Attachment_18_Contract_Security_Requirements.docx

Attachment 18

CONTRACT SECURITY REQUIREMENTS

Cybersecurity Directives:

(a) DoD Instruction 8500.01, Cybersecurity

(b) DoD Directive 8140.01, Cyberspace Workforce Management

(c) DoD Manual 8570.01-M, Information Assurance Workforce Improvement Program, Change 4

(d) SECNAV Instruction 5239.20, DON Cybersecurity/Information Assurance Workforce Management, Oversight and Compliance

(e) SECNAV M-5239.2, DON Information Assurance Workforce Management Manual

(f) SECNAV Instruction 1543.2 Cyberspace/Information Technology Workforce Continuous Learning

Industrial Security Directives:

(a) DoD 5220.22-M Change 1 (CH 1), National Industrial Security Program Operating Manual (NISPOM)

(b) DoDI 5220.22-R, Industrial Security Regulation

(c) DoDI 5220.22, National Industrial Security Program (NISP)

Information Security Directives:

(a) DoDM 5200.01 Vol. 1-4, DoD Information Security Program

(b) SECNAV M-5510.36, DON Information Security Program

(c) NAVSEAINST 5510.1C, Security Program Instruction

Privacy Act/PII Directives:

(a) OMB M-17-12, Preparing for and responding to a breach of Personally Identifiable Information

(b) DoDD 5400.11, DOD Privacy Program

(c) SECNAVINST 5211.5E, Department of the Navy (DON) Privacy Act (PA) Program

(d) NAVSEAINST 5211.2B, Naval Sea Systems Command Privacy Program

Communications Security Directives:

(a) DOD Instruction 8523.01, Communications Security (COMSEC)

(b) CNSSI 4005, Safeguarding Communication Security (COMSEC) Facilities and Materials

Personnel Security Directives:

(a) DoD Instruction 5200.02 Change 1, DoD Personnel Security Program

(b) SECNAV M-5510.30, DON Personnel Security Program

Operations Security Directives:

(a) DoDDIR 5205.02E, DoD Operations Security (OPSEC) Program

(b) SECNAVINST 3070.2, DON Operations Security (OPSEC) Program

(c) OPNAVINST 3432.1A, Operations Security

(d) NAVSEAINST 3432.1A, NAVSEASYSCOM Operations Security Policy Instruction

(e) NAVSEAINST 2200.1, NAVSEASYSCOM Photographic, Audible Recording and Portable Electronic Devices Policy

Physical Security Directives:

(a) DoD 5200.08-R, CH 1, Physical Security Program

Common Access Card (CAC) Directives:

(a) DoD Manual 1000.13, Volumes 1-2, DoD Identification (ID) Cards

(b) DoD Instruction 5200.46, DoD Investigative and Adjudicative Guidance for Issuing the Common Access Card

(c) FIPS Publication 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors

(d) CNO Ltr Ser N09N2/11U213200, DON Implementation of Homeland Security Presidential Directive

Homeland Security Presidential Directive (HSPD-12) requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006-DoD Implementation of HSPD-12 dated November 26, 2008 (or its subsequent Department of Defense instruction) directs implementation of HSPD-12. This section is in accordance with HSPD-12 and its implementing directives.

Contractors performing on Naval Undersea Warfare Center Division, Keyport (NUWCDIVKPT)/Naval Sea Logistics Center (NAVSEALOGCEN) contracts are required to successfully obtain and maintain (to include periodic reinvestigations) background investigations and clearances (if required) commensurate to contractor work performance and/or environment. Contract personnel investigation and adjudication records are subject to oversight by the Security Manager (SM) via the establishment of a “servicing” relationship with the records in the Joint Personnel Adjudication System (JPAS), Department of Defense (DoD) system of record for personnel security management. Contractor personnel unable to successfully obtain or maintain the appropriate investigation or necessary clearance shall immediately, upon notification from Facility Security Officer (FSO), will vacate the installation or performance location. The Contracting Officer, Contracting Officer’s Representative (COR) and the Security Contracting Officer shall be notified of any such vacancy.

APPLICIBILITY

These security requirements apply to contractor employees requiring physical access to any area of a federally controlled installation, facility or activity and/or requiring access to a Department of Navy (DON) or DoD computer/network/system to perform certain unclassified sensitive duties. These security requirements also apply to contractor employees who access Privacy Act Information of 1974, as amended in 5 U.S.C. 552a, and provide support associated with performing duties that have been identified by DON as National Security Position, as advised by the command security manager. It is the responsibility of the responsible Facility Security Officer/Representative of the command/facility where the work is performed to ensure compliance.

Each contractor employee providing services at a government site location and/or requires access to a DoN computer/system under this contract, is required to obtain a DoD Common Access Card (CAC). Additionally, depending on the level of computer/network access, the contractor employee will require a successful background investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled installation, facility, or activity under this section and who require access to a DoN Information Technology (IT) system will require a DoD CAC. When access to a military installation, facility or activity is required contractor employees shall in-process with the Command Security Manager upon arrival to the Command, and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

The contractor shall provide a personnel roster of all Prime and Subcontractor personnel and submit to the COR and Security Contracting Officer via e-mail no later than 30 business days following award which shall be updated monthly and when changes occur.

Access to Government facilities/installations is at the discretion of the Government. The Government reserves the right to rescind access at any time. In each instance when contractors are terminated, separated or the contract is at the end date, the Contractor Manager or FSO shall ensure the prompt return of any issued items to the Government issuer (e.g. Government property, Government-owned keys, CACs, and/or issued identification picture badges).

ACCESS TO DOD INFORMATION TECHNOLOGY SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as one of three levels. IT-I which is the Highest level designated as critical sensitive, IT-II designated as Non-critical sensitive, or IT-III designated as Non-sensitive. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act or other controlled unclassified information (CUI).

