J.8 DD254 DRAFT 11MAR2021 v1.pdf

CLASSIFICATION (When filled in):

PREVIOUS EDITION IS OBSOLETE. Page 1 of 3 AEM LiveCycle Designer

PREVIOUS EDITION IS OBSOLETE. Page 1 of 3 AEM LiveCycle Designer

DD DD FFOORMRM 252544,, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires: May 31, 2022

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED (See Instructions)

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

7. SUBCONTRACTOR(S)

(-- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor.)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

(Additional Performance Locations are located in block 13)

UNCLASSIFIED

UNCLASSIFIED

Top Secret None

✘ HM047621R0023

2021/03/11

NATL GEOSPATIAL-INTELLIGENCE AGENCY, NGA

SPRINGFIELD 7500 GEOINT DRIVE SPRINGFIELD VA 22150-

SPRINGFIELD VA 22150-7500

USA

HM0476

NATIONAL GEOSPATIAL-INTELLIGENCE AGENCY, 7500 GEOINT

Drive Springfield, VA 22150

CLOVER

PREVIOUS EDITION IS OBSOLETE. Page 2 of 3 AEM LiveCycle Designer

PREVIOUS EDITION IS OBSOLETE. Page 2 of 3 AEM LiveCycle Designer

DD DD FFOORMRM 252544,, APR 2018

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA

g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.)

h. FOREIGN GOVERMENT INFORMATION

d. FORMERLY RESTRICTED DATA

i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below) Public Release Authority:

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. See instructions for additional guidance.)

List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

CO: Gary Davis COR: Kathleen Martens

Questions regarding this solicitation DD 254 should be directed to the POC for this solicitation. For security issues for the solicitation please contact NGA Industrial Security Help Desk at:

IndustrialSecurity@nga.mil for UNCLASSIFIED messages Indusec@nga.smil.mil for classified messages up to SECRET

SEE SECTION 13 CONTINUATION SECTION AT THE BOTTOM OF THIS FORM

UNCLASSIFIED

UNCLASSIFIED

See Section 13

See Section 13

SEE SECTION 13 CONTINUATION SECTION AT THE BOTTOM OF THIS

FORM

PREVIOUS EDITION IS OBSOLETE. Page 3 of 3 AEM LiveCycle Designer

PREVIOUS EDITION IS OBSOLETE. Page 3 of 3 AEM LiveCycle Designer

DD DD FFOORMRM 252544,, APR 2018

NAME & TITLE OF REVIEWING OFFICIAL SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. (See instructions for additional guidance.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. (See instructions for additional guidance.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

c. ADDRESS (Include ZIP Code) d. POC NAME

e. POC TELEPHONE (Include Area Code)

f. EMAIL ADDRESS (See Instructions)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

b. TITLE

c. ADDRESS (Include ZIP Code)

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

e. CAGE CODE OF THE PRIME CONTRACTOR (See Instructions.)

f. TELEPHONE (Include Area Code)

g. EMAIL ADDRESS (See Instructions)

h. SIGNATURE

i. DATE SIGNED (See Instructions)

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

UNCLASSIFIED

UNCLASSIFIED

See Section 13

Jamie Mongold Regional Security Officer Jamie Mongold

NGA is responsible for oversight of SCI Ouid[NGA SISI]

NATIONAL GEOSPATIAL-INTELLIGENCE AGENCY

7500 GEOINT Drive, Springfield, VA, 22150 NGA Industrial Security Team

571-557-3355

HM0476 IndustrialSecurity@nga.mil

Maurice Williams HM0476

Industrial Security Lead

Maurice Williams

ATTN: MS S84 - OCS, NGA SPRINGFIELD 7500 GEOINT DRIVE

SPRINGFIELD VA 22150-7500, SPRINGFIELD, VA, 22150-7500, USA

5715578440 2021/03/15 maurice.williams@nga.mil

IndustrialSecurity@nga.mil

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

CONTINUATION OF ITEM 13

[Block: 13 Continuation]

Accounting for Classified:

As indicated in 5220.22.M, contractors shall establish an information management system to protect and control the classified information in their possession.

