A23_Attachment_2_DD0254_RRMC-IT_IDIQ_Services_(DRAFT)_VER_1_(7-19-16).pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. AND SAFEGUARDING

a. CLEARANCE REQUIRED

b. LEVEL OF SAFEGUARDING REQUIRED

2. IS FOR: (X and complete as applicable)

a. CONTRACT NUMBER

b. SUBCONTRACT NUMBER

c. DUE DATE (YYYYMMDD)

3. IS: (X and complete as applicable)

a. (Complete date in all cases)

REVISION NO.

c. (Complete Item 5 in all cases)

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specs)

DATE (YYYYMMDD)

DATE (YYYYMMDD)

4. THIS A FOLLOW-ON CONTRACT? YES NO. Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. THIS A FINAL DD FORM 254? YES NO. Yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. (Include Commercial and Government Entity (CAGE) Code)

a. ADDRESS, AND ZIP CODE b. CAGE CODE c. SECURITY OFFICE (Name, Address, and Zip Code)

7.

a. ADDRESS, AND ZIP CODE b. CAGE CODE c. SECURITY OFFICE (Name, Address, and Zip Code)

8. PERFORMANCE

a. b. CAGE CODE c. SECURITY OFFICE (Name, Address, and Zip Code)

9. IDENTIFICATION OF THIS PROCUREMENT

10. CONTRACTOR WILL REQUIRE ACCESS TO: 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL:YES NO YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

d. FORMERLY RESTRICTED DATA

e. INTELLIGENCE INFORMATION

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI f.

g. NATO INFORMATION

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

j. FOR OFFICIAL USE ONLY INFORMATION

k. (Specify)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE TEMPEST REQUIREMENTS

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

l. (Specify)

CLEARANCE

FACILITY

THIS SPECIFICATION

PRIME

SOLICITATION OR OTHER NUMBER

THIS SPECIFICATION

ORIGINAL

FINAL

IS If

IS If

CONTRACTOR

NAME, COGNIZANT

SUBCONTRACTOR

NAME, COGNIZANT

ACTUAL

LOCATION COGNIZANT

GENERAL

SPECIAL ACCESS INFORMATION

OTHER

HAVE

OTHER

DD FORM 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE.

12. RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release a.

Direct Through (Specify)

d. ADDRESS (Include Zip Code)

Yes No to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. The security classifiection guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

14. Requirements, in addition to ISM requirements, are established for this contract.

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No15. Elements of this contract are outside the inspection responsibility of the cognizant security office.

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. questions shall be referred to the official named below.

b. TITLE c. (Include Area Code) e.

17. DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER f.

PUBLIC

TYPED NAME OF CERTIFYING OFFICIAL

SECURITY GUIDANCE.

ADDITIONAL SECURITY REQUIREMENTS.

INSPECTIONS.

All

TELEPHONE

SIGNATURE

REQUIRED

OTHERS AS NECESSARY

DD FORM 254 (BACK), DEC 1999

BLOCK 13. SECURITY GUIDANCE (Continued) Contract #

DD FORM 254 (CONTINUATION) Page of

FOR OFFICIAL USE ONLY

Blue Ridge Summit, PA 17214 and contractor location in 6a.

RAVEN ROCK MOUNTAIN COMPLEX (RRMC)

1155 DEFENSE PENTAGON

WASHINGTON DC 20301-1155

RRMC Strategic Communications Officer (717) 878-3736 Public release of Non -SCI Intelligence Information is not authorized.

security: 1) All contractor employees performing on this contract must be United States Citizens, those that will require access to classified information must hold a minimum of Industrial Personnel Security Clearance at the SECRET level.

2) The following Security Classification Guide applies. The Alternate Joint Communications Center (AJCC) SCG, 13 Aug 93. Additional classification guidance will be provided by the on-site Government representatives. Classified information will be handled IAW the National Industrial Security Program, DoD 5220.22-M (Change 1 March 28, 2013).

3) All contractors involved in this project will follow RRMC Security Requirements and entry control procedures. Government issued identification (Common Access Card (CAC) and RRMC Badges) are the property of the U.S. Government and shall not be retained by the cardholder upon completion of contract, termination of employment, or removal from contract performance. All identification will be turned into the RRMC Security Office when no longer required for performance on the contract or upon expiration. Unauthorized possession of Government issued identification can be prosecuted under Section 70 I, Title 18, USC.

