M16-R-4950_CONT_SHEETS.pdf

Continuation Sheet for DD Form 254 Contract Number M67854-16-R-4950

10a. Access to COMSEC information/material will be processed IAW DoD 5220.22-M and NSA Industrial COMSEC Manual, NSA/CSS Policy Manual 3-16. Access to COMSEC information/material requires a final U.S. Government clearance and special briefings at the appropriate level. Subcontracting COMSEC information by a contractor requires prior approval from the Commander, Marine Corps Systems Command (MCSC) (CoS-Security). Additional Security Guidelines for COMSEC, will be provided by User Activity. Attachment A contains additional COMSEC guidance. Contractor only requires access to COMSEC due to possible exposure related to having a SIPRNet Account.

10e(2). Contractor requires access to the SIPRNET (at government activity). Although intelligence data is available on SIPRNET, and could be inadvertently accessed, there is no valid requirement for intelligence data at this time.

Therefore, contractor shall not intentionally access or download intelligence data from the SIPRNET. In the event, intelligence data is required, the COR or Project Lead/Officer will modify this requirement for submission to the MarCorSysCom CMCC. A final U.S. Government clearance, at the appropriate level, is required prior to access to Intelligence information. There is no valid requirement for NATO access, however inadvertent access may occur because NATO information is available on the SIPRNET. NATO access requires a final U.S. Government clearance and special briefings, at the appropriate level, prior to access. Written approval of the Contracting Officer is required prior to subcontracting.

10j. The contractor shall comply with the requirements of the SECNAV M-5510.36 and DOD M5200.01, Volume 4 for the procedures for handling, marking, storing, transmitting, releasing and destruction of Controlled Unclassified Information (CUI) identified as "Unclassified//For Official Use Only" (U//FOUO) information.

10k. Secret Internet Protocol Router Network (SIPRNet) access is required. While accessing the SIPRNet, the contractor is limited to information for which there is a Need-To-Know, and shall not access, download or, further disseminate any special access data (i.e. intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and, or without the guidance and written permission of the COR. In the event that any special access is required, the COR must modify the contract requirements for issuance of a new modified DD Form

254. A final U.S. Secret clearance and access is the minimum level where access to the SIPRNet is required by a contract employee. A NATO awareness brief is also required for all contractor employees where NATO access is not present in JPAS. NATO awareness briefings for SIPRNet are not recorded in JPAS. SIPRNet Request Forms and training requirements must also be met prior to gaining a SIPRNet account. The contractor’s Facility Security Officer is responsible for ensuring (as a requirement) that all JPAS visit requests are submitted to each organization where classified information will be discussed or accessed.

11a. The contractor requires access to classified source data up to and including the classification levels identified in item 1 of this DD Form 254 in support of this work effort. All classified material generated, fabricated, or modified by this contract will be returned to the respective government activity or Facility Security Officer for retention. If contractor employees will be co-located in MCSC spaces during anytime within the full performance of this contract, they will comply with and be held accountable for the requirements of SECNAV M-5510.30, SECNAV M-5510.36 and any additional security requirements provided by the Activity Security Coordinator (as appropriate). The contractor shall comply with the requirements of the Information Systems Security Programs as described in OPNAVINST 5239.1B series and local command information systems security instructions. All systems, regardless of the level of data processed, will be accredited in accordance with the above instructions. Contractor will ensure all articles (including graphics) intended for public release or posting on internet/World Wide Web sites will be processed through the office listed in Item 12 above before posting.

11j. While performing aboard NAVY/USMC sites, the contractor shall comply with the provisions of OPNAVINST 3432.1, Marine Corps Order 3070 and the local command 3070 instruction series for Operations Security; at all other sites the contractor shall comply with the local command and/or program OPSEC plan.

ADDITIONAL GUIDANCE:

(a) Security classification guides required during this contract will be provided under separate cover by the project officer.

(b) In addition to the reporting requirements directed by the NISPOM, the contractor will provide a concurrent report of loss or compromise of classified information to: Commander, Attn: Director of Security, Marine Corps Systems Command, 2200 Lester Street, Quantico VA 22134-6050.

(c) Visit requests to activities other than those listed in the Statement Of Work or this DD-254 will have "need to know" certified by the MCSC Project Officer. All requests shall contain the information required by the NISPOM and shall not exceed a 12 month period.

(d) Contractors will conduct a security review and comply with MARCORSYSCOMO 5720.2, “PUBLIC RELEASE REVIEW PROCESS” prior to entering government information on a home page (contractor or government web page site). A copy of this order will be provided by the project officer under separate cover to the contractor.

