DD254_Continuation_Sheet_20161027.pdf

DD Form 254 continued Contract Number:

Contractor:

Item 11j Have Operations Security (OPSEC) requirements All contractors supporting this effort will receive initial and annual refresher OPSEC training and will be periodically reminded of their responsibility to protect sensitive information. The contractor will develop a Critical Information List (CIL) which will identify the sensitive/unclassified information associated with the contract effort which, if disclosed, may tip an adversary as to our intentions and/or capabilities. Additionally, Critical Program Information (CPI) must be identified and protected IAW DoD Instruction 5200.39, “Critical Program Information Protection Within the Department of Defense”, dated July 16, 2008. CPI is defined as “highly sensitive information pertaining to a program which if compromised could cause significant degradation in mission effectiveness; shorten the expected life span of the program;

significantly alter program direction; or enable an adversary to defeat, counter, copy, or reverse engineer the technology or capability.”

AT1. AT Level 1 Training: IAW DoDI 2000.16, “DoD Antiterrorism (AT) Standards“, 2 October 2006, para E3.18.4, all contractor employees (to include subcontractor employees) supporting this contract that require access to a military installation, facility, controlled access area or test area shall complete AT Level 1 awareness training within 30 calendar days after the contract start date and annually thereafter. The contractor shall submit certificates of completion for each affected employee/subcontractor employee to DTRA/J0XS7. AT Level 1 awareness training is available at the following web site: https://atlevel1.dtic.mil/at/

IS5. Internet Advertisement: Unless this contract supports a Special Access Program (SAP), the contractor is authorized to publicly acknowledge they are working on a DTRA contract on their company-owned Internet web site; however, the company will not release information not previously published within publicly accessible U.S. government web sites or databases (e.g.

Small Business Innovative Research database; DoD contract announcements) or declared as Public Release by DTRA.

IS6. DTRA Network Access/Use: DTRA Network Access/Use: Any contractor requiring access to the DTRA Unclassified Network (DTRA UNET) or a DTRA Information System (IS) must possess a DOD Interim Secret clearance at a minimum with DTRA Policy. Failure to obtain or maintain a favorably adjudicated National Agency Check with Law and Credit Check (NACLC) will be grounds for removal from this contract effort. IAW DoDD 8570.01, 23 April 2007, “Information Assurance Training, Certification, and Workforce Management”, a contractor that requires access to a DTRA-owned/managed computer shall complete the “Cyber Awareness Challenge” Training via the Defense Security Service web site prior to receiving a DTRA network user account (and annually thereafter). The use of Universal Serial Bus (USB) devices is prohibited on DTRA AIS. DTRA email accounts cannot be auto-forwarded to commercial or personal email accounts IAW CJCSI 6510.01F, 9 February 2011, “Information Assurance (IA) and Support to Computer Network Defense (CND)”.

OS1. OPSEC Training: All contractors (including subcontractors) supporting this work effort shall supplement their current security practices by requiring any personnel involved in executing this contract to complete DTRA J0XS7-sponsored and administered Operations Security (OPSEC) training within 30 calendar days of contract execution (and annually thereafter). Upon contract award, all identified contractors (including subcontractors) will notify the COR of their acknowledgement that they will meet the requirements of the DTRA J0XS7 generated OPSEC Plan.

OS2. Social Media: All contractors (including subcontractors) supporting this work effort shall not post onto the Internet their affiliation with this contract effort, to include test schedules/locations, associated technologies and peers involved in the contract effort.

OS3. OPSEC Plan: This contract requires the establishment and maintenance of an OPSEC Plan. At a minimum, this plan shall identify: initial OPSEC training, education provided, annual refresher training and review. The OPSEC Plan must be approved by DTRA J0XS7.

PE1. Clearance Requirement: All contractors (including subcontractors) supporting this work effort shall be U.S. citizens and been granted an appropriate security clearance level for the DoD information they will receive from the government. SECRET clearances are based on a favorably adjudicated National Agency Check (NAC) with a Law and Credit Check (NACLC); a TOP SECRET clearance is based on a favorably adjudicated Single Scope Background Investigations (SSBI) via the Defense Security Service, Defense Industrial Clearance Officer, 600 10th Street, Fort Meade, MD, 20755. All contractors classified as a “Privileged User” that support this contract (e.g. Information Assurance Manager/Officer, Information Technology personnel, PKI certificate manager) must have completed their SSBI with favorable results prior to supporting this contract.

PE2. JPAS Action: Any contractor supporting this work effort that requires CAF notification of derogatory activity must be immediately reported to DTRA J0XS7. The contractor’s access contractor’s access to DTRA information (electronic or printed) shall be immediately suspended until a favorable security clearance determination has been received.

PE3. Clearance Revocation/Expiration: DTRA J0XS7 shall be immediately notified of any contractor supporting this work effort whose security clearance is downgraded, suspended, surrendered, expired or revoked. The contractor’s access to DTRA information (electronic or printed) shall be immediately suspended pending DTRA J0XS7 guidance.

