ePS_RFP_Attach_12_DD 254 Signed.pdf

Electronic Procurement System Request for Proposal

Attachment 12: DD Form 254

Acquisition Category (ACAT 1) Version: 1.0

23 March 2017

Distribution Notice D: Authorized to the Department of Defense (DoD) and DoD Contractors only. This document is for administrative or operational use, as of the date of approval for this document. Refer to the Program Manager (PM), PMW 220 Navy Enterprise Business Solutions (Navy EBS), Program Executive Office Enterprise Information System (PEO EIS), Washington Navy Yard, 1325 10th St. SE, Bldg. 196, Washington, D.C. 20374 for additional document requests.

Handling and Destruction Notice: Comply with distribution statement and destroy by any method that will prevent disclosure of contents or reconstruction of the document.

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

SECRET

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER

X

a. ORIGINAL (Complete date in all cases)

DATE (YYYYMMDD)

20170323

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs)

REVISION NO.

c. SOLICITATION OR OTHER NUMBER

N00039-17-R-0002

DUE DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases)

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes, complete the following:

In response to the contractor’s request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

THIS DD 254 IS FOR SOLICITATION PURPOSES ONLY. AN

ORIGINAL DD 254 WILL BE PROVIDED UPON CONTRACT

AWARD.

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE

8. ACTUAL PERFORMANCE

a. LOCATION

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

PROVIDE A COMMERCIAL OFF THE SHELF (COTS) END TO END (E2E) ELECTRONIC PROCUREMENT SYSTEM (EPS). THE EPS IS A MODERNIZATION EFFORT TO REPLACE DON’S LEGACY CONTRACT WRITING SYSTEM (CWS) AND OTHER ANCILLARY PROCUREMENT

SYSTEMS OR PORTALS.

10. CONTRACTOR WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION X a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

X

b. RESTRICTED DATA X b. RECEIVE CLASSIFIED DOCUMENTS ONLY X

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION X c. RECEIVE AND GENERATE CLASSIFIED MATERIAL X

d. FORMERLY RESTRICTED DATA X d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE X

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY X

(1) Sensitive Compartmented Information (SCI) X f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

X

(2) Non-SCI X g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

X

f. SPECIAL ACCESS INFORMATION X h. REQUIRE A COMSEC ACCOUNT X

g. NATO INFORMATION X i. HAVE TEMPEST REQUIREMENTS X

h. FOREIGN GOVERNMENT INFORMATION X j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS X

i. LIMITED DISSEMINATION INFORMATION X k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE X

j. FOR OFFICIAL USE ONLY INFORMATION X l. OTHER (Specify)

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

HANDLING REQUIREMENTS

X

k. OTHER (Specify)

NATO BRIEF FOR SIPRNET ACCESS ONLY AT

GOVERNMENT LOCATIONS ONLY

DD FORM 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE SPAWAR (O/P) 5500/3 (REV. 6-2006)

SOLICIATION NUMBER: N00039-17-R-0002

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial

Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release Direct Through (Specify):

COMMANDER, SPACE AND NAVAL WARFARE SYSTEMS COMMAND (SPAWARSYSCOM), CODE 8.5.1, 4301 PACIFIC HIGHWAY, SAN DIEGO CA 92110-3127

RELEASE OF RESTRICTED DATA MATERIAL IS NOT AUTHORIZED.

to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

* In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

ACCESS REQUIREMENTS:

THE CONTRACTING OFFICER IS TERRY COLEY, SPAWAR 2.1, (202) 433-0856

THE CONTRACTING OFFICER’S REPRESENTATIVE (COR) IS TBD.

10.B ACCESS TO RESTRICTED DATA REQUIRES A FINAL U.S. GOVERNMENT CLEARANCE AT THE APPROPRIATE LEVEL. PERMISSION

OF THE PEO EIS COR IS REQUIRED PRIOR TO SUBCONTRACTING.

