ATTACHMENT_3_-_Security_Requirements.pdf

ATTACHMENT 3

Security Requirements

21 July 2015

OFFICIAL DOD INFORMATION. The contractor will have access to Official DoD Information.

• Defined as: All information that is in the custody and control of the Department of Defense, relates to information in the custody and control of the Department, or was acquired by DoD employees as part of their official duties or because of their official status within the Department.

FOR OFFICIAL USE ONLY (FOUO). The contractor may have access to FOUO information officially known as Controlled Unclassified Information (CUI).

- CUI provided under this contract shall be safeguarded as required by government policy.

- Contractor shall:

• Ensure Personally Identifiable Information (PII) (also a type of CUI) protected under the Privacy Act Program is safeguarded as required by government policy.

• FOUO markings applied to information shall not be removed or altered unless approved in writing by the originator of the information.

• Enforce “need to know.”

• Not release FOUO information to unauthorized persons to include the public/media.

• Destroy FOUO information by approved methods (e.g. burn bag).

PERSONALLY IDENTIFIABLE INFORMATION (PII)

Contractor shall protect PII as required by laws and regulations (e.g. Privacy Act of 1974; DoD 5400.11-R; DoDM 5200.1M Volume 4). A few of these safeguards are:

1. Immediately report known or suspected instances of a privacy breach to the security manager at:

ronald.house.civ@mail.mil and luis.r.vazquez4.civ@mail.mil.

2. If involved in a breach, immediately attempt to recover the PII to bring it back under DoD control

3. Pick up and safeguard PII found unprotected 4. Enforce “need to know”

5. Look for PII during “end of day checks” 6. Store PII in a locked desk drawer or file cabinet

7. Encrypt email containing PII 8. Validate the recipient of PII requires PII for an official purpose

9. Ensure all recipients on email require the PII before hitting “send”

10. Use a burn bag to destroy PII

11. Store and process PII only in approved customer locations

12. Apply appropriate markings to documents and email that contain PII

13. Do not store PII on laptops or other removable media 14. If teleworking, access PII only through connection to the WHS network and using only a WHS issued laptop mailto:ronald.house.civ@mail.mil

15. If teleworking, prevent family and friends from viewing PII

16. If you can prevent a PII breach, you must act

17. Password protect documents containing PII if you cannot encrypt an email

18. Do not email PII to personal email accounts/servers (i.e. yahoo or gmail)

19. Escort visitors 20. Retrieve or clear PII from fax machines, printers, copiers…..

21. Remove your CAC if you walk away from your computer

22. Do not discuss PII near unauthorized persons or in unauthorized locations

23. If emailing PII outside of .mil for an official purpose and you cannot encrypt the email, you must password protect the document

24. Do no list PII on the subject line of emails

25. Do not post PII to a shared network drive/folder unless the folder is limited to access by those persons with an official “need to know”

26. Do not share/use/post PII to social media sites or any publically accessible web site

27. Do not place PII in trash cans or recycle bins 28. Do not store PII in a motor vehicle

29. Ensure 100% accountability of paper documents containing PII

30. Do not store PII on CD/DVDs unless approved in writing by the COR/COTR

GOVERNMENT POLICY

- The fact specific wording may not be written in this PWS does not constitute a waiver to comply with government policy.

WIRELESS SECURITY POLICY

- The contractor shall not install or operate wireless access points (e.g. Hot spots, routers) or any other Radio Frequency (RF) installation without prior Reservation Installation Application (RAI) approval.

- Contractor shall not bring personnel electronic devices (e.g. cell phone) into any secure facilities.

WEB SITES

- Contractor shall not post DoD information to any DoD controlled restricted web site unless approved by the CO and government customer.

- Contractor shall not post DoD information to any publicly accessible web.

COMPLIANCE WITH GOVERNMENT CUSTOMER SECURITY PROGRAMS

- Contractor shall comply with government customer programs designed to safeguard information, facilities, equipment and personnel by complying with established education & awareness programs and operating procedures including but not limited to: Information Security, Physical Security, Personnel Security, Communications Security, Information System Security, Controlled Unclassified Information, Operations Security, Counterintelligence, Anti-Terrorism Force Protection and Emergency Planning.

ORIGINAL CLASSIFICATION AUTHORITY

- Prohibited.

