Attachment_5_-_Security_Requirements.docx

8.0 SECURITY REQUIREMENTS

8.1 Personnel Security

Contractors performing on Naval Surface Warfare Center, Corona Division (NSWCCORDIV) contracts are required to successfully obtain and maintain (to include periodic reinvestigations) background investigations and clearances (if required) commensurate to contractor work performance and/or environment. Contract personnel investigation and adjudication records are subject to oversight by the Security Manager (SM) via the establishment of a “servicing” relationship with the records in the Joint Personnel Adjudication System (JPAS), Department of Defense (DoD) system of record for personnel security management. Contractor personnel unable to successfully obtain or maintain the appropriate investigation or necessary clearance shall immediately, upon notification from Facility Security Officer (FSO) be expected to vacate the installation or performance location. NSWCCORDIV Department Manager, Contracting Officer (KO), Contracting Officer’s Representative (COR) and the SM shall be notified of any such vacancy.

a. Contractor employees are not normally subjected to investigation unless access to classified information is required, in which case they are investigated and cleared under the National Industrial Security Program (NISP). Security clearances will not be granted to contractor employees for ease of movement within a restricted, controlled, or industrial area when their duties do not require direct access to classified information.

b. NSWCCORDIV does interact with contractors in matters that involve access to Controlled Unclassified Information (CUI) or areas critical to the operation of the Command which may not satisfy the prerequisites for personnel security clearances but do warrant a judgment of an employee’s trustworthiness. To meet this requirement the Security Office must coordinate and submit a National Agency Check with Inquiries (NACI) background investigation through the Office of Personnel Management (OPM). NSWCCORDIV will also submit a Single Scope Background Investigation (SSBI) or a Phased Periodic Reinvestigation (PPR) when contractor duties are designated as IT-I (privileged access) positions in accordance with SECNAVINST M-5510.30.

c. Contractor FSO shall report reportable derogatory contractor information and behaviors that bring into question an individual’s trustworthiness, judgment, and reliability to protect classified information to the Department of Defense Central Adjudication Facility (DoD CAF) via a JPAS incident report in accordance with the National Industrial Security Program Operating Manual (NISPOM). Contractor shall also notify the KO, COR, and SM of such incidents. Upon receipt of derogatory information, NSWCCORDIV Commanding Officer (CO) will determine based on the facts, whether a contractor can continue performing on the contract.

8.2 Contractor’s Personnel Roster

Contractor shall provide Government a personnel roster of all Prime and Subcontractor personnel and submit to the COR and Security COR via e-mail utilizing the following distribution address: CRNA_Contractor_Rosters@navy.mil no later than 20 business days following award and shall be updated monthly and when changes occur (CDRL A005).

8.3 Physical Security

Access to Government facilities/installations is at the discretion of the Government. The Government reserves the right to rescind access at any time. In each instance when contractors are terminated, separated or the contract is at the end date, the Contractor Manager or FSO shall ensure the prompt return of any issued items to the Government issuer (i.e. Government-owned keys; Common Access Cards (CACs) and/or issued identification picture badges).

a. Contractor Personnel Check-in/Check-out. Contractors entering onto or separating from the contract shall notify the NSWCCORDIV via e-mail utilizing the following distribution address: CRNA_Checkin_Checkout@navy.mil and include the following information: list the contract number, supporting code, contractor name and first day of work or the last day of work as applicable.

b. Contractor Issued CACs. Contractors issued a U.S. Department of Defense Government Identification CAC shall present the CAC as personal identification to gain entrance to installations. The CAC does not serve as authority to gain access to any Restricted Areas (RAs) within the command without proper vetting and approval.

8.3.1 Identification (ID) Picture Badges

a. NSWCCORDIV shall issue ID picture badges to Contractor personnel who are not issued a CAC. Contractor shall submit an NSWCCORDIV Badge/Access Request (NSWCCORDIV 5512/22) located at: https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/Documents/Forms/5512_22_Badge-Access%20Request.pdf. Badges and/or CACs are the property of the U.S. Government and will be used for official business only. Unauthorized use of badges and/or CACs shall be reported to the Security Office, local Naval Criminal Investigative Services (NCIS), and the Defense Security Service (DSS) representative assigned to the Prime and/or Sub-Contractor.