4) The Contractor or Subcontractor shall not release unclassified information pertaining to any part of this contract or any program related to this contract, regardless of medium (e.g., disc, film, tape, and document) to anyone outside the Contractor's organization. Reproduction of official contract documentation pertaining to RRMC by contractors is prohibited. At conclusion of contract, all documents and drawings will be returned per the Contracting Officer's direction.

5) Information about this contract or details about this facility will only be released to authorized personnel with an official "need to know'' and will not be discussed with unauthorized persons, discarded as unclassified trash, posted on web pages or released to the public without approval from the RRMC Security Office.

6) Transmission of Controlled Unclassified information (CUI) on this project shall be protected through the use of DoD Public Key Infrastructure (PKI) encryption or equivalent facility systems. The Government shall provide Common Access Cards (CAC) to contractor personnel for this purpose on government systems. At no time shall CUI or classified information be transmitted electronically by means other than approved government or facility approved systems and methods. (SEE CONTINUATION PAGES 3 through 4) addit_sec: OPSEC requirements are contained in the contract or addendum. All contractors performing work on this contract must have completed DoD Antiterrorism Level 1 training within the previous 12 months. Training is online at: https://atlevel1.dtic.mil/at/ See block 13 continuation sheet for further guidance.

8. Ref Block 8a- There is "NO" requirement for the contractor to establish safeguarding capability of classified information at the company location.

9. Ref Block 8a- All access to classified information shall only be at the Government work locations.

10. Ref Block 10e(2) Non-SCI Information is not releasable to contractor personnel who have not received a clearance at the appropriate security level. Access to intelligence information required for performance. ICD 703, Control and Dissemination of Intelligence Information, provides policy on control, access and dissemination of intelligence information. This policy is available from the Government requiring activity. Written approval of the Contracting Officer is required prior to subcontracting any work effort that requires access to intelligence information.

Theodore S. Rogers (Nominated COR) 114th Signal Battalion RRMC 1155 Defense Pentagon Washington DC, 21301-1155 (717)-878-7009

11. Ref 10.k. - This work performance will require the Contractor access to SIPRNET and NIPRNET. All system access will be sponsored by the Contracting Officer’s Representative (COR).

12. Ref 10.j. FOR OFFICIAL USE ONLY (FOUO) INFORMATION:

FOUO information shall be marked and safeguarded as specified in DoDM 5200.01-V4, February 24, 2012. Public release of FOUO information by the contractor is not authorized. The contractor is not authorized to use information developed or resulting from this contract in any advertising without prior review and written approval from the RRMC Security Office.

All contract documents generated (drawings, specifications, calculations, and studies, etc.) or produced by the contractor at a minimum shall be marked "FOR OFFICIAL USE ONLY". The following distribution statement shall be placed on classified and unclassified technical documents: Distribution authorized to the DoD and U.S. DoD contractors only; (reason (e.g. Administrative or Operational Use)); (date). Other requests for this document shall be referred to (controlling DoD office (e.g. RRMC Engineering)).

13. Ref 10.k. - Accreditation of the SIPRNET backbone to transport NATO Secret and below information resulted in additional security measures across the board. Per DoDM 5200.01-V1, all DoD military, civilian and contractor personnel briefed on their responsibilities for protecting U.S. classified information, shall be briefed simultaneously on the requirements for protecting NATO classified information. The Security Manager shall provide a NATO “awareness briefing” to contractor personnel performing work at U.S. Government requiring activity work locations and shall maintain a written acknowledgment of the individual's receipt of the awareness briefing along with statement of understanding of responsibilities for safeguarding NATO classified information. There is not a defined requirement for NATO access information under this contract so Item 10.g. is checked "No." The NATO awareness briefing does not constitute “need to know or access approval” to NATO classified information and shall not be entered in Joint Personnel Adjudication System (JPAS). The Contractor shall provide copies of NATO awareness briefings to the COR, upon request

14. Ref 11.a. - Properly cleared contractor personnel who have an established need-to-know in accordance with this contract are authorized access to classified information which supports this work effort. Access to classified information which supports this work effort is restricted to (Raven Rock Mountain Complex). Government agency or activity will provide security classification guidance for performance of this contract. Submit visit request to the KO and/or Security Management Office for need-to-know verification. The Contractor shall not remove any classified materials or information from the Government work site(s), nor shall the Contractor reproduce, generate, or store any classified materials or information relating to this contract at other than specified Government work locations. This includes downloading, storing, or transmitting classified information on or to any unauthorized software, hardware, or information technology system. Classified material shall only be stored at Government requiring activity work locations in Government furnished GSA approved security containers, or as directed by the COR and/or Government Security Officials.