All contractor employees under this contract who require access to Privacy Act or CUI protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity's Command Information Systems Security Manager (ISSM).

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a fully adjudicated Single Scope Background Investigation (SSBI/T5) which is a higher level investigation than the National Agency Check with Law and Credit (NACLC/T3) described below.

Due to the privileged system access, a SSBI/T5 suitable for high risk public trust positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) identified by the ISSM will be required to complete all mandatory training prior to accessing or operating a DoN/DoD IT system.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Command Security Manager and ISSM upon arrival to the Command, and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; block 16 shall be signed by the COR or Contracting Officer.

The SAAR-N shall be forwarded to the Command Security Manager to allow a seven (7) day processing timeframe prior to the individual's start date. Failure to provide the required documentation in the specified amount of time may result in delaying the individual's ability to perform tasks related to computer access, and thus their ability to perform under this contract.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. The Contractor's Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Command Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network at the IT II level or below upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. If the final results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contracting company of their responsibility to provide appropriate personnel.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this section including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this section in all subcontracts when the subcontractor is permitted to have classified/unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

The Contractor FSO shall report reportable derogatory contractor information and behaviors that bring into question an individual’s trustworthiness, judgment, and reliability to protect classified information to the Department of Defense Central Adjudication Facility (DoD CAF) via a JPAS incident report in accordance with the National Industrial Security Program Operating Manual (NISPOM). Contractor shall also notify the Contracting Officer, COR, and Security Contracting Officer of such information or behavior. Upon receipt of derogatory information, the Contrating Officer will consult with the Commanding Officer and Security Manager to determine based on the facts, whether a contractor’s continued access to classified material, IT system, or government facility is in the best interest of the government. All contractor performance issues associated with the contract will only be addressed to the contracting company by the Contractor Officer.

Access to Government facilities/installations is at the discretion of the Government. The Government reserves the right to rescind access at any time. In each instance when contractor employees are terminated, separated or the contract is at the end date, the Contractor Manager or FSO shall ensure the prompt return of any issued items to the Government issuer (e.g. Government property, Government-owned keys, CACs, and/or issued identification picture badges).

Standards for Wearing CACs/Badges. Contractor employees who have been issued CACs and/or badges shall wear them at all times on outer garments above the waist and removed when exiting the installation. CACs or badges shall not be worn outside the installation nor used as personal identification.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor's Security Representative. Within three work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, Email address and phone number for the Contractor's Security Representative. The Contractor's Security Representative shall be the primary point of contact on any security matter. During contract performance, the Contractor's Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Security Contracting Officer.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES

The Command security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. The Command recognizes contractor employees under this contract as Non-critical Sensitive (IT-II) when the contract scope of work requires physical access to a federally controlled installation, facility, or activity and/or requiring access to a DoD computer/network, to perform unclassified but sensitive duties. At a minimum, each contractor employee must be a US citizen and a favorably completed NACLC/T3 to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The NACLC/T3 consists of a standard NAC and FBI fingerprint checks plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to have completed:

1. SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product)

2. Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

3. Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual's start date shall result in delaying the individual's start date. Background investigations shall be reinitiated as required ensuring investigations remain current (not exceeding 10 years) throughout the contract performance period. The Contractor's Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements, ALL contractor employees shall in-process with the Command Security Manager upon arrival to the organization, and shall out-process prior to their departure at the completion of the individual's performance under the contract. Employees requiring IT access shall also check-in and check-out with the Command ISSM. Completion and approval of a SAAR-N form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Command Security Manager at least 7 days prior to the individual’s start date. Failure to provide the required documentation at least 7 days prior to the individual's start date may result in delaying the individual's start date.

Contractor employees shall accurately complete the required investigative forms prior to submission to the Command Security Manager. The Command's Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM). Suitability/security issues identified by the Command Security Manager may render the contractor employee ineligible for the assignment. An unfavorable determination made by the Command is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Command Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DON CAF for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) to Security Managers Office (SMO) 655384, or a hard copy VAR directly from the contractor's Security Representative. Although the contractor will take JPAS “Owning” role over the contractor employee, the Command will take a JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee's performance under the contract.

COMMAND ALL SHRED POLICY

Contractor shall dispose of all unclassified paper whether generated within or received from outside sources through shredding or placement in a command designated shred bin on a daily basis to eliminate unauthorized disclosure of Privacy Act, PII, FOUO information, or other types of CUI. This includes but is not limited to reports, briefings, meeting notes, memos, sticky notes, user manuals, working papers, and operating instructions. Newspapers, magazines, and shipping/laminated paper can be placed in recycle bins only. Brown paper bags (burn bags) and recycle bins are not authorized for storing or accumulation of unclassified office paper.

GENERAL SECURITY REQUIREMENTS

Contractor employees embedded in government work spaces will be included in the command security education program per SECNAV M-5510.36 (11-4.2.a) and must complete prescribed DoD/DoN training requirements.

Subcontracting. Contractor shall immediately notify the Contracting Officer and Security Contracting Officer prior to subcontracting and submit a copy of the sub-contract DD254 if applicable.

Security Inspections. Command security inspections shall occur annually and the Department Heads and CORs shall be informed of inspection results. Security inspections will include all embedded contractor personnel working in government facilities. Unannounced security spot-checks of departments shall occur throughout the year and are at the discretion of the Government.

Foreign Interests. Contractors with defined Foreign Interests (a Facility that is owned, controlled, or influenced by foreign interests) will ensure adherence to DoD and DON regulations, directives and policies. Full disclosure to the Contracting Officer, COR, and Security Contracting Officer is required.