b. Standards for Wearing CACs/Badges. Contractors who have been issued CACs and/or badges shall wear them at all times on outer garments above the waist and removed when exiting the installation. CACs or badges shall not be worn outside the installation nor used as personal identification except as indicated by NSWCCORDIVINST 5530.2A.

c. Separating/Terminating Procedures. Prior to separation/termination of a Contractor who has been issued a CAC and/or badge, the Contractor FSO shall notify the COR and submit a Contractor check-out via e-mail utilizing the following distribution address: CRNA_Checkin_Checkout@navy.mil. The email shall include the contract number, supported code, contractor name, and the last day of work. All credentials shall be collected immediately and returned to the local Security Office or Visitor Reception Office no later than five workdays after the effective date of Contractor’s separation/termination or the end of the contract.

8.3.2 Common Access Cards (CACs) for Contract Performance

Contractor personnel requiring CACs for performance of this contract shall coordinate the issuance of CACs through their assigned Trusted Agent who shall via the Trusted Associate Sponsorship System (TASS) (formerly known as Contractor Verification System (CVS) process a contractor application for CAC issuance.

a. Sponsorship. The sponsor is the person affiliated with the DoD or other Federal agency who takes responsibility for verifying and authorizing the applicant’s need for an ID card. Applicants applying for a CAC shall be sponsored by a DoD Government official or employee.

b. Eligibility. Eligibility is based on the DoD Government sponsor’s determination of the type and frequency of access required to DoD facilities or networks. The applicant’s sponsor must confirm that the applicant meets one of the following requirements:

(1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely. Access to the DoD network must require the use of a computer with Government-controlled configuration or use of a DoD-approved remote access procedure in accordance with the Defense Information Systems Agency Security Technical Implementation Guide.

(2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures.

(3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD (applicable to DoD contractors only) on a recurring basis for a period of 6 months or more.

a. The frequency of “recurring basis” for access shall be determined by the DoD Component concerned in coordination with installation security policies.

b. CAC eligibility for applicants requiring physical access to multiple DoD facilities on a recurring basis for less than 6 months are risk-based decisions that shall be made by NSWCCORDIV in coordination with installation security policies. These applicants may instead be eligible for local or regional base passes in accordance with local installation security policies and procedures.

c. Background Investigation. Background investigations are required for those individuals eligible for a CAC. Sponsored CAC applicants shall not be issued a CAC without the required background investigation stipulated in Federal Information Processing Standards Publication 201-2. Initial issuance of a CAC requires, at a minimum, the completion of the Federal Bureau of Investigation (FBI) fingerprint check with favorable results and submission of a NACI (or investigation approved in Federal Investigative Standards). Completed NACI’s for CAC issuance shall be adjudicated in accordance with Office of Personnel Management Memorandum.

d. CAC Expiration Dates. CACs shall be issued for a period not to exceed three years from the date of issuance or contract expiration date, whichever is shorter. Unfunded contract options shall be considered in the determinations of the length of contract. For example, a contractor hired under DoD contract with a base year plus 2 option years shall be issued a CAC with a 3-year expiration. The expiration of the Public Key Infrastructure (PKI) certificates on the CAC shall match the expiration date on the card.

8.4 Information Security

8.4.1 Controlled Unclassified Information (CUI)

a. Controlled Unclassified Information (CUI). CUI is official information that requires the application of controls and protective measures for a variety of reasons and has not been approved for public release, to include technical information, proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts per Executive Order 13556 and DoDM 5200.01, Vol 4. CUI is a categorical designation that refers to unclassified information that does not meet the standards for National Security Classification under Executive Order 12958, as amended, but is (a) pertinent to the national interest of the United States or to the important interests of entities outside the Federal Government, and (b) under law or policy requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination.

b. Minimum Requirements for Access to CUI. Prior to access, contractor personnel requiring access to Department of the Navy (DON) CUI or “user level access” to DON or DoD networks and information systems, system security and network defense systems, or to system resources providing visual access and/or ability to input, delete or otherwise manipulate sensitive information without controls to identify and deny sensitive information who do not have clearance eligibility are required to submit a Questionnaire for Non-Sensitive Positions (Standard Form 85) through the cognizant FSO or contractor entity representative to NSWCCORDIV Security Office for a suitability determination by DoD CAF.

c. Minimum Protection Requirements for CUI. Task Order deliverables taking the form of unclassified limited-distribution documents (e.g., For Official Use Only (FOUO), Distribution Statement Controlled) are not authorized for public release and, therefore, shall not be posted on a publicly accessible web server or electronically transmitted via e-mail unless appropriately encrypted.