10.K CONTRACTOR IS REQUIRED TO BE NATO BRIEFED FOR THE SOLE PURPOSE OF ACCESSING SIPRNET. THE SPECIAL BRIEFING IS PROVIDED BY THE CONTRACTING COMPANY'S FACILITY SECURITY OFFICER. NOTE: THERE IS NO REQUIREMENT FOR THE CONTRACTOR TO HAVE ACCESS TO NATO MATERIAL ON THIS CONTRACT PER CNO LTR 5510 SER N09N2/11U213075 DTD 9 SEP 11 THIS INFORMATION IS NOT REQUIRED TO BE ENTERED INTO JPAS. THE CONTRACTOR SHALL COMPLETE DERIVATIVE CLASSIFICATION TRAINING PRIOR TO BEING GRANTED ACCESS TO SIPRNET; TRAINING PROVIDED BY THE FACILITY SECURITY

OFFICER.

ALL CLASSIFIED INFORMATION MUST BE MARKED IN ACCORDANCE WITH EXECUTIVE ORDER 13526, CLASSIFIED NATIONAL SECURITY INFORMATION, OF 29 DECEMBER 2009. YOUR DEFENSE SECURITY SERVICE (DSS) INDUSTRIAL SECURITY

REPRESENTATIVE (IS REP) SHOULD BE CONTACTED FOR ASSISTANCE.

COPIES OF ALL SUBCONTRACT DD FORM 254S MUST BE PROVIDED TO THE DISTRIBUTION LISTED IN BLOCK 17.

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. YES NO

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement that identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

SPECIFIC ON-SITE SECURITY REQUIREMENTS ARE ATTACHED AND MUST BE PASSED TO ALL SUBCONTRACTORS.

- ATTACHMENT A - SPECIFIC ON-SITE SECURITY REQUIREMENTS.

- ATTACHMENT B - INFORMATION TECHNOLOGY (IT) SYSTEMS PERSONNEL SECURITY PROGRAM REQUIREMENTS.

- ATTACHMENT C - FOR OFFICIAL USE ONLY (FOUO) GUIDANCE.

- ATTACHMENT D - PERSONALLY IDENTIFIABLE INFORMATION (PII) RESPONSIBILITIES.

- ATTACHMENT E - OPERATIONAL SECURITY (OPSEC) REQUIREMENTS.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. YES NO

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

ALICIA RHAMY

ALICIA.RHAMY@NAVY.MIL

b. TITLE

SECURITY’S CONTRACTING OFFICER’S

REPRESENTATIVE (COR)

c. TELEPHONE (Include Area Code)

(619) 221-7638

d. ADDRESS (Include Zip Code)

COMMANDER

SPACE AND NAVAL WARFARE SYSTEMS COMMAND

4301 PACIFIC HIGHWAY

SAN DIEGO, CA 92110-3127

17. REQUIRED DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER SPAWAR CODE 2.1 (SADE)

f. OTHERS AS NECESSARY CODES 8.3.3, DD FORM 254 (BACK), DEC 1999 SPAWAR (O/P) 5500/3 (REV. 6-2006) (BACK)

SOLICITATION NUMBER N00039-17-R-0002

BLOCK 13 CONTINUATION: PAGE 3 OF 3

11.A CONTRACT PERFORMANCE IS RESTRICTED TO PEO EIS SPACES AT THE WASHINGTON NAVY YARD. PEO EIS WILL PROVIDE

SECURITY CLASSIFICATION GUIDANCE FOR PERFORMANCE OF THIS CONTRACT.

11.L CONTRACTORS RECEIVING, TRANSMITTING OR ACCESSING CONTROLLED UNCLASSIFIED INFORMATION (CUI) ON OR THROUGH ITS CONTRACTOR INFORMATION SYSTEM(S) MUST SAFEGUARD THE INFORMATION TO AVOID COMPROMISE, INCLUDING BUT NOT LIMITED TO DISCLOSURE OF INFORMATION TO UNAUTHORIZED PERSONS, UNAUTHORIZED MODIFICATION, DESTRUCTION, OR LOSS OF AN OBJECT, OR THE COPYING OF INFORMATION TO UNAUTHORIZED MEDIA, AS REQUIRED PER DFARS SUBPART 204.73 AND CLAUSES 204.7304 AND 252.204-7012. CONTRACTORS SHALL REPORT TO THE DOD EACH CYBER INCIDENT THAT AFFECTS UNCLASSIFIED CONTROLLED TECHNICAL INFORMATION RESIDENT ON OR TRANSITING CONTRACTOR INFORMATION SYSTEMS IN ACCORDANCE WITH DFARS CLAUSE 204.7304 AND 252.204-7012. DETAILED REPORTING CRITERIA AND REQUIREMENTS ARE SET FORTH IN THE CLAUSE AT 252.204-7012, SAFEGUARDING OF UNCLASSIFIED CONTROLLED TECHNICAL INFORMATION.