15. Ref 11.a. - Security in/out-processing. Contractor personnel working for the prime contractor and subcontractor(s), if applicable, must be listed on a current Visit Authorization Request (VAR) in Joint Personnel Adjudication System (JPAS) before they are allowed to begin working on their assigned contract. The Facility Security Officer (FSO) will submit continuous updates of the VAR, listing the assigned contractor personnel, throughout the life of the contract to the work location Security Management DD Form 254 Continuation Sheets. Office (SMO) code and higher echelons required to establish a servicing relationship in JPAS:

Text5: a. 114TH Sig Bn SMO code: WJHXAA

b. RRMC SMO code:

In addition to personnel security information, VARs will list the contract number in the additional information block, COR as the point of contact and the COR’s phone number. All contractor personnel integrated or embedded with RRMC organizations shall in-process through the supporting Security Office at work performance start date. All contractor personnel integrated or embedded with RRMC organizations shall out-process and clear through the supporting Security Office upon termination of employment on the contract or upon contract expiration/termination, whichever occurs first. Above requirements are applicable if there is a change in primary work performance location while employed on the contract. The prime contractor shall ensure above requirements are included in subcontracts and lower tier contracts when personnel are integrated or embedded with RRMC organizations. Per regulatory guidance, “embedded and/or integrated contractors are those who operate out of government-supplied on-base space.”

16. Ref 11.a. - HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY: All classified information, original and reproductions must be transmitted, marked, controlled and protected IAW National Industrial Security Program, DoD 5220.22-M (Change 1 March 28, 20 13). The information will remain property of the U.S. Government and shall be returned upon completion of the project per Contracting Officer's direction for disposition instructions

17. Ref 11.e. - This is a non-personal services contract (see Item 14). All contractor personnel working on this contract shall have the required clearance at performance start date and shall be able to maintain the required security clearances throughout employment on this contract.

18. Ref 11.e. - Any classified information generated or received during work performance on this contract shall be controlled, marked, protected, transmitted, and safeguarded in accordance with DoD policy and shall only be at specified Government requiring activity work locations.

19. Ref 11.e - The process of extracting, paraphrasing, restating or generating classified information based on a security classification guide or one or more source documents, or both, is derivative classification. Any derivatively classified information generated in performance of this contract shall normally be marked according to the classification markings reflected on the source material(s). However, a compilation of information could warrant a change in classification level of the information, or, it could warrant the classification of previously unclassified information. The Contractor shall consult with the COR regarding any potential classification issues when generating information and/or deliverables in support of this contract.

20. Ref 11.e. - The Government requiring activity will identify, or provide, additional instruction or appropriate security classification guides/guidance to the Contractor, as required. The Contractor shall notify the COR, in writing, of any instance where referenced security classification guides/guidance cannot be accessed at links or sites specified in this contract or specified in separate correspondence. The prime contractor shall ensure all applicable security classification guides/guidance are made available to any subcontractor(s), as appropriate.

21. Ref 11.e. - Persons who derivatively classify information and who apply derivative classification markings shall receive training in the proper application of derivative classification principles. The Contractor, in coordination with the COR, shall identify by name and position title, those contractor, subcontractor or any lower tier subcontractor personnel who will be generating and derivatively classifying information during work performance on this contract. This includes, but is not limited to, personnel who require SIPRNET accounts. These individuals shall successfully complete initial Derivative Classification Training at work performance start date and once every two years thereafter. Training consists of the Derivative Classification Course (IF103.16) and Derivative Classification Exam (IF103.06) and is available on-line at the DSSA/STEPP website at: http://cdsetrain.dtic.mil/derivative/index.htm, under Information Security. Certificates of successful completion, of initial and refresher training, shall be provided to the COR within three (3) business days of completion of training.

22. Ref 11e. - The prime contractor shall require subcontractors to include above requirements in lower tier contracts.

23. Ref 11.j. - The Contractor is not required to prepare an OPSEC Plan. The Contractor shall comply with DoD Directive 5205.02E and the requiring activity OPSEC program. The Contractor shall ensure all contractor employees and subcontractors performing work under this contract complete Level I OPSEC training within 30 calendar days of start of employee performance on this contract and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the COR upon request.

