DD254_Security_Guidance.pdf

Item #13 DD254 Security Guidance

Item 11j. Operations Security (OPSEC) Requirements

OPSEC promotes mission effectiveness by preserving essential secrecy about US intentions, capabilities, and current activities. Refer to DoD 5220.22-R (Industrial Security Regulation), DoD 5220.22-M Sup1 (National Industrial Security Program Operating Manual Supplement), and 5205.02 (DoD Operations Security Program).

Public release of any U.S. Government information is not authorized unless specifically approved in writing by the government. Examples of government information are: unclassified;

controlled unclassified, Confidential, Secret, Top Secret, Sensitive Compartmented Information and other special access information.

Contractors and their personnel supporting WHS (including all subordinate activities), must have OPSEC awareness and education/training initially and annually as required by the Government.

FACILITY SECURITY CLEARANCE

The Contractor MUST have an ACTIVE Facility Security Clearance (FCL) at the level of the contract. The FCL will be verified by the Government prior to contract award.

Should the Prime Contractor enter into sub-contracting agreements in the performance of this award, it is the Prime Contractor’s responsibility to ensure that any sub-contractor(s) possesses a FCL at the appropriate level, and that evidence of the FCL is provided to the COR prior to the Sub-Contractor’s commencement of work. Further, it is the Prime Contractor’s responsibility to provide security guidance to the Sub-Contractor IAW the original DD 254 (Classified Contract Security Specifications). The Government will provide the Prime Contractor with applicable security guidance.

PERSONNEL SECURITY

Contractor personnel must have a within-scope background investigation that has been adjudicated for eligibility to access classified information at the appropriate level in performance of the contract.

Prior to commencement of work, the Contractor shall provide the Government Security Office with a Visit Authorization Request (VAR) via JPAS that verifies all proposed employee’s eligibility for access to classified information at the level of the contract. VARs submitted on all assigned contract employees shall be re-verified on an annual basis thereafter.

Contractors working on-site at the Pentagon or the Mark Center Complex must submit a VAR to the Government Security Office via JPAS to SMO code DDAADZ6 (Facilities Services Directorate). A written VAR on letter head is not accepted at these locations and must be submitted through JPAS.

CONTRACTOR ACCESS TO DOD INFORMATION SYSTEMS

Personnel accessing DoD Information Systems must have the appropriate level investigation favorably completed prior to accessing the network.

-DoD information shall be processed only on DoD approved information systems.

-Classified information shall be processed only on information systems approved for classified processing at the appropriate level.

-DoD information shall not be processed on non-DoD approved information systems (home/personal/non-accredited contractor computers).

-Contractor shall not modify DoD information systems or introduce hardware or software unless approved by the Government.

COMPLIANCE WITH PENTAGON REGULATIONS

Each employee assigned to this project by the Contractor and or subcontractor shall be required to display the appropriate credentials provided by the Government at all times while on the project site. All credentials are Government property and must be returned to the Contracting Officer upon expiration, release of the assigned employee and/or completion of project.

Government credentials must not be displayed in public or left unattended. Lost or stolen credentials must be reported to the Government Security Office immediately.

All requests for DOD Building Passes shall be submitted by the Prime Contractor and validated through the Contracting Officer’s Representative to the Government Security Office.

The contractor employee will be required to present at least one Government issued (State or Federal) Photo ID, and a Social Security Card when they arrive at the CAC/Building Pass issuance facility.

Transmission of FOUO information on the project shall be protected through use of DoD Public Key Infrastructure (PKI) encryption. The Government shall provide Common Access Cards to contractor personnel for this purpose to use on government systems.

Contractor shall coordinate with the customer for procedures on the proper handling of classified information to include; storage and destruction, safeguarding, transmission and transportation, delivery, and reporting security incidents involving classified information.

WIRELESS SECURITY POLICY

Within Pentagon Reservation, the contractor shall not install or operate wireless access points (hotspots, routers) or any other Radio Frequency (RF) installation without prior approval from the Government. The contractor must abide by the Pentagon Wireless Security Policy which shall be provided upon request.

Use of Personal Electronic Devices is strictly prohibited in any secure facility.