8.4.2 Personally Identifiable Information (PII)

a. Personally Identifiable Information (PII). PII is defined as information about an individual or individuals which can be used to distinguish or trace an individual’s identity; or relates to, is unique to, or describes the individual (e.g., home address, date of birth, social security number, credit or charge card account numbers, medical information, education information, etc.). PII can also be defined as two unique pieces of personal information linked or linkable to an individual which require safeguarding.

b. Contractor shall:

(1) Mark properly all documents containing PII data (i.e., letters, memos, emails, messages, faxed documents, etc.) as “FOR OFFICIAL USE ONLY – PRIVACY SENSITIVE: ANY MISUSE OR UNAUTHORIZED DISLCOSURE MAY RESULT IN BOTH CIVIL AND CRIMINAL PENALTIES” and ensure that e-mails are encrypted.

(2) Ensure that each system of records and documents containing personal information are stored in either a locked cabinet or secured room when not in use by an employee performing official duties related to the records or documents.

(3) Refrain from disclosing any information contained in a system of records by means of communication to any person or agency, except as authorized by NSWCCORDINST 5211.1A or the specific Privacy Act systems of records notice.

(4) Refrain from maintaining unnecessary PII files.

(5) Report any loss or unauthorized disclosure of PII to the Privacy Program Manager immediately upon discovery. If the loss occurs during non-duty hours, the Staff Duty Officer (SDO) must be notified at 951-232-3990. The Privacy Program Manager or SDO must, in turn, notify appropriate privacy officials.

(6) Properly dispose of any PII records in a manner to prevent inadvertent disclosure.

8.4.3 Couriering

Contractors designated to courier classified material in support of contract performance shall be briefed by the Contractor FSO on their responsibility to safeguard classified information, ensure they possess an identification card or badge which contains the contractor’s name, and the name and a photograph of the employee. Contractor shall provide NSWCCORDIV SM and COR a list of contractors authorized to courier and updated as changes occur.

8.4.4 Media Transfer Agent/Data Transfer Agent (MTA/DTA)

Contractors designated as Media Transfer Agents shall comply with mandatory training and procedures per NSWCCORDIVINST 5510.4A, Classified Information Systems Removable Media Policy.

8.4.5 Command All Shred Policy

Contractor shall dispose of all unclassified paper whether generated with NSWCCORDIV or received from outside sources through shredding or placement in a command designated shred bin on a daily basis to eliminate unauthorized disclosure of Privacy Act, PII, FOUO information, or other types of CUI. This includes but is not limited to reports, briefings, meeting notes, memos, sticky notes, user manuals, working papers, operating instructions, newspapers, magazines and laminated paper. Brown paper bags (burn bags) and recycle bins are not authorized for storing or accumulation of unclassified office paper.

8.4.6 Loss or Compromise including Electronic Spillages

a. Electronic Spillages. An electronic spillage occurs when data is placed on an IT system possessing insufficient security controls to protect the data at the required classification. In accordance with Navy Telecommunications Directive 03-06 Serial C, Mandatory Reporting Requirements Associated with Electronic Spillages of Classified Information classified information placed on an IT system operating at a lower level of classification must be presumed compromised until proven otherwise.

b. Loss or Compromise Reporting Requirement. Upon discovery of a possible loss or compromise of classified material, the first priority is to protect and/or retrieve the material. Any contractor who becomes aware of a possible loss or compromise of classified information will promptly notify NSWCCORDIV SM. Upon notification, the SM will determine if a Preliminary Inquiry (PI) is necessary.

8.5 Operations Security (OPSEC)

a. OPSEC. As defined in National Security Decision Directive (NSDD) 298, National Operations Security Program, OPSEC is a systematic and proven process by which the U.S. Government and its supporting contractors can deny to potential adversaries information about capabilities and intentions by identifying, controlling, and protecting generally unclassified evidence of the planning and execution of sensitive Government activities.

b. NSWCCORDIV Critical Information List (CIL) Quick Reference Guide. Critical Information Items (CII) 1 through 11 is designated as NSWCORDIV critical information and the Quick Reference Guide must be displayed at each workstation:

(1) Information about operations, missions, and exercises.

(2) Test schedule or specific test location.

