of the contracting activity.

Item 10b: Restricted Data (RD). This contract requires access to RD and FRD material and information. This information is classified and is controlled under the Atomic Energy Act of 1954. Overall security oversight for RD and

FRD is under the cognizance and control of the Department of Energy. Contractor personnel given access to RD and

FRD shall be knowledgeable of requirements in 10CFR1045, "Nuclear Classification and Declassification," and DoD

Directive 5210.2, "Access to and Dissemination of Restricted Data," and shall be trained in accordance with

10CFR1045.35(a).

Item 10c: Contractor requires access to Critical Nuclear Weapons Design Information (CNWDI). Permission of the contracting activity is required prior to subcontracting. CNWDI special briefings and procedures are required. A government representative initially briefs the contractor security facility officer for CNWDI, who in turn is responsible to brief other contractor employees who require access. A final U.S government security clearance is required for this access as defined in DoD Directive 5210.2.

Item 10d: Formerly Restricted Data (FRD). This contract requires access to RD and FRD material and information. This information is classified and is controlled under the Atomic Energy Act of 1954. Overall security oversight for RD and

FRD is under the cognizance and control of the Department of Energy. Contractor personnel given access to RD and

FRD shall be knowledgeable of requirements in 10CFR1045, "Nuclear Classification and Declassification," and DoD

Directive 5210.2, "Access to and Dissemination of Restricted Data," and shall be trained in accordance with

10CFR1045.35(a).

Item 10e(1): In accordance with DoDM 5105.21, Volumes 1-3, Sensitive Compartmented Information (SCI)

Administrative Security Manual, dated 19 October 2012, and the Continued Responsibility Form that all contractors sign when they are SCI indoctrinated, all contractors performing work on a DTRA contract that requires SCI access must comply with the following:

1. All contractor employees requiring SCI must be U.S. citizens and be eligible for a TOP SECRET clearance and have met the Intelligence Community Directive (ICD) 704, (Personnel Security Standards and Procedures Governing

Eligibility for Access to SCI and Other Controlled Access Program Information, 1 October 2008 and Intelligence

Community Policy Guidance-ICPG 704.1, 704.2, 704.3, 704.4, and 704.5), requirements prior to granting of SCI access.

Clearance is based on a Single Scope Background Investigation (SSBI) adjudicated by Defense Security Service (DSS) in

Columbus, Ohio. Individual must be indoctrinated for SCI prior to being given access to such information. It is the

Contractor/Facility Security Officer's responsibility to ensure that the SSBI is current and that a PPR/PR is submitted in a timely manner for all of their contractor employees performing SCI work.

2. All DTRA contractors will receive their initial SCI indoctrination/training once granted eligibility by the Defense

Intelligence Agency (DIA) or the Department of Defense (DoD CAF). All contractors are also obligated to annually complete the DTRA SCI refresher training.

3. All contractors with SCI access, prior to traveling outside the Continental United States (OCONUS), for unofficial and official reasons, must report that travel to the Special Security Office (SSO) using the DTRA Form 195 (DTRA Foreign travel Questionnaire, part 1, Pre-Travel). Within five working days of the completion of the trip reply to the post-travel email that you will receive from the SSO.

4. All contractors with SCI access will report contact with a foreign national, which meets the following criteria, to the

SSO within 72 hours, or immediately following an OCONUS trip:

A. That is of a close continuing associations (i.e., communicating regularly via telephone, e-mail, etc.), characterized by ties of kinship, casual contacts and associations arising from living in a community normally need not be reported.

B. In which illegal or unauthorized access is sought to classified, sensitive, or proprietary information or technology, either within or outside the scope of the employee's official activities, or curiosity or normal business inquiries.

Item 10e(1) and (2): a.) Classified material generated in support of this SCI contract is not releasable to foreign nationals without the written permission of Defense Intelligence Agency (DIA) and Director, DTRA through the Special Security

Office (SSO), Security & Counterintelligence Office.

b.) SCI documents received under this contract may not be released to subcontractors without the permission of DTRA, SSO, Security & Counterintelligence Office.

c.) The Prime Contractor is not authorized to issue subcontract in furtherance of the security requirements delineated in this specification without the written coordination and approval of the DTRA SSO. All DD Form 254's issued to subcontractors must be coordinated and approved by the DTRA SSO prior to the issuance of the DD Form 254 by the

Prime Contractor.

D.) Contractor generated or Government furnished material is not releasable to the Defense Technical Information Center

(DTIC). Technical reports will bear the statement "Not Releasable to DTIC".

E.) Contractor will access SCI information at an approved DTRA Sensitive Compartmented Information Facility (SCIF) only or the nearest servicing Special Security Office where the actual performance of the contract is being done. A Co-

User Agreement (CUA) between DTRA, SSO and the servicing SSO (site location) is required to provide the assistance and must be approved and in place.