Contractors shall ensure that classified information in their custody is used or retained only for a lawful and authorized U.S. Government purpose. The U.S.

Government reserves the right to retrieve its classified material or to cause appropriate disposition of the material by the contractor. The information management system employed by the contractor shall be capable of facilitating such retrieval and disposition in a reasonable period of time. Authorized NGA personnel may request and receive a listing from the contractor’s information system of all classified entrusted to the contractor from NGA or in connection to this contract for NGA. Authorized personnel consists of NGA program personnel for the contract and personnel from NGA Security. If there is any doubt if the person is authorized access, clarification will be made by Industrial Security or the contracting officer of record.

Retention of classified after the period of performance is only authorized long enough to properly close out the contract and properly dispose of classified as directed by the contracting officer or representative. The manner of disposing of classified shall adhere to the NISPOM. A copy of the certification of disposition by the contractor of government furnished property and information shall be provided to Industrial Security if classified was released to the safekeeping of the contractor.

Classification Guidance:

Specific classification guides for this program will be issued by the program office or COR on this effort directly to the contractor.

With the type of environment NGA operates in, the contractor may be exposed to other NGA programs or classified information not associated with this contract or the information may not be referenced in the program classification guides but may be referenced in the Consolidated NGA Security Classification Guide (CoNGA SCG). The contractor program manager or contractor security office can request access to the guides from the NGA program office or Industrial Security who will provide links or soft/hard copies of the requested security guides. The security guides can also be found on JWICS. All classified guides are accountable items and if provided to the contractor shall be tracked and accounted for in the contractor’s information management system.

E-Nomination Portal:

NGA Contractor SCI nomination process is completed within a web-based portal known as the e-Nomination portal. To gain access to the e-Nomination portal the contractor shall delegate a security professional to make the nominations. The number of personnel assigned to make nominations is limited per the COR and do not have to be performing on the contract. For technical issues the contractor will need to contact the e-Nomination support team via e-mail.

The following information of the security professional shall be provided to the COR to generate an e-Nomination account.

1.Full Name 2.Primary e-mail address 3.Alternate e-mail address: in case the primary e-mail address holder is not available. It is recommended that this be a group e-mail box or distribution list.

4.Physical Address Once a nomination is submitted, the e-Nomination portal assigns an e-Nomination Number to the submission. In an effort to provide better OPSEC and protect personal identification information when corresponding via unsecure means (encrypted e-mail authorized) the contactor is not authorized to pair the nominated individual’s name with the assigned e-Nomination number. If the contractor misplaces their copy of nomination personnel and e-Nomination numbers list, the contractor security office shall contact the COR for assistance. NGA Industrial Security and NGA Personnel Security may be contacted for assistance if the COR is not available. Only a limited number of personnel in these offices have access to this information and may not be available for assistance at the time of call.

Foreign Travel:

Contractors with SCI access, conducting official or unofficial travel outside the Continental United States shall enter travel details into PeopleSoft, if at all possible 40 days prior to the trip or as soon as the trip is known, if within 40 calendar days. Upon reentry into the Continental United States, the individual has 15 calendar days to complete post travel forms located in PeopleSoft. If the individual does not have access to PeopleSoft, they can contact the COR and indicate foreign travel is projected and PeopleSoft is in need of updating to reflect the travel (this also applies to the post travel forms).

Government Furnished Property and Information:

If contract personnel are issued a Common Access Card (CAC) the contract personnel will follow the directions of their assigned Trusted Agent for the CAC.

When contract personnel depart the contract they will need to notify their assigned Trusted Agent. If the contract personnel will no longer be supporting NGA via an NGA contract the CAC shall be turned in to the NGA Site CAC Office, the Trusted Agent or the COR. If contract personnel are unable to contact the Trusted Agent or return the CAC, it is the contractor security office’s responsibility to collect the CAC from the individual and notify and seek further direction from the COR and Industrial Security the same day.