Text6: 24. Ref 11.j. - OPERATIONS SECURITY (OPSEC) REQUIREMENTS:

The general aim of OPSEC is to promote mission effectiveness by preserving essential secrecy about US intentions, capabilities, and current activities. Refer to DoD 5220.22-R, Industrial Security Regulation; DoD 5220.22-M, National Industrial Security Program Operating Manual; DoD 5205.02-M, DoD Operations Security (OPSEC) Program Manual; DoDD 5205.02E, DoD Operations Security (OPSEC) Program. OPSEC is directed to the protection of UNCLASSIFIED intelligence on classified or sensitive programs of such nature that the disclosure of the indicators may lead to the compromise of classified or sensitive information Security essential to defense activities may be compromised whenever open sources (such as technical articles, press releases, national publications, the congressional records, or contract awards) and detectable activities (such as communications, logistics actions, or research, development and test activities) provide information that hostile intelligence services (HOIS) can piece together resulting in actions harmful to the US interest. OPSEC is concerned with all sources of exploitable information. It covers the total problem by addressing vulnerabilities and countermeasures weakness in a program which could lead to the disclosure of classified information. Unlike other security programs, OPSEC does not readily lend itself to complete identification of security requirements (countermeasures) during initial contract preparation. Input from the contractor in the form of an initial OPSEC plan must be developed and provided by the contractor. OPSEC countermeasures and plans must be flexible to address changes in the threat environment information. Unlike other security programs, OPSEC does not readily lend itself to complete identification of security requirements (countermeasures) during initial contract preparation. Input from the contractor in the form of an initial OPSEC plan must be developed and provided by the contractor. OPSEC countermeasures and plans must be flexible to address changes in the threat environment.

25. Ref 11.l. –The Contractor shall require access to SIPRnet and NIPRnet IAW RRMC –IT access policies and procedures

26. Ref 11.l. - Information Assurance (IA) Training. All contractor personnel with access to Government information systems and networks shall successfully complete all required initial and annual IA awareness training as specified in AR 25-2 and as directed by the Government requiring activity. Training is available at https://ia.signal.army.mil.

27. Ref 11.l. - Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at: https://atc.us.army.mil/iastar/index.php in the unit container managed by the COR. Certificates of successful completion of IA training, Acceptable Use Policies (AUP), applicable baseline and computing environment certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

28. Ref 11.l. - The Contractor shall ensure that all contractor employees and subcontractor employees requiring IA awareness training complete the training at start of work performance on this contract and annually thereafter for the duration of this contract.

29. Ref 11.l. - Information Assurance Workforce Certification. Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.239-7001 (Information Assurance Contractor Training and Certification) applies to this contract. This contract is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management IA skills for personnel performing IA functions within DoD. Functions spanning multiple levels require certification of the highest level functions. Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty.

30. Ref 11.l. - The Contractor shall ensure its IA workforce members have the baseline certifications corresponding to their IA functions, as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3 of DoD 8570.01-M at work performance start date. Contractors will obtain all required Computing Environment (CE) certificates within 6 months of being engaged. The IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. The Contractor shall ensure that all employee certifications remain active and renewed prior to expiration.

31. Ref 11.l. – The Contractor shall ensure that all employees’ IA certifications are released to the Department of Defense Workforce Certification Application at: https://www.dmdc.osd.mil/appj/dwc/index.jsp.

32. Ref 11.l. - The Contractor shall ensure the Personnel Security (IT Level) and IA Workforce Specialty requirements, aligning the IA functional responsibilities and access levels to the contract tasks, in accordance with DoD 8570.01-M.

Text7:

33. Ref 11.l. - Non-Government-owned computing systems or devices. The Contractor shall comply with AR 25-1 and AR 25-2. The Contractor shall not install or connect non-Government-owned computing systems or devices to Government networks without the COR's coordinating and obtaining proper authorization from the appropriate Information Assurance Program Manager (IAPM), ensuring that all software has a Government Certificate of Networthiness. The non-Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

34. Ref 11.l. - Protection of Sensitive Unclassified Data. The Contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and For Official Use Only (FOUO), proprietary, and Law Enforcement Sensitive information residing on Mobile Computing Devices (MCD) or other external media, is protected in accordance with current Data at Rest (DAR) guidelines and requirements. The Contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to, laptop, netbook, notebook, or tablet computers, and Blackberry or equivalent devices. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks, and other portable digital storage devices. Guidance for protecting DAR information appears in DoD Policy Memorandum, 3 Jul 07, subject: Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Media, and in DoD Component implementing instructions.

