Security.docx

SECURITY

8.1 Security Clearances and Investigations. All personnel shall obtain and maintain background investigations and (if necessary) clearances appropriate to support contract performance. Clearances shall be maintained for the duration of this procurement. Personnel unable to successfully obtain or maintain an appropriate investigation or necessary clearance will immediately, upon notification from Facility Security Officer (FSO), be expected to vacate the installation or performance location. The department manager, designated Subject Matter Expert (SME) and security office will also be notified of any such vacancy.

8.2 Clearance Lists. A list of personnel and their security clearances shall be delivered to the (NSWCCORDIV) security office and SME no later than 20 business days following award and shall be updated with the monthly personnel listing deliverable and when personnel changes occur.

8.2.1 Personnel Lists. Contractor will provide government a personnel list on company letterhead signed by competent authority/manager of all (prime and sub) personnel performing on the contract. This list will also be reconciled and forwarded to the NSWCCORDIV security office as changes occur. A preferred template example not containing PII is available from the SME or security office.

8.3 Contractors will immediately notify the SME of any subcontracting.

8.4 General Security Compliance. Contractor personnel shall comply with all DoD, DoN, NAVSEA, NSWCCORDIV, and other performance location’s security instructions, policies, procedures and guidance. These requirements apply both on and off Government property at NSWC Corona, remote sites or travel destinations, to include any established check-in / check-out procedures of personnel occupying Government facilities.

8.5 System Authorization Access Request (SAAR-N) The Contractor shall complete/sign Classified and Unclassified User Authorization Agreements as applicable, using OPNAV 5239/14 SAAR-N forms, and Privileged Access Agreements. Contractor personnel shall complete the DoD Annual Information Awareness training prior to being granted access to government IT systems and must indicate on the OPNAV 5239/14 SAAR-N, the IA training completion date. The Contractor shall submit a copy of their IA training certificates to the NSWCCORDIV SME.

8.6 Security Inspections. Security Inspections (to include Industrial) will occur a minimum of once per year.

Department Manager and FSO will be informed of results. Inspections will also typically involve interaction with 2- 3 contractor employees. Brief unannounced spot-checks of department occur throughout the year and are at the discretion of the government.

8.7 Foreign Interests. Contractors with defined Foreign Interests (a Facility that is owned, controlled, or influenced by foreign interests) will ensure adherence to DoD and Navy regulations. Full disclosure to the Corona Contracting Officer, SME and security office is mandated.

8.8 Training. Personnel will participate in Annual Security Refresher Brief, New Employee Security Brief, and Annual Counter-Intelligence Brief. FSO will be given initial orientation training either in person or electronically of installation concept of operations as relative to the contract.

8.9 Emergency Management. Employees are expected to register Regional (AtHoc) Emergency Notification System. Contractors will follow Corona emergency preparedness and antiterrorism protocol during designated command emergencies and declared threat conditions.

8.10 Common Access Cards (CACs). CAC issuance is at the discretion of the Government and will only be to personnel who meet at least one of the three following criteria:

1) The individual requires both access to a DoD facility and logon access to DoD networks on site or remotely.

2) The applicant requires remote access to DoD networks that use only the CAC logon for user authentication.

3) The applicant requires frequent access to a DoD network to perform volunteer duties (volunteers only).

8.11 Government Facilities. Access to Government facilities is at the discretion of the Government. The Government reserves the right to rescind access at any time. In each instance when employees no longer work for a company due to circumstances favorable or unfavorable, the FSO shall ensure the prompt return of the following materials:

1) Government-owned keys to desks, offices, etc.

2) CAC, except for CACs issued to retired military personnel and retired civil servants on that basis.

3) Base Passes, except for passes issued to retired military personnel and retired civil servants on that basis

4) Base stickers for the employee’s vehicle, except for stickers issued to retired military personnel and retired civil servants on that basis

5) Government Furnished Equipment (GFE) and Government Furnished Information (GFI), with special attention to Information Technology (IT) equipment, Critical Information (CI), and Critical Program Information (CPI). In executing the provisions above, the contractor may collect the materials listed in that paragraph and return them to the custody of an appropriate Government employee or direct the contractor employee to surrender these items to the security office, whichever is appropriate to the circumstances.

8.12 Isolated Personnel Reporting. Contractor personnel traveling overseas shall contact the Antiterrorism Officer and if required, complete all mandated Foreign Travel requirements.