DERIVATIVE CLASSIFICATION

DECLASSIFICATION & DOWNGRADING OF CLASSIFIED INFORMATION

UNAUTHORIZED PUBLIC DISCLOSURE OF CLASSIFIED INFORMATION

- Contractor shall not release any classified information to the public.

• Public disclosure includes but is not limited to: person to person, the internet, social web sites, newspapers, television, radio.

- Contractor shall report known or suspected instances of unauthorized public disclosure of classified information.

• Contractor shall report known or suspected unauthorized disclosures to the CO, government customer and the WHS/FSD Security Manager.

• Additionally the Contractor shall:

Not include classified information when reporting the incident via unclassified telephone or unclassified computer systems.

Not confirm or deny the existence of classified information to the media or public.

Not save, copy, paste classified information to DoD networks or to personal or company computer systems.

Not print classified information.

Not share classified information with unauthorized persons.

Follow instructions provided by the government.

Understand the classified information disclosed to the public remains classified and still requires safeguarding. Only an Original Classification Authority can declassify the information.

• Refer queries from the public, media, or press to the WHS Security Manager.

• Refer all Congressional queries to the WHS Security Manager.

VIOLATIONS/INCIDENTS

- The contractor shall also report to the CO and WHS/FSD Security Office (ronald.house.civ@mail.mil and luis.vazquez4@mail.mil), all suspected or known violations/incidents to safeguard DoD information, equipment, facilities, personnel.

DESTRUCTION OF DOD INFORMATION

- At government locations within the NCR, all DoD information shall be destroyed by using the Pentagon Incinerator.

DISPOSITION OF DOD INFORMATION

- Contractor shall return all DoD information used in performance of this contract when no longer needed or upon conclusion of this contract, whichever occurs first.

PROPERTY

- Contractor shall return all property to the government customer when no longer required for performance of this contract.

mailto:luis.vazquez4@mail.mil

CONTINUED RESPONSIBILITY

- Safeguarding DoD information is a lifelong obligation.

- Upon completion of this contract, Contractor shall continue to safeguard DoD information.

- Contractor shall report attempts by unauthorized persons to gain access to information. Send email notification to the WHS/FSD Security Manager and government customer.

PRE PUBLICATION REVIEW

- Safeguarding DoD information is a lifelong obligation.

- Any DoD information intended for publication or dissemination must undergo a security and policy pre-publication review. This includes, but is not limited to:

• Books

• Manuscripts and theses

• Biographies

• Articles

• Book reviews

• Audio/video materials

• Speeches

• Press releases

• Conference briefings

• Research papers

• Gaming materials

• Other media

- Prior to initiating a security review ensure the owner (Government Agency) of the information has conducted an internal security review and written guidance has been provided.

- Report unauthorized releases of DoD information to: ronald.house.civ@mail.mil and luis.r.vazquez4.civ@mail.mil.

Operations Security (OPSEC) Requirements:

OPSEC promotes mission effectiveness by preserving essential secrecy about US intentions, capabilities, and current activities. Refer to DoD 5220.22-R (Industrial Security Regulation), DoD 5220.22-M Sup 1 (National Industrial Security Program Operating Manual Supplement), and 5205.02 (DoD Operations Security Program).

OPSEC is directed towards protection of UNCLASSIFIED intelligence on classified or sensitive programs of such nature that the disclosure of the indicators may lead to the compromise of classified or sensitive information. Security essential to defense activities may be compromised whenever open sources (such as technical articles, press releases, national publications, congressional records, or contract awards) and detectable activities (communications, logistics, or research and development and test activities) provide information that hostile intelligence services (HOIS) can piece together resulting in actions harmful to US interest.

OPSEC is concerned with all sources of exploitable information. It covers the total problem by addressing vulnerabilities, countermeasures and weaknesses in a program which could lead to the disclosure of classified information. Unlike other security programs, OPSEC doesn’t readily lend itself to complete identification of security requirements (countermeasures) during initial contract preparation. Input from the contractor in the form of an OPSEC plan must be developed and mailto:luis.r.vazquez4.civ@mail.mil provided by the contractor. OPEC countermeasures and plans must be flexible to address changes in the threat environment.

The contractor shall comply with OPSEC requirements imposed by any program supported. OPSEC is a structured process that identifies critical information, analyzes friendly actions, integrates threat analysis and risk assessments and then helps personnel apply protective measures to mitigate unacceptable risks.

FOR OFFICIAL USE ONLY (FOUO). The contractor may have access to FOUO information officially known as Controlled Unclassified Information (CUI).