SAP_Supp_(HQ0147-20-R-0001).pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

fleischmannd 11.0.1.20130826.2.901444 Special Access Program (SAP) Supplement Contract No:

(January 18, 2019 Version—all other versions obsolete.)

1. Item 10f:

a. This contract involves DoD SAPs. Strict requirements for need-to-know, special handling, physical security measures, and administrative controls beyond the requirements of the National Industrial Security Program (NISP) are required. SAP participants must comply with the enhanced security procedures referenced in this document.

b. Access to MDA SAP information or material is authorized only at facilities and locations specifically approved by MDA Special Programs. Access to SAP information requires a final U.S. Government:

(1) Secret clearance with a favorable NACLC, PRS, Tier 3 investigation, or Tier 3 reinvestigation, as appropriate, completed within the last five (5) years, an approved SAP nomination, and a signed SAP nondisclosure agreement prior to access. The government program security officer (PSO) will contact the contractor facility security officer (FSO) to obtain security information on facilities and personnel required to perform on this contract.

(2) Top Secret clearance with a favorable SSBI, PPR, or SBPR, as appropriate, completed within the last five (5) years, an approved SAP nomination, and a signed SAP non-disclosure agreement prior to access. The government PSO will contact the contractor FSO to obtain security information on facilities and personnel required to perform on this contract.

c. All SAP work, regardless if in a prime or subcontractor’s location, will be performed in an MDA-approved SAP facility (SAPF). If there is a requirement to discuss, store, or process SAP information in an existing sensitive compartmented information facility (SCIF), SAPF, or closed area, a memorandum of understanding (MOU) or a Co-Use Agreement (CUA) must be executed between the MDA-cognizant SAP security representative and the other government cognizant security representative. A standard operating procedure (SOP) will be written for each SAPF and coordinated with MDA Special Programs.

2. Item 11h:

Consult with MDA Special Programs prior to ordering encryption devices or COMSEC keying material to support SAP transmissions.

3. Item 11i:

TEMPEST requirements may be necessary in the performance of this contract in accordance with program requirements, Committee on National Security Systems Advisory Memorandum (CNSSAM) TEMPEST 01-13, DoD Manuals, and applicable MDA SAP Central Office (SAPCO) policies. Consult with MDA Special Programs to confirm the requirements.

4. Item 11j:

OPSEC measures are necessary in the performance of this contract. Specific guidance will be provided by MDA Special Programs.

5. Item 12:

a. Public release of SAP information is prohibited . Do not release documents or other materials pertaining to this effort to the Defense Technical Information Center (DTIC) or any other such information service under any circumstance. Pre-publication and/or presentation(s) review and approval are required prior to the use of any classified or unclassified information which is either tangentially or directly related to any SAP. In each case, approval must be obtained from the MDA SAPCO. The request must be submitted by the person who desires to make the publication or presentation, via the contractor program security officer (CPSO) to the

MDA PSO.

b. The contractor will not use references to SAP accesses (nicknames, code words, et. al) or information, even by unclassified acronyms, in advertising, promotional efforts, or employee recruitment.

6. Item 13:

The Government PSO will provide additional security classification guides (SCG) specific to the SAPs under this contract. Contractors will classify SAP material in accordance with the provided SCGs and applicable publications listed in Item 14.

a. Prior to processing, storing, transmitting, transferring, or communicating MDA SAP information on any IS or network, the contractor must comply with the latest statutory, regulatory, as well as national, DoD, and MDA policy guidance, to include those references listed in Item 14. The contractor must obtain the requisite authorization to test, connect, or to operate from the MDA authorizing official (AO).

b. The Contractor must employ physical security safeguards for IS(s) and/or networks involved in processing or storage of Government information/data to prevent unauthorized access, disclosure, modification, destruction, use, and to otherwise protect the confidentiality and ensure use conforms with DoD regulations.