35. Ref 14. - Additional References – see last paragraph on continuation sheets.

36. Ref 17.f. - The prime contractor shall provide a copy of the DD Form 254 and all revisions, for any classified subcontract supporting this work effort, to the COR, and RRMC Chief of Security. In addition, the prime contractor shall require any subcontractors who have lower tier subcontractors to also comply with this requirement. DD Forms 254 shall be provided to the following:

114TH SIGNAL BATTALON

RAVEN ROCK MOUNTAIN COMPLEX (RRMC)

ATTN: Christine Armond

1155 DEFENSE PENTAGON

WASHINGTON DC 20301-1155

E-mail: christine.s.armond.civ@mail.mil

37. Access to Protected Information. Protected information means all non-public information, including, but not limited to, trade secrets or proprietary information of other Contractors, Government source selection information, Privacy Act or personally identifiable information (PII), or any other information with distribution limited by the U.S. Government. If, during the performance of this requirement, Contractor personnel obtain access by any means to protected information, they shall not disclose, publish, divulge, release, or make known, in any manner or to any extent, the information except as necessary to carry out duties under this contract. Protected information shall be given only to persons specifically granted access to this sensitive information and may not be further divulged without specific prior written approval from an authorized U.S. Government individual. Further, contractor employees may use any non-public information for official/authorized U.S. Government purposes, and they shall not use the information for their personal gain, the gain of their employer, or the gain of anyone else. The Contractor shall notify the Contracting Officer of any potential organizational conflicts of interest created by any such access; however, a nondisclosure agreement will not overcome an Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5. Moreover, the Trade Secrets Act prohibits releasing proprietary information without the owner’s consent. Accordingly, all Government Contractors are required to mark their proprietary information, and any time the Contractor is given inadvertent access to such marked information, the Contractor shall inform the Contracting Officer of the access.

38. Federal Acquisition Regulation (FAR) Clause 52.204-9 (Personal Identity Verification of Contractor Personnel) is applicable to this contract.

39. Common Access Card (CAC). The Government will provide special access badges as necessary. The Prime Contractor Facility Security Officer (FSO) shall ensure that all Contractor personnel acquire and maintain CACs. The approving Government Trusted Agent (TA) may give access to the FSO using the online Trusted Associate Sponsorship System (TASS), https://www.dmdc.osd.mil/tass. Contractor eligibility remains in force during employment under the contract for those employees who have a valid and recurring requirement for access to Government facilities or automation systems (reference DD254 for systems access) to perform those duties stipulated in the contract. The Contractor shall use a valid CAC to access the Government domain. The Contractor shall immediately return the CACs to the COR when the Contractor employee’s employment is terminated or upon expiration of the contract. The CACs expire when Contractor employee’s eligibility terminates or three years from the issuance date, whichever occurs first. The Contractor is responsible for all CACs and shall report all lost or stolen CACs to the COR immediately.

41. Antiterrorism Level I Training. The Contractor shall ensure that all contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas complete Antiterrorism (AT) Level I awareness training within 30 calendar days after start of employee performance on this contract. Within 5 calendar days of training, the contractor shall certify to the COR or KO that all employees performing work under this contract have completed the AT Level I awareness training. AT Level I awareness training is available at: https://jkodirect.jten.mil/Atlas2/faces/page/login/Login.seam (Course JS-US007)

42. 36. iWATCH. The Contractor shall ensure that all employees and subcontractor employees performing work under this contract are trained on the local iWATCH program within 30 calendar days of start of employee performance on this contract. The requiring activity ATO will provide the locally developed iWATCH training. The Contractor shall maintain all iWATCH training records and shall provide copies to the COR upon request.

43. Contractor personnel may require access to Army Knowledge Online (AKO). The COR will provide sponsorship for this access.

44. Contractor personnel shall comply with all entry control requirements and security policies/procedures in effect at all work and TDY locations. This includes, but is not limited to, displaying Common Access Card (CAC) or any special access badges as required at any work location.