8.13 Information protection will occur as per any applicable governing directives.

8.14 Contractor personnel granted access to the NMCI network will be required to complete Navy Information Assurance (IA) or comparable training, at the Government’s discretion, and complete and sign appropriate IA forms required to be granted continued access to Government information technology networks. All IA security concerns will be directed to the Information Assurance Manager.

8.15 Operations Security. Background, Operations Security (OPSEC) is a process for protecting unclassified sensitive information from exploitation by an adversary. Sensitive unclassified information – which is also referred to as CI or CPI – is defined as information that is not classified but which needs to be protected from unauthorized disclosure. Examples are information labeled “For Official Use Only (FOUO),” proprietary information, contractor sensitive information, limited distribution information, and Personally Identifiable Information (PII).

8.15.1 The contractor and all subcontractors shall provide OPSEC protection for sensitive unclassified information as identified in the CI List (see below) paragraphs and CPI List, if applicable. The prime contractor and all subcontractors shall employ the countermeasures listed below in order to protect that information. Additional countermeasures may be employed as necessary. If an OPSEC Plan is provided, the contractor and all subcontractors shall comply with that plan. These OPSEC requirements will be in effect throughout the life of the procurement from award through the conclusion of services at the end of the Period of Performance (PoP) or other procurement termination. If required, the contractor and all subcontractors shall prepare an OPSEC Plan.

8.15.2 Contractor personnel shall follow OPSEC concepts and principles in the conduct of this requirement to protect CI, personnel, facilities, equipment and operations from compromise. The contractor shall consult with the SME within 5 working days of receipt of order to determine all special circumstances affecting OPSEC under this requirement. In any case where there is uncertainty or ambiguity regarding OPSEC measures, the contractor shall consult the SME as soon as possible. If the SME is unavailable, the contractor shall consult the contracting officer instead. The prime contractor and all subcontractors shall provide OPSEC protection for sensitive unclassified information and comply with all OPSEC requirements.

8.15.3 Minimum Protection Requirements for CI. CI is exempt from public release under Exemption 2 of the Freedom of Information Act (FOIA). It is designated “For Official Use Only (FOUO)” and is considered controlled unclassified information. Specific Critical Program Information, for reasons of OPSEC will not be identified to offerors prior to award. CPI will be identified to the successful offeror only after receipt of order.

8.16 Personally Identifiable Information (PII). PII will be protected in accordance with DoD and Navy directives, in such a manner as to prevent unauthorized disclosure. Email containing PII must be encrypted.

8.17 Controlled Unclassified Information (CUI): CUI is official information that requires the application of controls and protective measures for a variety of reasons and has not been approved for public release, to include technical information, proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts. CUI is a categorical designation that refers to unclassified information that does not meet the standards for National Security Classification under Executive Order(s), but is pertinent to the national interest of the United States or to the important interests of entities outside the Federal Government, and under law or policy requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination.

8.17.1 Minimum Requirements for Access to CUI: Prior to access, contractor personnel requiring access to DoN CUI or "user level access to DoN or DoD networks and information systems, system security and network defense systems, or to system resources providing visual access and/or ability to input, delete or otherwise manipulate sensitive information without controls to identify and deny sensitive information" who do not have clearance eligibility are required to submit a Questionnaire for Public Trust Positions (Standard Form 85P) through the cognizant Facility Security Officer or contractor entity representative for a suitability determination by DoN Central Adjudication Facility.

8.17.2 Minimum Protection Requirements for CUI: Contract deliverables taking the form of unclassified limiteddistribution documents (FOUO), are not authorized for public release and therefore shall not be posted on a publicly accessible web server, nor electronically transmitted via electronic mail unless appropriately encrypted.

8.18 Countermeasures. Countermeasures to CI exploitation are required to negate the susceptibility of critical information to exploitation by an adversary or competitor. The contractor shall protect all CI listed in a manner appropriate to the nature of the information, including use of the necessary countermeasures as listed below applicable to specifics items.

1)Encryption of electronically-stored CI.

2)Encryption of e-mail containing CI.

3)Storage of hard copy CI, optical media and external hard drives in locked containers when not in use.

4)Transmission of CI to the minimum set of recipients with a need to know.

5)Proper marking of CI with warnings to include at a minimum “FOR OFFICIAL USE ONLY”; as appropriate to the nature of the CI it shall also be marked with “UNCLASSIFIED BUT SENSITIVE,”

“PRIVACY ACT INFORMATION,” “PERSONALLY IDENTIFYING INFORMATION,” “PROTECT

FROM UNAUTHORIZED DISCLOSURE” or other similar statements cautioning protection of the CI.

6)Restricting disclosure of CI at meetings and conferences (including teleconferences) to the minimum necessary to the performance of this requirement.