Personnel on this contract may be issued other types of government identification or other items (together or separately is referred as items). These items are not limited to but may include the Intelligence Community Access Badge, tokens or NGA Parking Hang Tag. When contract personnel depart the contract, notification by the contractor to the program office and Industrial Security shall be made the same day. If the contract personnel will no longer be supporting NGA via an NGA contract the items shall be turned into the NGA Workforce Support Center or the COR. If contract personnel are unable to turn these items in to the Workforce Support Center or COR , it is the contractor security office’s responsibility to collect the items from the individual to include completing any debriefing paperwork needed and notify and seek further direction from the COR or Industrial Security. Items shall be returned within 4 business days (timeline may be extended with authorized documented exceptions by NGA Security) to an NGA Site Security office. The contractor shall track and record delivery of items collected as if the items were classified SECRET (NISPOM Chapter 5, Section 4). These receipts shall be kept for the life of the contract and be presented for review if requested by NGA Security Personnel (military/government/contractor). Digitalizing receipts for filing to reduce storage is authorized.

Personnel Security Clearance:

All contractor Single Scope Background Investigation – Periodic Reinvestigation (SSBI-PR) shall be submitted to the Defense Counterintelligence and Security Agency (DCSA) Personnel Security Management Office - Industry (PSMO-I) in a timely manner to prevent interruption of continuous access. When submitting the package, the contractor will ensure the NGA Personnel Security Office address is used in the “Thru Address” block. Also, in the comment section the contractor should place the following statement “For SCI access with NGA”. Once the investigation is completed the contractor shall notify NGA Personnel Security that the investigation is in need of adjudication.

NGA Personnel Security offers status checks of personnel who have been nominated for SCI access. This is done in two separate methods. One is done monthly and provides an in-depth review. To obtain this service the contractor security office needs to contact personnel security to establish a monthly reoccurring appointment. The other method is via e-mail. The e-mail status check will provide at what stage the nomination is in such as awaiting for COR

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

CONTINUATION OF ITEM 13

approval, adjudication action or awaiting additional information. The e-mail status is done bi-weekly. The subject of the e-mail shall be “Status Check”.

Multiple nominations can be checked with one e-mail request however the list of personnel must be placed in an Excel compatible document.

Upon request from NGA, a list of all personnel supporting the contract shall be provided within 24 hours of request unless indicated otherwise.

Protection of Personally Identifiable Information (PII):

All PII information shall be safeguarded in accordance with established law, regulation and polices. The contractor will control all PII information connected to NGA as CUI. NGA defines PII as “Information that can be used to distinguish or trace an individual's identity, such as their name, Social Security number, biometric records, etc., alone or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, mother's maiden name, etc.”

A contractor shall report the detection or discovery of suspected or confirmed incidents involving PII to their program manager or COR. If the program manager or COR is unavailable or has a conflict of interest, contact the Privacy Office. The following is a short example list and does not include all that is considered or may be considered PII:

Security Clearance Level Leave Balances; type of leave used Family Data Religion, Race, National Origin Home Address Home Telephone Number Personal E-mail Address Social Security Number Biometric Identification (such as fingerprints)

Date of Birth Place of Birth Mother’s Maiden Name Performance Ratings Participants Names/Results in NGA Courses Alien Registration Number Driver’s License Number Medical or Financial Records

Protection of Unclassified Information:

The Contractor shall not release outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the Contracting Officer has given prior written approval or in performance of a project that has been scoped and negotiated by NGA with the contractor. Release and disclosure guidance provided to subcontractors shall be “all release and disclosure request shall be submitted though the prime contractor to NGA”.