THE CONTRACTING OFFICER’S REPRESENTATIVE (COR) OR TECHNICAL REPRESENTATIVE (TR) WILL SPECIFY WHICH POSITIONS

REQUIRE CLEARANCE.

NO FURTHER ENTRIES ON THIS PAGE.

ATTACHMENT A

SPECIFIC ON-SITE SECURITY REQUIREMENTS

GENERAL.

Contractor Performance. In performance of this contract, the following security services and procedures are incorporated as an attachment to the DD Form 254. The Contractor will conform to the requirements of DoD 5220.22-M, Department of Defense National Industrial Security Program, Operating Manual (NISPOM). When visiting any Government installation, the Contractor must abide by the security requirements of the facility. Additionally, the Contractor will comply with the security directives used regarding the protection of classified and controlled unclassified information, SECNAVINST 5510.36 (series), SECNAVINST 5510.30 (series), and NRADINST 5720.1(series). Both of the SECNAV

Instructions are available online at http://neds.nebt.daps.mil/. If the Contractor establishes a cleared facility or Defense

Security Service (DSS) approved off-site location, the security provisions of the NISPOM will be followed within this cleared facility.

HANDLING CLASSIFIED MATERIAL OR INFORMATION.

Control and Safeguarding. Contractor personnel are responsible for the control and safeguarding of all classified material in their possession. All contractor personnel will be briefed by their FSO on their individual responsibilities to safeguard classified material. In the event of possible or actual loss or compromise of classified material, the Contractor will immediately report the incident to the organization that they are assigned to per incident notification procedures after which the contractor shall notify the PMW-220 Program Security office. In addition to any command directed investigation, a PMW-220 Program Security representative will review the circumstances and report results of the inquiry to the FSO and the Cognizant DSS Field Office. The Contractor will promptly correct any deficient security conditions identified in coordination with the organization with which they are assigned.

Storage.

• Classified material may be stored in containers authorized by SPAWAR Security Management for the storage of that level of classified material. Classified material may also be stored in Contractor owned containers with SPAWAR

Security Managers written permission.

• The use of Open Storage areas must be pre-approved in writing by SPAWAR Security Managers for the open storage, or processing, of classified material. Specific supplemental security controls for open storage areas, when required, will be provided by SPAWAR security managers.

INFORMATION ASSURANCE (IA) SECURITY.

Contractors using IT, networks, or computer resources to process classified, sensitive unclassified and/or unclassified information will comply with the provisions of SECNAVINST 5239.3 (series) and local policies and procedures. Also see: INFORMATION TECHNOLOGY (IT) SYSTEMS PERSONNEL SECURITY PROGRAM REQUIREMENTS section below.

VISITOR CONTROL PROCEDURES.

Title 18 USC 701 provides for criminal sanctions including fine or imprisonment for anyone in possession of a badge who is not entitled to have possession. Whoever manufactures, sells, or possesses any badge, identification card, or other insignia, of the design prescribed by the head of any department or agency of the United States for use by any officer or employee thereof, or any colorable imitation thereof, or photographs, prints, or in any other manner makes or executes any engraving, photograph, print, or impression in the likeness of any such badge, identification card, or other insignia, or any colorable imitation thereof, except as authorized under regulations made pursuant to law, shall be fined under this title or imprisoned not more than six months, or both.

Contractors that have been awarded a classified contract must submit visit requests using the JPAS. All Government activities have been directed to use JPAS when transmitting or receiving VALs. Therefore, contractors who work on classified contracts are required to have established an account through JPAS for their facility. This database contains all

U.S. citizens who have received a clearance of Confidential, Secret, and/or Top Secret. The visit request can be submitted for one year. This information is provided in accordance with guidance provided to contractors via the Defense Security

Service (DSS) website https://www.dss.mil/ (DSS guidance dated 24 April 2007, subject: Procedures Governing the Use of JPAS by Cleared Contractors).