(3) Date, time, route, or destination of the off-base movement of classified or sensitive information (e.g., equipment, documents, etc.) or arms, ammunition, and explosives (AA&E).

(4) Location of sensitive equipment (AA&E, COMSEC, etc.) or sensitive facilities (e.g., SCIF or laboratories).

(5) Project milestones.

(6) Personnel information that reveals force structure and readiness such as recall rosters.

(7) Information about capabilities, vulnerabilities, and limitations; information revealing a security weakness.

(8) Existence and/or details of intrusions into or attacks against DoD networks or information systems, including, but not limited to tactics, techniques and procedures used, network vulnerabilities exploited, and data targeted for exploitation.

(9) Network (and system) user IDs and passwords.

(10) Movements of key command personnel or visiting dignitaries, including itineraries, meeting agendas, hotel and transportation reservations, plans/routes, etc. (recommend protection of this information for all command personnel).

(11) Information revealing the security classification of equipment, systems, operations, missions, exercises, etc.

c. CIL Countermeasures. Contractor shall employ the following countermeasures to mitigate the susceptibility of critical information to exploitation, when applicable:

(1) OPSEC awareness & practice.

(2) Public key infrastructure when using (PKI) encryption and digital signature when using NIPRNET or transmission via secure systems or means (e.g., SIPRNET, JWICS, secure fax, secure phone).

(3) Adhere to All Shred policy and do not excessively fill shred bins.

(4) When janitorial services or other un-cleared visitors are in the work area, protect sensitive information by covering or putting away documents, refrain from discussing in their presence, etc.

(5) Limit detail in contract, budget, presentation, press release or publication to that essential for legitimacy.

(6) Use protected databases, follow guidance on composing strong passwords (avoid words found in dictionary), and protect user IDs and CACs.

(7) Do not provide more information than necessary in voicemail announcement.

(8) Outlook out- of-office autoreply shall not include dates and locations for out of command option.

(9) Vary day-to-day routines, both on and off the installation, including travel routine.

(10) During testing and evaluation, practice OPSEC methodologies of staging out of sight, desensitization, or speed of execution.

(11) Routinely change call signs.

d. Contractor shall:

(1) Display CIL Quick Reference Guide at workstation.

(2) Strictly adhere to need-to-know principles when discussing sensitive information and/or information that could be considered as an indicator of operational plans and/or intentions.

(3) Be knowledgeable of critical information, indicators, and countermeasures.

(4) Encrypt sensitive information in transit and at rest, in accordance with NSDD 298.

(5) Report OPSEC issues (potential critical information, vulnerabilities, indicators, etc.) to the OPSEC Program Manager.

8.6 Antiterrorism (AT) Foreign Travel

Contractors officially traveling overseas shall contact the Antiterrorism Officer (ATO) and if required, complete all mandated Foreign Travel requirements.

8.7 General Security Requirements

a. Subcontracting. Contractor shall immediately notify the COR and Security COR prior to subcontracting and submit a copy of the sub-contract DD254 if applicable.

b. Security Inspections. NSWCCORDIV security inspections shall occur annually and the Department Heads and CORs shall be informed of inspection results. Security inspections will include all embedded contractor personnel working in government facilities. Unannounced security spot-checks of departments shall occur throughout the year and are at the discretion of the Government.

c. Foreign Interests. Contractors with defined Foreign Interests (a Facility that is owned, controlled, or influenced by foreign interests) will ensure adherence to DoD and DON regulations, directives and policies. Full disclosure to NSWCCORDIV KO, COR, and Security COR is required.

d. Emergency Management.

(1) Contractors shall ensure that they are able to receive Command Desktop Notification System (CDNS) (aka AtHoc) messages by contacting Navy Marine Corps Intranet (NMCI) at 1-866-843-6624. The CDNS alerts registered users to various hazards, emergencies, traffic conditions, and Force Protection Condition (FPCON) changes, etc., both during and after working hours. The Automated Telephone Notification System (ATNS), a sub-system of the Wide Area Alert Network (WAAN), enables a registered user to receive telephonic, email, and text alerts on devices indicated.

(2) Contractors shall maintain a copy of the NSWCCORDIV Bomb Threat Card (NSWCCORDIV 5530/5) next to each Command telephone. If a telephonic bomb threat is received, complete the card as accurately as possible and immediately contact the Regional Dispatch Center (RDC).