PE4. Employment Termination: The contractor shall provide DTRA J0XS7 with advance notice of contractor(s) supporting this work effort that will be self-terminating their employment, retiring, absent from duty or employment for more than 60 consecutive days or are being removed from their position. The company will ensure the departing employee does not have continued access to any information or technology associated with this contract. If the employee was issued a DTRA proximity reader badge or a DTRA computer network account that employee must be formally out-processed via DTRA J0XS7.

PE6. In-House Contractor: All contractors that will perform contract work within a DTRA workspace shall be in-processed by DTRA J0XS7. These contractors are required to formally out-process from DTRA J0XS7, return their DTRA-issued badge(s), and coordinate the return of DTRA-issued equipment with the COR.

PE7. Security Reporting: The contractor is required to immediately notify DTRA J0XS7 for the following security-related incidents: a contractor is administratively removed from the contract effort or has their employment terminated; a contractor is elicited for information regarding this contract from anyone not working on the contract; when a contractor mishandles, fails to secure, uses information provided via this contract for personal gain or provides contract-provided information to a foreign nation; when classified information provided via this contract is discovered on unauthorized AIS; a contractor has their security clearance revoked by their employer or by a security clearance adjudicator; a contractor requests their security clearance to be downgraded/revoked or requests their access to classified information to be removed; the discovery of any nonconformance with the OPSEC Plan; suspected or verified loss of CPI or Critical Information.

PH1. Installation Access: Contractor(s) that require access to a military installation in support of this work effort must comply with installation policies, directives, Random AT Measures (RAM), and Force Protection Condition (FPCON) levels. The contractor can be denied access IAW DoDI 5200.08, 10 December 2005, “Security of DoD Installations and Resources”, DTM 09-12, Interim Policy Guidance for DoD Physical Access control, and DTM 13-005, 25 April 2013, “Deviations from the DoD Physical Security Program”. The contractor shall comply with installation requests for information required for background checks to meet installation access requirements. The contractor must comply with all personal identity verification requirements as directed by the DoD and/or local policy. The contractor will comply with Force Protection Condition (FPCON) changes that can occur on the overall installation or a specific installation facility.

PH2: DTRA Facility Access: Contractor(s) that require access to any DTRA facility in support of this work effort shall submit a Visit Authorization Letter (VAL) to DTRA J0XS7. The VAL shall use the format defined in the NISPOM, para 6-104. The VAL may be faxed to (505) 846- 8983 or sent via the Joint Personnel Adjudication System (JPAS) to GQDD614. The visit duration will not exceed the period of contract performance. All classified visit requests shall be forwarded to the Program Manager for approval. The use of personally owned devices (PED) is prohibited in all DTRA facilities; contractor owned PEDs require pre-approval from DTRA J0XS7 to be introduced into a DTRA workspace. Unauthorized introduction of PED/contractor owned PEDs constitutes a security incident that will require a formal security incident inquiry/report for corrective action to be conducted. A DTRA proximity reader badge will be issued only to a contractor that must be in a DTRA workspace a minimum of three days per week or requires access to a DTRA-owned/managed computer network. A contractor will not be issued a DTRA proximity badge without receiving an in-processing security briefing.

PH3. DTRA Facility Proximity Badges All personnel at DTRA (military, civilian, contractor or other government agency personnel) that require a permanent DTRA badge or access to the DTRA LAN must receive a DTRA J0XS7 in-processing security brief before issuance of a DTRA badge or access to the DTRA LAN.

Contractors or other government agency employees working at or supporting DTRA must be in DTRA spaces a minimum of three days per week for a DTRA permanent badge to be issued to them. Some contractors or other government agency employees working at or supporting DTRA may be required to have a DTRA LAN account. Contractors or other government agency employees working at or supporting DTRA that will be issued a DTRA permanent badge or a DTRA LAN account must be in-processed by DTRA J0XS7.

OC4. Electronic Device Policy in DTRA Facilities: In accordance with DTRA instructions and policies, the use of personally owned electronic devices is prohibited in all DTRA facilities.

Unauthorized introduction of such devices into the DTRA facility constitutes a security incident, which will be followed with a formal security incident inquiry/report for corrective action.

Unless issued/approved by DTRA, all electronic devices which require access into the DTRA facility must be coordinated and approved through the Security and Counterintelligence, Technical Security Branch.

OC5. Training: All in-house contractors must attend and complete the DTRA J0XS7 hosted “Initial Newcomers Security Training” and “Annual Security Awareness Training”.

OC6. Notifications: The contractor is required to notify the COR of the following incidents; the COR will immediately notify DTRA J0XS7:

a. When a contractor employee working on this contract mishandles, fails to secure, or uses contract-provided information for personal use or personal gain.

b. When a contractor employee working on this contract expresses a desire of their security clearance to be downgraded, revoked or no longer wants access to classified information.

COR:

LT Mohammed R Akbar Phone: 505-846-8964

Contracting Officer:

HERBERT THOMPSON

Phone: 505-846-8799

Chief Security and Counterintelligence Det Albuquerque:

PERRY M. KISSAM

Phone: 505-846-6107