Upon termination of a Contractor employee with any access badge, Common Access Card (CAC), Navy Commercial

Access Control System (NCACS) authorization, or active VAL on file, the FSO must:

• Notify by telephone, as soon as practicable, the PMW-220 Program Security office. Additionally, within 5 working days of any termination, notify in writing the PMW-220 Program Security office, the Security COR, and the managers of any facilities to which the employee had been granted unescorted access of the termination and effective date of termination.

• Immediately confiscate any Government issued identification badge, (to include CAC and any building access badges, if issued), sign and send a “Termination letter” within 24 hours to the PMW-220 Program Security office to document the collection. Return confiscated items no later than five business days after the effective date of the termination to issuing authority. Confiscate all vehicle decals and parking permits and return them to Unit/Organization entry control.

INSPECTIONS.

PMW-220 Program Security personnel may conduct routine and periodic inspections of the security practices of the

Contractor. All contractor personnel will cooperate with Government representatives during these inspections. A report of the inspection will be forwarded to the Contractor and Contracting Officer. The Contractor must be responsive to the

Inspectors findings in a timely manner not to exceed 10 days.

Oversight personnel will conduct surveillance of contractor processes and contract data artifacts IAW NEN INST

5510.1A Contract Security Oversight Program to determine contractor adherence to DoN Security Standards and NGEN contract security performance requirements.

REPORTS.

In addition to the reports required by the NISPOM, Chapter 1, Section 3, Contractors are required to report the following events to the Contracting Officer and the PMW-220 Program Security office. All references should read: PEO-

EIS/PMW-220 Program Security or NEN Security Team

• The denial, suspension, or revocation of security clearance of any assigned personnel;

• Any adverse information on an assigned employee's continued suitability for continued access to classified information;

• Any instance of loss or compromise, or suspected loss or compromise, of classified information;

• Actual, probable or possible espionage, sabotage, or subversive information; or

• Any other circumstances of a security nature that would affect the contractor's performance of the contract.

In addition to the NISPOM reporting requirements, any conviction and/or violation of the Foreign Corrupt Practices Act, or any other violation of the International Traffic in Arms Regulations (ITAR) shall immediately be reported to the

Designated Disclosure Authority (DDA) and Contracting Officer.

PHYSICAL SECURITY.

Contractors must comply with installation access control procedures. Any contractor who repeatedly violates access control requirements will be issued an Apparent Security Violation (ASV). After the ASV has been investigated, a letter will be forwarded to the contracting facility’s Security Officer via the Contracting Officer for resolution.

PROGRAM OFFICE RESPONSIBILITIES.

Review requests by cleared contractors for retention of classified information beyond a two-year period and advise the contractor of disposition instructions and/or submit a Final DD Form 254 to the Security’s COR.

In conjunction with the appropriate transportation element, coordinates a suitable method of shipment for classified material when required.

Certify and approve Registration for Scientific and Technical Information Services requests (DD 1540) (DTIC).

Ensure timely notice of contract award is given to host commands when Contractor performance is required at other locations.

Certify need-to-know on visit requests and conference registration forms.

Manage and conduct the NEN Security Contract Security Oversight Program (CSOP).

ATTACHMENT B

INFORMATION TECHNOLOGY (IT) SYSTEMS: PERSONNEL SECURITY PROGRAM REQUIREMENTS

Applicable guides:

• DoD 5200.2-R, Personnel Security Program (PSP)

• DoD Directive 8500.1, Information Assurance (IA)

• DoD 5200.1-R, Information Security Program (ISP)

• DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM)

• DoD 5200.1 Vol.3, Protection of Classified Information

• SECNAVINST 5510.36 (series), DON Information Security Program (ISP)

• SECNAVINST 5510.30 (series), DON Personnel Security Program (PSP)

• SECNAVINST 5239.3 (series), DON Information Assurance Program (IA)

• DoD 5105.21-M-1, Sensitive Compartmented Information Administrative Security Manual (SCI)

• National Security Decision Directive 298, National Operations Security Program (OPSEC)

• DoD 5205.02, DoD Operations Security Manual (OPSEC)

• OPNAVINST 3432.1, Operations Security (OPSEC)

• SPAWARINST 3432.1, Operations Security Policy (OPSEC)

• NSA Industrial COMSEC Manual, NSA/CSS Policy Manual 3-16 (COMSEC)

• SECNAVINST 5211.5E, DON Privacy Program

• NEN 5500.1 (Series), Contract Security Oversight Program (CSOP)

The U.S. Government conducts trustworthiness investigations of personnel who are assigned to positions that directly or indirectly affect the operation of unclassified IT resources, and systems that process Department of Defense (DoD) information, to include For Official Use Only (FOUO), and other controlled unclassified information (CUI).