45. Threat Awareness and Reporting Program (TARP). Cleared contractor personnel shall comply with all Threat Awareness and Reporting Program (TARP) reporting requirements in accordance with AR 381-12, and as directed by the Government requiring activity. Cleared contractor personnel shall report threat-related incidents, behavioral indicators, and other matters of Counterintelligence (CI) interest as specified in AR 381-12, Chapter 3, to the nearest military CI office, the Facility Security Officer, the Federal Bureau of Investigation, or the Defense Security Service (DSS).

46. The Contractor shall ensure all cleared employees, to include cleared sub-contractor employees, attend threat awareness training within 30 calendar days of employee work start date and annually thereafter. Training must be conducted by a supporting CI agent or other authorized representative, as directed by the supporting Government Security Manager. The initial training may be satisfied by taking the authorized on-line training via AKO at: https://www.us.army.mil/suite/page/655474 if attendance at a CI training session is not possible within 30 calendar days of employee work start. Certificate of completion shall be maintained on file. The on-line training does not replace the requirement to attend the first available CI conducted threat awareness training session. The contractor shall maintain training records that include employee name, training dates, training locations, and method of training and shall make such records available to the COR, upon request.

47. Contractor personnel who require access to information, or who will be performing or participating in any functions, as outlined in AR 381-12, paragraph 2-6, shall contact their COR who will coordinate with the supporting Government Security Manager for scheduling of special CI threat-awareness briefings, and debriefings, as appropriate. This includes contractor personnel who require access to Sensitive Compartmented Information (SCI), Special Access Program (SAP) information, cryptographic information, or who are system administrators or key information network personnel with administrator-level privileges on Army information systems. These contractor personnel shall notify their COR in advance of any foreign travel to determine if special CI threat travel briefings/debriefings are required, as specified in AR 381-12, paragraph 2-6a. The COR will coordinate with the supporting Government on-site Security Manager for this determination.

48. Contractor personnel shall comply with all applicable security regulations, guidance, and procedures, including local, referenced in this DD Form 254, the Performance Work Statement (PWS), and in effect at all work locations. Contractor personnel shall attend all Government provided security and security awareness training as specified by the Government requiring activity. This includes successful completion of all required on-line security training, as directed by the Government requiring activity.

Text15: 49. Contractor Responsibility: By memorandum dated 1 April 2005, the Deputy Under Secretary of Defense (Counterintelligence and Security) authorized the use of JPAS to verify security clearance levels for personnel who require access to classified information within DoD. Within Army, use of JPAS is mandated. The Contractor FSO shall ensure all personnel performing on this work effort have security access level, Information Technology (IT) level, Contractor affiliation, Security Management Office (SMO) affiliation and all other required information accurately reflected/populated in JPAS. The Contractor shall make available to the Government requiring activity, and all work locations under this effort, all information necessary to enable verification of security access level/affiliation via JPAS. When Visit Authorization Letters (VAL) are required by the Government requiring activity, they shall be transmitted via JPAS. If any concerned organization is not on-line with JPAS, a hardcopy VAL may be necessary until JPAS is available. Non-DoD organizations may still require a hardcopy VAL.

50. Emergencies and Force Protection Conditions. During declared emergencies and/or elevated Force Protection Conditions (FPCONs) Charlie or Delta, contractor performance under this contract shall be determined by the COR or KO. All Contractor employees providing services under this contract are required to report for duty as scheduled and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the KO or COR. The Contractor Project Manager shall keep the COR apprised of all personnel whereabouts when in a temporary duty (TDY) location.

51. FAR Clause 52.204.2 applies to the extent that this contract involves access to information classified "Confidential," "Secret," or "Top Secret." The Contractor shall comply with

52.: a. The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M).

b. Any revisions to that manual, notice of which has been furnished to the Contractor.

c. If, subsequent to the date of this contract, the security classification or security requirements under this contract are changed by the Government and if the changes cause an increase or decrease in security costs or otherwise affect any other term or condition of this contract, the contract shall be subject to an equitable adjustment as if the changes were directed under the changes clause of this contract.

d. The Contractor agrees to insert terms that conform substantially to the language of this clause, including this paragraph, but excluding any reference to the Changes clause of this contract, in all subcontracts under this contract that involve access to classified information.

53. IAW AR 380-49, Ch 2-3(e), 'All fully executed DD Form 254s for subcontractors must be provided to the COR. The COR will ensure that the ISS also receives a copy.’