F.) The contractor is required to adhere to the NISPOM and any revisions to the manual, ICD 700 (Protection of National

Intelligence, 21 September 2007), ICD 701 (Security Policy for Unauthorized Disclosures of Classified Information), ICD

705 (Sensitive Compartmented Information Facilities, 26 May 2010, Intelligence Community Standard-ICS 705-1, 17

September 2010, ICS 705-2, 17 September 2010, and DoDM 5105.21, Volumes 1-3, Sensitive Compartmented

Information (SCI) Administrative Security Manual, dated 19 October 2012 for the proper handling and protection of SCI material.

G.) Upon expiration of this contract, the contractor shall request disposition instructions for all classified and unclassified project material. The contractor may be directed to properly destroy the material or return it. If classified or unclassified project material is to be retained by the contractor, every effort will be taken to transfer it to a follow on contract or similar effort. Unless written authorization by the contracting office to retain specific material for a specific period of time is received, the material shall be returned or destroyed as instructed.

Item 10g: Contractor access to North Atlantic Treaty Organization (NATO) and Foreign Government Information requires a final U.S. Government clearance at the appropriate level.

Reference: DTRA Memorandum, North Atlantic Treaty Organization (NATO) Security Briefing for Secure Internet

Protocol Router Network (SIPRNET) Users.

All DTRA's contractors that require a SIPRNET account must be briefed on NATO.

Item 10h: Contractor access to Foreign Government Information requires a final U.S. Government clearance at the appropriate level. Individuals should be briefed on NATO at the appropriate locations.

Item 10i: This contract may require access to Alternate or Compensatory Control Measures (ACCMs) information as needed. Procedures for protection of ACCM materials are located in CJCSM 3213.02 series manual.

Item 10j: All "For Official Use Only" information shall be marked, safeguarded, transmitted, and disclosed in accordance with DoD Manual 5200.01, Volume 3, Protection of Classified Information.

Item 10k: This contract requires access to NC2-ESI. NC2-ESI material remains under U.S. Government control at all times. Access to NC2-ESI by contractor personnel will be limited to U.S. Government facilities.

b) In order to be considered for access to NC2-ESI. Applicant must be United States citizens. No waivers will be considered. In addition, applicant must have a Top Secret clearance based on a favorable Single Scope Background

Investigation (SSBI) completed within the past five years. No waivers will be considered.

c) Contractor will nominate personnel to USSTRATCOM/J050. Contractor will nominate only technically qualified personnel who meet citizenship and clearnce requirements stated above.

d) Nominations will contain full identifying data on the nominee, statement that he/she meets the above citizenship requirements, description of the applicant’s duties under the contract, which will require access to NC2-ESI, applicant’s current clearance and the basis for the clearance.

e) If the applicant meets the clearance and investigation criteria, nomination must be received by USSTRATCOM/J050 and must be received 60 days prior to anticipate date NC2-ESI access required.

f) NC2-ESI access will require briefing and debriefing to be accomplished by USSTRATCOM/J050. Contractor will cooperate with USSTRATCOM/J050 in making personnel available with sufficient lead-time to permit USSTRATCOM to arrange for required briefings and debriefings.

g) Contractor will advise USSTRATCOM/J050 of any adverse information or change in status of an employee who has been granted access to NC2-ESI, i.e., marriage, divorce or remarriage.

Item 11c: All classified information received or generated under this contract is the property of the U.S. Government. At the termination or expiration of this contract, the U.S. Government will be contacted for proper disposition instructions.

The PM/COTR will provide the appropriate Security Classification Guides to the contractor in support of this contract.

Any security classification guidance will be provided by the Program Manager under separate cover. This applies to the actual performance location only.

Item 11d: The contractor is required to fabricate, modify, and store classified hardware. The Government will provide one work area and computer with DTRA network access. Under no circumstances shall individuals working on this contract remove from DTRA any classified electronic media without approval and permission.

All contractors in privileged user positions must have a completed single scope background investigation (SSBI) in accordance with DOD I 8500.2, 6 February 2003, paragraph E3.4.8. and Table E3.T1, prior to filling the position.

Privileged users are defined as, but not limited to, persons in the following roles or positions: Information Assurance

Managers/Officers, supervisors of IT positions, system administrators, maintainers of IA-enabled products such as routers, switches, firewalls, personnel performing system monitoring and testing, and personnel who issue Classified PKI certificates.

Item 11e: The contractor is performing logistical support and services only. Classification markings on material furnished contractor will provide the classification guidance necessary for the performance of the contract.

Item 11f: Access to classified information OCONUS shall only take place at NATO, SHAPE, and approved US

Government facilities.

Item 11g: The contractor shall prepare and submit DD Form 1540 to the Contracting Officer for certification of "need-to-know", before access will be granted to the Defense Technical Information Center (DTIC).

Item 11h: COMSEC account is authorized. See Item 10a.