7)Immediate and appropriate destruction in a manner precluding reconstruction of all CI no longer needed under this requirement.

8)Restricting verbal discussion of CI to venues and circumstances that prevent the monitoring and interception of the discussion by unauthorized personnel.

9)Maintaining current, successful completion of Navy-mandated Information Assurance (IA) and OPSEC training by all personnel handling CI.

10) Refraining from the use of unencrypted cellular telephones to transmit CI.

11) Refraining from the use of foreign postal systems to ship CI.

12) Promptly retrieving documents containing CI printed on printers accessible by persons without a need to know the CI.

13) Use of cover pages or other appropriate means to prevent the viewing of CI by unauthorized persons.

14) Limiting the inclusion of CI in contract and budget documents, presentations, press releases and other publications to that which is essential to the performance of this requirement.

15) Use of protected databases and strong passwords and the protection of user identifications (UserIDs).

16) During test and evaluation events (as applicable to this requirement) practice OPSEC methodologies with respect to staging units, personnel and materials out of the observation of unauthorized persons;

desensitization; and the speed of execution of the event.

8.19 Compromise. The contractor shall notify the SME, FSO, and security office immediately of all known and suspected compromises of CI, classified information, or PII. If the SME cannot be reached, the contractor shall notify the Contracting Officer (or the Command Duty Officer if after normal work hours).

8.20 FOUO. The FOUO marking is assigned to information at the time of its creation. It is not authorized as a substitute for a security classification marking but is used on official Government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA). Use of FOUO markings does not mean that the information can’t be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

8.20.1 All UNCLASSIFIED documents created under this procurement that contain FOUO information will be marked “FOR OFFICIAL USE ONLY” on the bottom of the cover page and interior pages.

8.20.2 Classified documents containing FOUO do not require any markings on the cover of the document.

However, the interior pages containing only FOUO information shall be marked at the top and bottom center with “FOR OFFICIAL USE ONLY.” Only unclassified portions containing FOUO shall be marked with “(FOUO)” immediately before each unclassified FOUO portion.

8.20.3 All FOUO information released to the contractor will be marked with the following statement prior to transfer:

THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY

DISCLOSURE UNDER THE FOIA. EXEMPTIONS(S) ______ APPLY.

8.20.4 Removal of the FOUO marking may be accomplished only by the originator or other competent authority.

The contractor SHALL NOT REMOVE ANY FOUO MARKING WITHOUT WRITTEN AUTHORIZATION FROM NSWC CORONA OR THE AUTHOR. The Government will notify the contractor when the FOUO status is terminated.

8.20.5 The contractor is authorized to disseminate FOUO information to its employees and those having a need to know the information in order to accomplish the requirements of this procurement.

8.20.6 During working hours, reasonable steps shall be taken to minimize the risk of access to FOUO information by unauthorized personnel. FOUO information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need to know the information in order to perform the requirements of this procurement. During non-working hours, the FOUO information shall be stored in a locked desk, file cabinet, bookcase, rooms, or other lockable container or space affording reasonable protection from unauthorized disclosure.

8.20.7 FOUO information may be transmitted via US postal service first-class mail, parcel post and fourth-class mail for bulk shipments only. The contractor shall not permit FOUO information to enter foreign postal systems and parcel delivery systems.

8.20.8 When no longer needed, FOUO information shall either be returned to appropriate Government custody or destroyed in a manner precluding reconstruction of the information.

8.20.9 Electronic transmission of FOUO information (via voice, data, or facsimile transmission) shall be by approved secure communications systems (such as encryption if unclassified). If circumstances preclude the use of such a system, the contractor shall consult the SME; if the SME is not available and time requirements do not permit delay, the contractor shall consult the Contracting Officer.

8.21 ACCESS BRIEFINGS. FSO will provide any necessary access briefings required for contract performance (NATO, CNWDI, etc.).

8.22 The Contractor shall notify NSWC Corona if any of the limitations mentioned above need modification.

Conversely, the Government will notify the Contractor when security requirements delineated in this SOW are modified.

8.23 Access to Government Information Systems

The Contractor shall require access to Government Information Systems to perform the duties under this SOW.

The Contractor shall access systems on unclassified networks including but not limited to NMCI/NGEN, NIPRNET, closed enclaves, and non-networked systems.

8.24 Access to Intelligence information is not required for performance of this contract.

8.25 Information Storage

Documentation, system test results and sensitive information shall be stored at NSWC Corona and NMCI shared drives under NSWC Corona cognizance.