The United States Office of Personnel Management (OPM), and the Federal Investigations Processing Center (FIPC) process all requests for U.S. Government trustworthiness investigations. Requirements for these investigations are outlined in paragraph C3.6.15, and Appendix 10 of DoD 5200.2-R.

Designating Positions/Position Categories and Assigning IT Levels

DoDD Directive 8500.1, Subject: Information Assurance (IA), paragraph 4.8 states "Access to all DoD information systems shall be based on a demonstrated need-to-know, and granted in accordance with applicable laws and DoD

5200.2R for background investigations, special access and IT position designations and requirements. (Note: Terminology used in DoD 5200.2R references “ADP” vice “IT”. For purposes of this requirement, the terms ADP and IT are synonymous.).

An appropriate security clearance and non-disclosure agreement are also required for access to classified information in accordance with DoD 5200.1-R" DoD 5200.2R and DoDD 5200.2 require all persons assigned to sensitive positions or assigned to sensitive duties be U.S. citizens.

IAW DoD Instructions, all persons assigned to IT-I and IT-II positions, as well as all persons with access to controlled unclassified information (without regard to degree of IT access) or performing other duties that are considered "sensitive" as defined in DoDD 5200.2 and DoD 5200.2R must be U.S. citizens. Furthermore, access by non-U.S. citizens to unclassified export controlled data will only be granted to persons pursuant to the export control laws of the U.S. The categories of controlled unclassified information are contained in Appendix 3 of DoD 5200.1R. These same restrictions apply to "Representatives of a Foreign Interest" as defined by DoD 5220.22-M (NISPOM).

IAW the above guidance, contract and oversight requirements, the contractor shall:

• Designate IT Positions or Position Categories and associate an IT Level (IT-I, IT-II, IT-III) to those positions or position categories IAW DoD 5200.2-R referencing SPAWAR clarification guidance provided in this DD Form 254

(subject to periodic update).

• Submit all IT position categories and associated IT Levels to the PMO for review and approval (via email) to the

APM Program Security (NGEN Security Manager), initially, and as needed. NOTE: The positions/position categories/IT

Level nominations (with individual criterion) will be reviewed for approval by the PMW-205 PM (or designated staff) within 90 days of submission of position(s) to the PMO. Contractor will consult as needed with government network counterparts and PMO to determine criterion. Changes to positions or position categories and IT Level designations not yet approved must be submitted for review and approval as needed. PMO will maintain an approved list (including nominations criteria) which will be reviewed with contractor annually.

Criteria For Designating Positions

Criteria For Designating Positions: updated per OPM Federal Investigations Notice No. 16-02, dated October 6, 2015:

Tier 5/5R is for Top Secret and/or SCI – Critical or Special Sensitive Positions = IT-I Position (Privileged)

• Responsibility or the development and administration of Government computer security programs, and including direction and control of risk analysis an/or threat assessment.

• Significant involvement in life-critical or mission-critical systems.

• Responsibility for the preparation or approval of data for input into a system, which does not necessarily involve personal access to the system, but with relatively high risk for effecting grave damage or realizing significant personal gain.

• Relatively high risk assignments associated with or directly involving the accounting, disbursement, or authorization for disbursement from systems of (1) dollar amounts of $10 million per year or greater, or (2) lesser amounts if the activities of the individual are not subject to technical review by higher authority in the IT-I category to ensure the integrity of the system.

• Positions involving major responsibility for the direction, planning, design, testing, maintenance, operation, monitoring, and/or management of systems hardware and software.

• Other positions as designated by Space and Naval Warfare Systems Center Pacific (SSC Pacific) that involve relatively high risk for effecting grave damage or realizing significant personal gain.

Personnel whose duties meet the criteria for IT-I Position designation require a favorably adjudicated Single Scope

Background Investigation (SSBI) or SSBI Periodic Reinvestigation (SSBI-PR) or Tier 5/5R. The SSBI or SSBI-PR or

Tier 5/5R shall be updated every 5 years by using the Electronic Questionnaire for Investigation Processing (eQIP) web based program (SF86 format).