Item 11j: OPSEC requirements apply. All contractors supporting this effort will receive initial and annual refresher

OPSEC training and will be reminded of their continued responsibility to protect sensitive information.

At a minimum the contractor will adhere to the guidelines set forth in the Agency's OPSEC Policy Statement and Critical

Information List. Additionally, the contractor will develop a Critical Information List specific to their portion of the contract work which will identify any sensitive/unclassified information which if disclosed may tip an adversary as to our intentions and/or capabilities.

Additionally, Critical Program Information (CPI) must be identified and protected IAW DoD Instruction 5200.39, Critical

Program Information Protection Within the Department of Defense, July 16, 2008. CPI is the classified, highly sensitive information pertaining to a program which if compromised could cause significant degradation in mission effectiveness;

shorten the expected life span of the program; significantly alter program direction; or enable an adversary to defeat, counter, copy, or reverse engineer the technology or capability

Item 11k: Defense Courier Service Accounts: Checking "Yes" in block 11.K on page 1 will only authorize the contractor to utilize an existing DCS account. It does not authorize creation of a new DCS account. If the contractor requires their own DCS account, written justification must be provided and Part II of the DCS Form 10 must be signed by DTRA

Special Security Officer before the account can be created.

Item 13d: In contracts involving SCI/SAP information, the contractor is not authorized to issue subcontracts in furtherance of the security requirements delineated in this specification without the written authorization of the DTRA

SSO.

Item 13e: In accordance with DTRA Policy and DTRA Instruction 5240.06, DTRA Counterintelligence Awareness, Briefing, and Reporting Programs, dated Feb 6, 2004, section 4 under Policy, all contractors working under DTRA contracts are required to comply with the following:

4.1. All DTRA contractors will receive a CI Awareness Briefing upon in-processing at DTRA. All DTRA contractors will receive an annual update of the CI Awareness Briefing.

4.2 Prior to any official travel outside the Continental United States (OCONUS) or while attending domestic or overseas meetings, conferences or symposiums where meetings with foreign nationals are expected, all DTRA contractors and personnel contracted by DTRA traveling via agency sponsored or supported activities or another DoD component, will contact the BDC or the local SC Field Office to receive a AOR Specific Travel Briefing, no more than 90 days prior to any OCONUS travel in accordance with DoD Directive 2000.16 (reference (b).

In accordance with DODI 2000.16, Antiterrorism (AT) Standards, Standard 19; and DTRA Directive 2000.12, DTRA

Antiterrorism Program, Standard 19 requires all DTRA employees and on-site DOD contractors at all DTRA locations to be provided AT Level I Training. The Security and Counterintelligence Directorate will be responsible for ensuring completion of annual AT Level I Training.

All personnel at DTRA (civilian, military, contractor or other government agency personnel), in accordance with DTRA instructions and policies, the use of personally owned electronic devices are prohibited in the DTRA facility .

Unauthorized introduction of such devices into the DTRA facility constitutes a security incident; which will be followed with a security incident inquiry/report for corrective action. Unless issued/approved by DTRA, all electronic devices which require access into the DTRA facility must be coordinated and approved through the Security and

Counterintelligence, Technical Security Branch.

The use of the public world-wide web/internet services is not authorized to discuss, disseminate, produce or transmit "For

Official Use Only" information and classified information

All personnel at DTRA (military, civilian, contractor or other government agency personnel) that require a permanent

DTRA badge or access to the DTRA LAN must receive an in-processing security brief before issuance of a DTRA badge or access to the DTRA LAN. Contractors or other government agency employees working at or supporting DTRA must be in DTRA spaces a minimum of three days per week for a DTRA permanent badge to be issued to them. Some contractors or other government agency employees working at or supporting DTRA may be required to have a DTRA

LAN account. Contractors or other government agency employees working at or supporting DTRA that will be issued a

DTRA permanent badge or a DTRA LAN account must in-process and receive a security briefing.

All personnel that possess a DTRA permanent badge or have access to the DTRA LAN must receive an out-processing security debrief in the event they are terminating employment, retiring, no longer supporting DTRA, being reassigned to another government agency, or will be absent from duty or employment for more than 60 consecutive days. Failure to do so may adversely affect departing personnel’s security clearance and future employment.

This sentence relates to full time DTRA contractors, and personnel who are contracted by DTRA that are located in other regions, academia, etc.

All contractors that will be working in DTRA space and/or having access to the Local Area Network are required to in and out process through Personnel Security.

The signatures below indicate this contract has been coordinated with the DTRA Program Manager and the Special

Security Officer (SSO) for SCI Information. For further assistance on the contract please contact the DTRA Program

Manager listed below.

Program Manager:

___________________________________DATE:_________________Phone:________________

Printed Name

____________________________________ (Signature)

Special Security Office (SSO):

____________________________________DATE:_________________Phone:________________

Printed Name

____________________________________ (Signature)