In accordance with DoD Instruction 5200.48, Controlled Unclassified Information (CUI) Effective March 6, 2020, CUI information and material may be transmitted via first class mail, parcel post, or, bulk shipments. When practical, CUI information may be transmitted electronically (e.g., data, website, or e-mail), via approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure or transport layer security (e.g., https). Avoid wireless telephone transmission of CUI when other options are available. CUI transmission via facsimile machine is permitted;

however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive CUI; facsimile machine located in a controlled government environment).

The absence of the CUI marking on information does not mean the information may be released. Some records may still require protection. The contract will seek further guidance when needed.

During the performance of this contract, DoD will be expanding the Controlled Unclassified Information (CUI) Program. NGA will provide guidance to the contractor. If the contractor encounters CUI prior to receiving the guidance, the contractor will contact NGA Industrial Security for guidance.

Public Release:

Unless noted in the contract or FAR, release request of contract information shall be routed to the Contracting Officer by the way of the NGA program office for this contract and/or task orders. Request to release information (classified or unclassified) to international partners requires approval from NGA’s Office of International Affairs.

Security Incident Reporting:

In addition to NISPOM requirements, contractors shall report all security incidents, infractions and any other situation if it involves the possibility of unauthorized release or disclosure of classified information to include incidents that jeopardizes classified information. This includes FGI and NATO classified information. Notification recipients shall include the DCSA IS Rep for the company, NGA Industrial Security, NGA Information Security Division (ISD), and the CORs for the base contract (as listed in contract paperwork) and the task order contract (if applicable). Initial notification will consist of only the following information via e-mail of the day of discovery:

Incident type Personnel Involved Contract Number Primary COR Task Order COR Date and Time of Incident Lead Company Investigator for the Incident Estimated Date of Completion of Investigation All incident information, except the initial notification information, shall be treated as SECRET//NOFORN/Working Papers until determination is made by NGA Security. The investigation incident report shall be classified SECRET//NOFORN/Working Papers and transmitted to NGA ISD (for government investigation and determination), NGA Industrial Security (to ensure compliance), and the CORs for the base contract (number located on the DD 254) and the task order contract (if applicable) for contract monitoring. The report will be transmitted by the most secure means possible in this order; classified e-mail to all listed

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

CONTINUATION OF ITEM 13

parties. If classified e-mail is not an option transmit via secure fax to NGA Industrial Security for distribution. If secure FAX is not an option, transportation between the company's registry and NGA registry (mail/FedEx) is authorized. Only as a last resort should the investigation report be hand carried to Industrial Security for distribution. If AIS equipment is involved it is the contractor's responsibility to have the AIS equipment properly transported (such as courier authorization) to an NGA facility for investigation, if requested by NGA.

Subcontracting requirement:

All subcontracts requiring access to classified information require CO/COR approval. Once submitted for approval an e-mail notification shall be sent to Industrial Security and the contract program office. Subcontracts not requiring access to classified information still require the contract program office approval.

The prime contractor shall certify their proposed subcontractor is not effectively owned or controlled by a foreign interest or cleared under a Special Security Agreement (SSA). This validation will be through the Defense Counterintelligence and Security Agency. Access to proscribed information by a company cleared under an SSA may require NGA to complete a National Interest Determination (NID) to determine if release of proscribed information to the subcontractor is in the best interest of national security. The subcontractor personnel will not be nominated for or given access to classified information until the NID is validated by NGA Industrial Security.

Industrial Security Branch Support:

NGA is responsible for all SCI connected to this contract. To assist and provide proper oversight to the contractor, NGA will conduct visits to the contractor sites. These visits (commonly known as Customer Assistance Visits or CAVs) will range from 1 NGA Industrial Security person (who may be military, government, or contractor for security services to NGA) or a team of personnel to provide guidance and assistance in protection of national security information. Other government organization may be invited to attend or be notified of such visits and the results of such visits. There may be other visits (announced and unannounced) to ensure compliance of other security and non-security related requirements. The contractor security professional responsible for the contract will contact NGA Industrial Security to coordinate the CAV annually.