Tier 3/3R is for Secret – Non Critical Sensitive positions = IT-II Position (Limited Privileged)

Responsibility for systems design, operation, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the IT-I category, includes but is not limited to:

• Access to and/or processing of proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts;

• Accounting, disbursement, or authorization for disbursement from systems of dollar amounts less than $10 million per year. Other positions are designated by Space and Naval Warfare Systems Center Pacific (SSC Pacific) that involve a degree of access to a system that creates a significant potential for damage or personal gain less than that in IT-I positions. Personnel whose duties meet the criteria for an IT-II Position require a favorably adjudicated National Agency

Check with Local Agency Check and Credit Check (NACLC) or Tier 3/3R.

Tier 1/1R is for Unclassified – Non-Sensitive positions = IT-III Position (Non-Privileged)

• All other positions involving Federal IT activities. Incumbent in this position has non-privileged access to one or more DoD information systems, application, or database to which they are authorized access. Personnel whose duties meet the criteria for an IT-III Position designation require a favorably adjudicated National Agency Check with Inquiries

(NACI) or Tier 1/1R.

Qualified Cleared Personnel Do NOT Require Trustworthiness Investigations:

When background investigations supporting clearance eligibility have been submitted and/or adjudicated to support assignment to sensitive national security positions, a separate investigation to support IT access will normally not be required. A determination that an individual is NOT eligible for assignment to a position of trust will also result in the removal of eligibility for security clearance. Likewise, a determination that an individual is NOT eligible for a security clearance will result in the denial of eligibility for a position of trust.

Procedures for submitting U.S. Government Trustworthiness Investigations:

Only the e-QIP version of SF-85 and SF 86 are acceptable by OPM-FIPC.

The Facility Security Officer (FSO) must verify employee's security clearance eligibility in the Joint Personnel

Adjudication System (JPAS) before contacting SSC Pacific Personnel Security Office to initiate request for trustworthiness investigations.

After determining that an individual requires Public Trust Position determination, the FSO will identify the individual to the SSC Pacific Personnel Security Office and the specific IT Level category assigned for requesting the appropriate type of investigation. The FSO will also provide the following information to the SSC Pacific Personnel Security Office to initiate a request thru e-QIP:

Full SSN of the applicant

Full Name

Date of Birth

Place of Birth

Email Address

Phone Number

The Personnel Security Office will send email notification and instruction to the applicant to complete and submit e-QIP expeditiously.

The FSO or SSC Pacific Personnel Security Office will take and submit fingerprints using SF-87, FD-258 or electronic submission. The FSO must obtain from SSC Pacific Personnel Security Office the e-QIP Request Number for inclusion in submitting the fingerprints. For immediate fingerprint result, electronic transmission of fingerprints is encouraged.

Submission of hard copy SF-87 or FD-258 is acceptable until 2013 to:

E-QIP RAPID RESPONSE TEAM

OPM-FIPC

1137 BRANCHTON ROAD

BOYERS, PA 16020

SSC Pacific Personnel Security Office will notify the FSO when the Public Trust Investigation request is released to the

Parent Agency, the Office of Personnel Management (OPM).

Contractor fitness determinations made by the DOD CAF are maintained in the Joint Personnel Adjudication System

(JPAS). Favorable fitness determinations will support public trust positions only and not national security eligibility. If no issues are discovered, according to respective guidelines a “Favorable Determination” will be populated in JPAS and will be reciprocal within DoN. If issues are discovered, the DOD CAF will forward the investigation along with all supporting documentation to the SSC Pacific Security Office for local determination. The local fitness determination will be made by the Command Security Manager and your company will be notified of the decision in writing. If an individual received a negative trustworthiness determination, they will be immediately removed from their position of trust, the contractor will follow the same employee termination processing above, and they will replace any individual who has received a negative trustworthiness determination.

If you require additional assistance with the submission of Public Trust Investigations, you may send an email to SSC

Pacific at W_SPSC_SSC_PAC_clearance US@navy.mil.

ATTACHMENT C

FOR OFFICIAL USE ONLY (FOUO) INFORMATION REQUIREMENTS

The FOUO marking is assigned to information at the time of its creation. It is not authorized as a substitute for a security classification marking, but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA). The following minimum guidance is provided:

• Use of FOUO markings does not mean that the information cannot be released to the public, only that it must be reviewed by SPAWAR Security prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

• An UNCLASSIFIED document containing FOUO information will be marked "FOR OFFICIAL USE ONLY" on the bottom face and interior pages.