54. Ref 14. - Applicable Security Documents

AR 25-1 Army Information Technology AR 25-2 Information Assurance AR 25-55 The Department of the Army Freedom of Information Act Program AR 190-13 The Army Physical Security Program (FOUO requires AKO access) AR 190-51 Security of Unclassified Army Property (Sensitive and Nonsensitive) AR 380-5 Department of the Army Information Security Program AR 380-40 Safeguarding and Controlling Communications Security Material (FOUO requires AKO access) AR 380-49 Industrial Security Program AR 380-67 Personnel Security Program AR 381-12 Threat Awareness and Reporting Program (TARP) AR 525-13 Antiterrorism (FOUO requires AKO access) AR 530-1 Operations Security (OPSEC) (FOUO requires AKO access) DoDM 5200.01-V1 DoD Information Security Program: Overview, Classification, and Declassification DoDM 5200.01-V2 DOD Information Security Program: Marking of Classified Information DoDM 5200.01-V3 DOD Information Security Program: Protection of Classified Information DoDM 5200.01-V4 DoD Information Security Program: Controlled Unclassified Information (CUI) DoDD 5205.02E DoD Operations Security (OPSEC) Program DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM) DoDD 5400.11 DoD Privacy Program DoD 8570.01-M Information Assurance Workforce Improvement Program DoDI 8500.01 Cybersecurity DoDI 8510.01 DoD Information Assurance Certification and Accreditation Process (DIACAP) DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT) TB 380-41 Security: Procedures for Safeguarding Accounting and Supply Control of COMSEC Material (FOUO)

Army CIO/G-6 Best Business Practice 05-PR-M-0002, Information Assurance (IA Training and Certification); available at: https://informationassurance.us.army.mil/

Deputy Under Secretary of Defense memorandum, 1 Apr 2005, Subject: Facilitating Classified Visits within the Department of Defense

Department of the Army G-2 memorandum, 29 May 2007, subject: Classified Visit Request Process

SCI ADDENDUM TO DD FORM 254 7 APR 09

(1) This contract requires access to Sensitive Compartmented Information (SCI). The Commander, US Army Intelligence and Security Command (INSCOM), acting on behalf of the DA Deputy Chief of Staff (DCS), G-2 as the Cognizant Security Authority (CSA) for the US Army, has exclusive security responsibility for all SCI released to the contractor or developed under the contract and held within the Contractor's SCI Facility (SCIF) or Co-utilization Agreement (CUA) SCIF. The Defense Intelligence Agency (DIA) has security inspection responsibility for SCI and the Defense Security Service (DSS) retains responsibility for all collateral information released or developed under the contract and held within the DoD Contractor's SCIF. The manuals, regulations and directives below provide the necessary guidance for physical, personnel, and information security for safeguarding SCI, and are part of the security classification specification for this contract:

DoD 5105.21-M-1, SCI Security Manual, Administrative Security Signals Intelligence Security Regulations (SISR) (Available from the CM) Imagery Policy Series (Available from the CM) AR 380-28, DA Special Security System Army Handbook for SCI Contracts.

(2) Contract estimated completion date: (NOTE: Section “F” of the contract normally provides the Period of Performance. Option years are not to be included, as an option is not valid until exercised by the government.)

(3) The name, telephone number, email address and mailing address of the Contract Monitor (CM) for the SCI portion of this contract is: Theodore S Rogers, 301-878-7381, therodore.s.rogers2.civ@mail.mil (Additionally, identify the Security POC & phone number and email address at the contractor’s/subcontractor’s location): TBD (The Contract Monitor and the contractor security officer must be registered in the Army Contractor Automated Verification System (ACAVS) in order to process SCI actions)

(4) All DD Forms 254 prepared for subcontracts involving access to SCI under this contract must be forwarded to the CM for approval and then to HQ INSCOM, ACofS Security, G2, Contractor Support Element (CSE) for review and concurrence prior to award of the subcontract.

(5) The contractor will submit the request for SCI visit certifications through the CM for approval of the visit. The certification request must arrive at the Contractor Support Element at least ten (10) working days prior to the visit. Visit certification requests will be processed through ACAVS.

(6) The contractor will not reproduce any SCI related material without prior written permission of the CM.

(10) This contract requires (SI) (TK) (G) (HCS) (Add others as required)

(11) The contractor will perform SCI work under this contract at the following locations: Raven Rock Mountain Complex, 450 Harbaugh Valley Rd, Fairfield, PA 17320

***************************************** NOTHING FOLLOWS *************************************************