Appendix L.doc

NAVAIR National Guidance for Contractor Access to IT Resources

NAVAIR National Guidance for Contractor Access to IT Resources Ref: (a) Chief of Naval Operations letter Ser N09N2/8U223257 of 09 Oct 08

1. Background: Submission of a completed OPNAV FORM 5239/14 (SAAR-N), completion of Information Assurance (IA) awareness training, and applicable personnel security investigation requirements apply to all contractors who require access to Navy Information Technology (IT) resources {e.g. computers, laptops, PED/PDAs, NMCI, RDT&E networks, websites such as My NAVAIR, Navy Web servers requiring Common Access (CAC) Public Key Infrastructure (PKI), etc.}. Contracts involving DON IT systems or duties requiring access to Government IT networks or other resources will incorporate these security requirements.

2. Eligibility: U.S. contractors are obligated to supply a U.S citizen when contracted services require IT access to any sensitive DOD/DON data. Employees of Foreign Owned Controlled or Influenced (FOCI) companies are considered Foreign Representatives regardless of the individual’s citizenship status.

a. At a minimum, contractors who require access to any Government IT networks or other resources which contain classified or sensitive unclassified information, and are assigned as a System Administrator, shall be designated IT-1. All other contractor personnel not designated as IT-1, but who require access to Government IT networks or other resources containing classified (SECRET or below), or sensitive unclassified information shall be designated IT-2. Although Article 120.15 of the ITAR defines a lawful permanent resident as a U.S. person, these individuals DO NOT meet the U.S. citizenship requirements specified in SECNAV M-5510.30B, Section 5 for IT-1 or IT-2 access.

b. IT access which is strictly limited to information approved for public release is designated IT-3. FN contractors are eligible for IT-3 access. However, IT-3 access is dependant upon very rigorous IT controls to remain non-sensitive. There are few IT-3 contractor positions supporting NAVAIR, the NAWCS, PEOs, Depots or Field Activities. User access at the IT-3 level requires positive IT User access controls which:

(1) Preclude access to system security and network defense systems, or to system resources;

(2) Preclude visual access to industrial proprietary data, Personally Identifiable Information (PII) requiring protection under the Privacy Act of 1974, Government-developed privileged information involving the award of contracts, and other protected sensitive information. “View only” access to company proprietary information by employees of that company is permitted. Ex: view only access to Boeing proprietary information is permitted to Boeing employees at the IT-3 level.

(3) Preclude ability to input, delete or otherwise manipulate protected sensitive information. Ex: access to industry proprietary information contained within a Government system is designated IT-2 when the individual user has the ability to enter, update, delete or otherwise modify the information in the government IT system.

3. Contractors with an existing investigation:

a. Contractors shall complete Part I and Blocks 25 thru 32 of the SAAR-N. System Name block shall be filled in with the name of each specific IT system access is required; “ALL GOVERNMENT IT SYSTEMS” is not acceptable for contractors.

b. Contractors shall coordinate IT levels in Block 33c with the Contracting Officer’s Representative (COR), and contact the Security Office servicing the individual for further guidance if required.

c. Contractors shall submit SAAR-N to the company Facility Security Officer (FSO), who shall utilize the information in JPAS to complete Part III of the SAAR-N, and submit SAAR-N to the Contracting Officers Representative (COR).

d. COR shall complete Part II of the SAAR-N form. Block 14 of the SAAR shall be filled in with the words, “Access to Government IT Systems is needed to execute duties as assigned.” The COR shall submit SAAR-N to their site IAM.

4. Contractors without an existing investigation: The NAVAIR, NAWC, Depot or Field Activity which the contractor is supporting, is responsible for non-National Industrial Security Program (NISP) adjudications for contractor trustworthiness determinations, per SECNAV M5510.30B, Section 6-7. Per reference (a), the Department of the Navy Central Adjudication Facility (DONCAF) will adjudicate contractor investigations for public trust positions for U.S. citizens in IT-II and IT-III positions. Contractor fitness determinations made by the DONCAF will be maintained in the Joint Personnel Adjudication System (JPAS). The company FSO is responsible to initiate National Agency Check with Local Agency Check and Credit Checks (NACLC) Personal Security Investigations (PSI) required to make trustworthiness determinations.

a. As in paragraph 3 above, the contractor shall complete Part I and Blocks 25 thru 32 of the SAAR-N, and submit to the company FSO with an SF-85P (Questionnaire for Public Trust Positions) and fingerprint card.

b. Utilizing the guidelines in Appendix-G of SECNAV M-5510.30B, the FSO shall review the information disclosed on the 85P to determine if there is any derogatory information which could preclude the individual from having access to DON IT systems.

(1) If the individual is found suitable, the FSO shall submit the SF-85P and fingerprint card to Office of Personnel Management (OPM) to initiate a National Agency Check with Local Agency Check and Credit Checks (NACLC) investigation. The “Agency Use Only” portion of the SF 85P should be completed in accordance with the directions provided in reference (a).

Record the sponsoring NAVAIR, NAWC, PEO, Depot or Field Activity’s “Security Officer Number” (SON) number, in Block J of the 85P. FSO’s should contact the Command Security Manager to obtain the correct number. At PAX River/Webster Field, the SON is 2299. Block L (SOI) is N180.

(2) The FSO may not complete the SAAR-N form and submit if the 85P indicated the individual may be unsuitable for IT access. In that case, IT Access is denied/terminated until OPM provides the investigation results to NAVAIR and NAVAIR makes a suitable adjudication.

c. FSO shall complete Part III of the SAAR-N as follows:

(1) Block 33. Type of Investigation: NACLC

(2) Block 33a. Date of Investigation: Date submitted to OPM

(3) Block 33b. Clearance Level: UNCLASS

(4) Block 33c. IT Level Designation: Coordinated with COR

(5) Blocks 34 thru 37: FSO contact information and signature

d. FSO submit SAAR-N to the COR with a copy of the SF-85P attached.

e. COR shall complete Part II of the SAAR-N form and submit to designated collection points with SF-85P attached.

f. Site security office shall maintain a copy of the SF-85P until a determination is annotated in JPAS by DONCAF or the investigation is returned to the command for a final determination. Once the results are received, security will notify the company of the results. IT access will be terminated for those personnel who are found unsuitable.

5. Companies without an FSO:

a. The contractor shall submit their documentation to the COR.

b. COR shall complete Part II and Block 33c of the SAAR-N form and submit (with SF-85P and fingerprint card if required), to their site IAM.

c. NAVAIR/NAWC/Depot/Field Activity Security Office shall:

(1) if required initiate the NACLC investigation

(2) screen the 85P to determine if interim IT access may be granted

(3) complete Part III of the SAAR-N when interim IT access is granted.

(4) make a final determination and notify the company of the results once OPM investigation results are received. Interim IT access will be terminated for those personnel who are found unsuitable.

Enclosure (2) Enclosure (2)