• Classified documents containing FOUO do not require any markings on the face of the document; however, the interior pages containing only FOUO information shall be marked top and bottom center with "FOR OFFICIAL USE

ONLY." Mark only unclassified portions containing FOUO with "(FOUO)" immediately before the portion.

• Any FOUO information released to you by SPAWAR or PEO EIS is required to be marked with the following statement prior to transfer:

“THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY DISCLOSURE UNDER THE

FOIA EXEMPTION(S) ___________ APPLY. Removal of the FOUO marking can only be accomplished by the originator or other competent authority. DO NOT REMOVE ANY FOUO MARKING WITHOUT WRITTEN

AUTHORIZATION FROM SPAWAR OR THE AUTHOR. When the FOUO status is terminated, you will be notified.”

• You may disseminate FOUO information to your employees and subcontractors who have a need for the information in connection with this contract.

• During working hours, reasonable steps should be taken to minimize risk of access by unauthorized personnel.

FOUO information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored in locked desks, file cabinets, bookcases, locked rooms, or similar items.

• FOUO information may be transmitted via first-class mail, parcel post, fourth-class mail for bulk shipments only.

• When no longer needed, FOUO information may be disposed by tearing each copy into pieces to preclude reconstructing and placing it in a regular trash, recycle container, or in the uncontrolled burn.

• Unauthorized disclosure of FOUO information does not constitute a security violation, but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the

Privacy Act may result in criminal sanctions.

• Electronic transmission of FOUO information (voice, data, or facsimile) should be by approved secure communications systems whenever practical.

• To obtain FOUO guidance refer to the DoD Information Security Program Regulation, DoD 5200.1-r, appendix 3, located at http://www.dtic.mil.

ATTACHMENT D

PERSONALLY IDENTIFIABLE INFORMATION (PII) REQUIREMENTS

Applicable guide: SECNAVINST 5211.5E, Department of the Navy (DON) Privacy Program.

The Contractor is responsible for safeguarding the rights of others by:

• Ensuring that PII contained in a system of records, to which they have access or are using to conduct official business, is protected so that the security and confidentiality of the information is preserved.

• Not disclosing any information contained in a system of records by any means of communication to any person or agency, except as authorized by SECNAVINST 5211.5E or the specific PA systems of records notice.

• Not maintaining unpublished official files that would fall under the provisions of reference 5 U.S.C. 552a.

• Safeguarding the privacy of individuals and confidentiality of PII contained in a system of records.

• Properly marking all documents containing PII data (e.g., letters, emails, message traffic, etc.) as “FOR

OFFICIAL USE ONLY – PRIVACY SENSITIVE – Any misuse or unauthorized disclosure can result in both civil and criminal penalties.”

• Not maintaining privacy sensitive information in public folders.

• Reporting any unauthorized disclosure of PII from a system of records to the APM Program Security, NEN

Program Office, and organization assigned.

• Reporting the maintenance of any unauthorized systems of records to APM Program Security, NEN Program

Office and organization assigned.

NOTE: SECNAVINST 5211.5E uses the old term “PPI.” It has been updated to PII for use in this document.

ATTACHMENT E

OPERATIONS SECURITY (OPSEC) REQUIREMENTS

All work is to be performed in accordance with DoD and Navy Operations Security (OPSEC) requirements, per the following applicable documents:

• National Security Decision Directive 298, National Operations Security Program (NSDD) 298

• DOD 5220.02, DOD Operations Security (OPSEC) Program Manual

• OPNAVINST 3432.1, Operations Security

• SPAWARINST 3432.1,Operations Security (OPSEC) Policy

The Contractor will accomplish the following minimum requirements in support of the Space and Naval Warfare Systems

Command (SPAWARSYSCOM) OPSEC Program:

• The Contractor will practice OPSEC and implement OPSEC countermeasures to protect DoD Critical

Information. Items of Critical Information are those facts, which individually, or in the aggregate, reveal sensitive details about SPAWARSYSCOM or the Contractor’s security or operations related to the support or performance of this

Statement of Work (SOW), and thus require a level of protection from adversarial collection or exploitation not normally afforded to unclassified information.