(e) IAW Defense Security Service Industrial Security Letter (ISL) 2006-01, the Joint Personnel Adjudication System (JPAS) is the “CSA-designated database” referenced in the NISPOM (para 2-200b.) All contractor personnel performing on this contract will be correctly listed in JPAS and JPAS will be utilized for classified visit certifications.

(f) All Government Badges issued under this contract by MARCORSYSCOM will be returned immediately to the MARCORSYSCOM SECURITY OFFICE upon termination of contract, or individual terminations. When an individual contractor is terminated, for any reason, it is the responsibility of the Facility Security Officer to immediately notify the Director of Security, MCSC 2200 Lester Street, Quantico VA 22134-6050. Failure to comply could result in the suspension of all contractor proximity key and NT accounts.

(g) If additional contracting requirements exist where retention of classified information by the contractor facility is required, a written request to retain material will be forwarded to the COR. If approved, a Final DD- 254 will be issued for a period not to exceed 2 years.

(h) All work performed within MarCorSysCom sites/spaces, will follow SECNAV M-5510.30 (Personnel Security Program) and SECNAV M-5510.36 (Information Security Program) and local command security instructions.

ATTACHMENT A

ADDITIONAL SECURITY GUIDELINES FOR COMSEC

Contractor Generated Communications Security (COMSEC) Material: Any material generated by the contractor (including, but not limited to: correspondence, drawings, models, mockups, photographs, schematics, status programs and special inspection reports, engineering notes, computations and training aides) will be classified according to its own content. Classification guidance will be taken from other elements of this Contract Security Specification, DD Form 254, Government furnished equipment or data, or special instructions issued by the Contracting Officer, or his/her duly appointed representative.

REQUIREMENTS:

1. The requirements of DoD 5220.22-M and NSA/CSS Policy Manual 3-16 are applicable to this effort.

2. All contractor personnel to be granted access to classified COMSEC information must be U.S. citizens granted FINAL clearance by the government prior to being given access. Immigrant aliens, interim cleared personnel, or personnel holding a contractor granted CONFIDENTIAL clearance are not eligible for access to COMSEC information released or generated under this contract without the express permission of the Director, NSA.

3. Contractor employees or cleared commercial carriers shall not carry classified COMSEC material on commercial passenger aircraft anywhere in the world without the approval of the procuring contracting officer.

4. No contractor generated COMSEC or government furnished COMSEC material may be provided to the Defense Technical Information Center (DTIC).

5. Classified paper COMSEC material may be destroyed by burning, disintegration, chopping or high security cross-cut shredding. Cryptographic key tapes must be “terminally” destroyed (destroyed to the point where it cannot be reconstructed) utilizing devices listed on the Evaluated Products List (EPL) for Punched Tape Destruction Devices or the EPL for High-Security Disintegrators. A listing of EPLs can be found at http://www.nsa.gov/ia/government/mdg.cfm. When a method other than burning is used, all residue must be reduced to pieces 5mm or smaller in any dimension. When classified COMSEC material other than paper is to be destroyed, specific guidance must be obtained from the User Agency.

6. Unclassified COMSEC information released or generated under this contract shall be restricted in its dissemination to personnel involved in the contract. Release in open literature or exhibition of such information without the express written permission of the Director, NSA, is strictly prohibited.

7. Recipients of COMSEC information under this contract may not release information to subcontractors without permission of the User Agency.

8. Additional notices to be affixed to the cover and title or first page of contractor generated COMSEC documents:

a. “COMSEC MATERIAL – ACCESS BY CONTRACTOR PERSONNEL RESTRICTED TO U.S. CITIZENS HOLDING FINAL

GOVERNMENT CLEARANCE.”

b. “THIS PUBLICATION OR INFORMATION IT CONTAINS MAY NOT BE RELEASED TO FOREIGN NATIONALS WITHOUT PRIOR SPECIFIC APPROVAL FROM THE DIRECTOR, NSA. ALL APPROVALS WILL IDENTIFY THE SPECIFIC INFORMATION AND COPIES OF THIS PUBLICATION AUTHORIZED FOR RELEASE TO SPECIFIC FOREIGN HOLDERS. ALL REQUESTS FOR ADDITIONAL ISSUANCES MUST RECEIVE PRIOR SPECIFIC APPROVAL FROM THE DIRECTOR, NSA.”

http://www.nsa.gov/ia/government/mdg.cfm