Initially, all physical security requirements connected to ICD 705 will be coordinated through NGA Industrial Security. The NGA Classification Guide provides general classification guidance when dealing with safeguarding SCI. Per ICD 705-2, if a SCIF conference room (accredited under this contract) will be used by another organization (when a Co-utilization/Joint Utilization is not in place or being coordinated) the contractor shall notify Industrial Security via e-mail within 10 days. It is understood at times meetings are scheduled within the 10 day window, in this case immediate notification is required.

If requested NGA Industrial Security will provide a limited supply of physical and digital copies or training aids and reference material such as the NISPOM, ICD 705, 5200.01 Vol 1-4 and posters.

Inspection Reporting:

Contractor is responsible to submit the following Defense Counterintelligence and Security Agency documents to the NGA Industrial Security Branch within 30 days of completion or upon request prior to an NGA Industrial Security Customer Assistance Visit:

•DCSA Results Letter •Rating Matrix •List of Vulnerabilities , observations, recommendations, and other documentation provided by DCSA following an inspection

Ref 10e1: SCI Access required. No public release of information authorized, public disclosure or confirmation of any subject related to the support contract is not authorized without first obtaining written approval from the GCA.

Ref 10e2: Non-SCI Information is not releasable to contractor employees who have not received a clearance at the appropriate security level. Written concurrence of the GCA is required prior to subcontracting. Access to Intelligence information required for performance.

Ref 10g: Personnel not assigned to a NATO staff position, but requiring access to NATO classified information, NATO COSMIC, NATO Secret or access to the NATO accredited SIPRNET terminals, must possess the equivalent FINAL or Interim U.S. Security Clearance based upon the appropriate personnel security investigation required. Personnel with access to NATO ATOMAL information must have the appropriate level FINAL U.S. Security Clearance. The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees are NATO briefed prior to access being granted. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM Ch 10, Section 7. Prior approval from the GCA is required for subcontracting. : NATO:

During this contract, the contractor will have access to NATO Information. Upon approval from NGA, the contractor will be indoctrinated at the appropriate access level. NGA does not require refresher training for access to NATO Information. Per NISPOM 10-706, contractors are required to have annual NATO refresher training. Upon request NGA can provide training material to the contractor security team to help meet NISPOM requirements. Per DD Form 441, the Department of Defense Security Agreement, time spent by the contractor to meet NISPOM requirements is not billable to the contract unless authorized within the contract or by the CO/COR.

Ref 10j: Controlled Unclassified Information (CUI) generated and/or provided under this contract shall be safeguarded and marked as specified in DoD Instruction 5200.48.

Ref 11a: Contractor performance is restricted to locations identified in Block 13.

Government agency or activity will provide security classification guidance for performance of this contract.

Ref 11j : OPSEC:

NGA applies strong OPSEC measures to deny potential adversaries access to NGA’s critical information. To ensure the continuation of denial, personnel assigned to this contract shall comply and support the OPSEC plans associated with this contract. The contractor shall remain compliant with NGA OPSEC training requirements. If warranted, the contractor will work with the OPSEC Program Management or the Key Component OPSEC Officer to protect NGA’s critical information.

Ref 11l

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

CONTINUATION OF ITEM 13

[Block: 8] [Location] NATL GEOSPATIAL-INTELLIGENCE AGENCY, 3200 SOUTH SECOND STREET

ST LOIUS MO 63118

USA [Location Code] HM1575 [Location] NATL GEOSPATIAL-INTELLIGENCE AGENCY, ATTN; L13-OCSS 3838 VOGEL ROAD ARNOLD MO 63010-6238

ARNOLD MO 63010-6238

USA [Location Code] HM1575

[Block: 12] DoDAAC[HM0476] Location Code/Agency Name/Address[HM0476, ATTN: MS S84 - OCS ATTN: MS S84 - OCS, NGA SPRINGFIELD 7500 GEOINT DRIVE SPRINGFIELD VA 22150-7500, SPRINGFIELD, VA, 22150-7500, USA]