• Contractor must protect Critical Information and other sensitive unclassified information and activities, especially those activities or information which could compromise classified information or operations, or degrade the planning and execution of military operations performed or supported by the Contractor in support of the mission. Protection of

Critical Information will include the adherence to and execution of countermeasures which the Contractor is notified by or provided by SPAWARSYSCOM, for Critical Information on or related to the SOW.

• Sensitive unclassified information is that information marked FOR OFFICIAL USE ONLY (or FOUO), Privacy

Act of 1974, Company Proprietary, and information identified by SPAWARSYSCOM.

• SPAWARSYSCOM has identified the following items as Critical Information that may be related to this SOW:

o Known or probable vulnerabilities to any U.S. system and their direct support systems.

o Details of capabilities or limitations of any U.S. system that reveal or could reveal known or probable vulnerabilities of any U.S. system and their direct support systems.

o Details of information about military operations, missions, and exercises.

o Details of U.S. systems supporting combat operations (numbers of systems deployed, deployment timelines, locations, effectiveness, unique capabilities, etc.).

o Operational characteristics for new or modified weapon systems (Probability of Kill, Countermeasures, Survivability, etc.).

o Required performance characteristics of U.S. systems using leading edge or greater technology (new, modified, or existing).

o Telemetered or data-linked data or information from which operational characteristics can be inferred or derived.

o Test or evaluation information pertaining to schedules of events during which Critical Information might be captured. (advance greater than 3 days).

o Details of Team SPAWAR unique Test or Evaluation capabilities (disclosure of unique capabilities).

o Existence and/or details of intrusions into or attacks against DoD Networks or Information Systems, including, but not limited to, tactics, techniques and procedures used, network vulnerabilities exploited, and data targeted for exploitation.

o Network User ID’s and Passwords.

o Counter-IED capabilities and characteristics, including success or failure rates, damage assessments, advancements to existing or new capabilities.

o Vulnerabilities in Command processes, disclosure of which could allow someone to circumvent security, financial, personnel safety, or operations procedures.

o Force Protection specific capabilities or response protocols (timelines/equipment/numbers of personnel/training received/etc.).

o Command leadership and VIP agendas, reservations, plans/routes etc.

o Detailed facility maps or installation overhead photography (photo with annotation of Command areas or greater resolution than commercially available).

o Details of COOP, Team SPAWAR emergency evacuation procedures, or emergency recall procedures.

o Government personnel information that would reveal force structure and readiness (such as recall rosters or deployment lists).

o Compilations of information that directly disclose Command Critical Information.

The above Critical Information and any that the Contractor develops, regardless if in electronic or hardcopy form, must be protected by a minimum of the following countermeasures:

• All emails containing Critical Information must be DoD Public Key Infrastructure (PKI) signed and PKI encrypted when sent.

• Critical Information may not be sent via unclassified fax.

• Critical Information may not be discussed via non-secure phones.

• Critical Information may not be provided to individuals that do not have a need to know it in order to complete their assigned duties.

• Critical Information may not be disposed of in recycle bins or trash containers.

• Critical Information may not be left unattended in uncontrolled areas.

• Critical Information in general should be treated with the same care as FOUO or proprietary information.

• Critical Information must be destroyed in the same manner as FOUO.

• Critical Information must be destroyed at contract termination or returned to the government at the government’s discretion.

The Contractor shall document items of Critical Information that are applicable to Contractor operations involving information on or related to the SOW. Such determinations of Critical Information will be completed using the DoD

OPSEC 5 step process as described in National Security Decision Directive (NSDD) 298, “National Operations Security

Program”.

OPSEC training must be included as part of the Contractor’s ongoing security awareness program conducted in accordance with Chapter 3, Section 1, of the NISPOM. NSDD 298, DoD 5220.02, “DOD Operations Security (OPSEC)

Program”, and OPNAVINST 3432.1, “Operations Security” should be used to assist in creation or management of training curriculum.

If the Contractor cannot resolve an issue concerning OPSEC they will contact the APM Program Security, NEN Security

Manager and organization OPSEC security officer, who will consult with SPAWARSYSCOM HQ as needed.

All above requirements MUST be passed to all Sub-contractors.

Questions pertaining to the SPAWAR OPSEC Program should be directed to Grant Merkel, 619-553-2800, email grant.merkel@navy.mil .