7. Item 14:

Contractors performing under this contract will use the below listed security publications unless exempted by MDA Special Programs. MDA Special Programs will provide the contractor the below listed publications if requested.

a. DoD Manuals 5200.01, Volumes 1 through 4, DoD Information Security Program.

b. DoD Joint Special Access Program (SAP) Implementation Guide (JSIG), and applicable MDA Implementation guidance.

d. DoD Memo, “Transition to the Risk Management Framework.”

c. JSIG errata, 05 October 2018.

e. The MDA Special Programs “SAP Nomination Process (SAPNP).”

f. DoD Manuals 5205.07, Volumes 1 through 4, DoD Special Access Program (SAP) Security Manuals, and MDA Implementation Guidance.

g. DoD 5220.22-M “National Industrial Security Program Operating Manual.”

h. Applicable PSO-approved facility-specific SOPs, treaty plans, and OPSEC guides.

i. DoD Directive 5205.07, “Special Access Program (SAP) Policy.”

j. DoD Instruction 5205.11, “Management, Administration, and Oversight of DoD Special Access Programs (SAPs).”

k. National Security Agency/Central Security Service (NSA/CSS) Policy Manual 9-12.

m. DoD “Security Marking Implementation Guide for Special Access Programs.”

n. DoD Instruction 8510.01, “Risk Management Framework (RMF) for DoD Information Technology(IT).”

o. OMB Memorandum, “Management and Oversight of Federal Information Technology.”

p. USDI Memorandum "Insider Threat Mitigation."

q. DoD Instruction 4140.01, “DoD Supply Chain Materiel Management Policy.”

r. Applicable DoD and MDA guidance.

8. Item 15:

MDA Special Programs will conduct program/security reviews of all SAPFs, material, and operations related to this contract. DSS oversight over SAP portions of this contract is carved-out.

9. Contract Number.

The contractor may be required to establish non-attributable, internal procedures and charge numbers that will be documented in their business financial management procedures as necessary for cost accumulation by uncleared personnel.

10. Subcontracting.

Subcontracting must have prior approval from MDA Special Programs.

Any classified program activity requiring the use of a subcontractor facility must meet DoD Manual 5205.07-V3, the MDA Implementation guide, and be approved by MDA Special Programs.

11. Communications and Transmissions.

a. All material relating to this contract and its administration will be classified in accordance with MDA and SAP-specific SCGs and this DD Form 254, or as directed by MDA Special Programs.

b. Program-related communications will be conducted on secure communication devices.

12. Vouchers.

All invoices and vouchers submitted under this contract must be unclassified and be devoid of any information requiring them to be classified or cause an OPSEC concern.

may not

b. Invoice/voucher must be transmitted to the sterile address. The sterile address will be provided under a separate cover from procurement contracting officials, see section "G" of the contract.

a. Invoice/voucher reveal the contractor’s name, customer’s name, or any funding figures.

13. Legal Counsel.

Notify the procuring contracting officer (PCO) and MDA Special Programs, in writing, should the contractor require private counsel to represent corporate interests in matters related to or associated with SAP-sponsored activities. The private counsel will be treated as a subcontractor. In those incidents where the issues are not program-specific, it is the responsibility of appropriately-indoctrinated contractor personnel to prevent inadvertent disclosure of SAP-related information, operational procedures, and/or administrative details.

l. MDA Special Access Programs "Top Secret Control Officer's (TSCO) Guide."

s. MDA Special Programs "Assured File Transfer Process."

14. Retention of Program Related Documentation, Software, and Hardware.

Upon completion of this contract and acceptance by the government of final deliverables, the contractor must:

a. Conduct an inventory/audit of all SAP material received and/or generated under this contract and forward it to MDA Special Programs.

b. In accordance with MDA Special Programs direction, the contractor must destroy administrative security records and related documents using an approved destruction procedure/method and maintain certificates of destruction for final close-out review. Retention of SAP information at the contractor facility is not generally authorized beyond contract close-out unless a follow-on contract or task is anticipated. A written request for authorization for document retention must be forwarded to the PCO and MDA PSO for approval.

15. Issues/Conflict Reporting.

a. Any questions regarding classification, access, or any other security-related issue in regard to the SAP portion of this contract must be referred to MDA Special Programs.

b. Any conflict between instructions contained in Item 14 and this DD Form 254 must be reported to MDA Special Programs by the most expedient and secure means available.

COR/TM/CLIN COTR

Special Access Program Representative Missile Defense Agency Missile Defense Agency