VGSA_Template_Final_CO_Approved_01AUG17.pdf

VISITOR GROUP SECURITY AGREEMENT (VGSA)

BETWEEN

STRATEGIC WEAPONS FACILITY, ATLANTIC (SWFLANT)

AND

COMPANY NAME GOES HERE

FOR

CONTRACT TITLE GOES HERE

Contract #: XXXXXX-xx-X-xxxx

NAME

Facility Security Officer/Local Security Rep

Company Name

(DATE)

Contracting Officer Representative (COR)

Strategic Weapons Facility Atlantic

Primary Contract Site Manager/Resident Dir

Company Name

MAXINE LLOYD

Command Security Manager (CSM)

Strategic Weapons Facility, Atlantic

F. D. ROCHFORD, CAPT, USN

Commanding Officer

Strategic Weapons Facility, Atlantic

References.

(a) DoD 5200.01 Vol 1-4, Department of Defense Information Security Program

(b) SECNAV M5510.36, DoN Information Security Program

(c) SECNAV M-5510.30, DoN Personnel Security Program

(d) DoD 5220.22-M, National Industrial Security Program Operating Manual

(e) SWFLANTINST 5530.7, series Security Consolidated Directive Manual

(f) DoD 5220.22-R, Industrial Security Regulation

(g) SSPINST 5510.34, Industrial Security Program

(h) SECNAV M-5210.1, Records Management Program

1. This agreement, entered into by Strategic Weapons Facility Atlantic, (SWFLANT) and

Company Name goes here (hereafter referred to as the “Contractor”), prescribes specific actions per reference (a) thru (h) to be taken by the Contractor and SWFLANT, to ensure the protection of government owned National Security Information (NSI) trusted to the Contractor at the on-base operating location. Responsibilities are delineated as follows:

a. Authority. Security oversight authority is issued by references (a) through (h).

b. All Parties. All parties responsible for the security of NSI will perform duties specified by this agreement in a timely manner. The designated SWFLANT Industrial Security Specialist (ISS) is responsible for implementation, oversight, and management of the government activities industrial security program per references (a) through (g).

c. Contractor Security Supervision. Contractor Home Office Facility (HOF) will designate in writing the names of primary and alternate security representatives at both their off-base cleared facility and on-base operating locations, who are responsible for security administration at their respective activities. SWFLANT Command Security Manager (CSM) is responsible for providing oversight and is responsible for implementing and managing the Government activity security program per references (a) through (g).

d. Standard Practice Procedures (SPP). Compliance with this agreement will normally eliminate the need for an addendum or supplement to the HOF SPP to outline security responsibilities at on-base operating activity. Contractor will use and comply with references (a) through (g) per this agreement and other applicable DoD and Navy directives as required.

Should Contractor personnel determine a need to develop an addendum or supplement to the

HOF SPP, a copy will be provided to SWFLANT CSM. A copy of HOF SPP will be maintained by on-base operating activity. Security procedures identified in this Visitor Group Security

Agreement (VGSA) take precedence over Contractor SPP. NOTE: An SPP is only required when the Facility Security Officer (FSO) and CSM determine it to be necessary.

e. Access to and Accountability of Classified Material

(1) All access to, or possession of NSI by Contractor personnel will be under the control of

SWFLANT government personnel.

(2) Contractor will maintain NSI created or stored at SWFLANT in accordance with references (a) through (e). Contractor will not have custody of NSI, but will appoint a Classified Control

Representative (CCR) for the safekeeping of classified information at Naval Submarine Base Kings Bay

(SUBASE), per the Contractor Statement of Work (SOW) and reference (e).

(3) If Contractor personnel, during contract performance, discover unattended classified material or an unsecure/unattended security container, they will immediately secure the classified material and notify the CCR, Contractor security personnel, and CSM. During non-duty hours

Contractor personnel will notify SWFLANT Weapons Operations Center (WOC) to request

Command Duty Officer (CDO) notification and notify CSM when possible compromised NSI is discovered. Contractor personnel will maintain a list of emergency telephone numbers to contact

SWFLANT WOC and CSM in this case. NSI will be released to SWFLANT CDO when the

CCR cannot be contacted. Contractor employee access to NSI will be controlled by SWFLANT and limited to contract-specific, need-to-know, information only, unless mission requirements dictate otherwise.

f. Storage of Classified Material: Contractor is not authorized to permanently store classified material at their on-base operating location. The material will be issued by SWFLANT

Command Classified Control Manager (CCCM) to be stored in a SWFLANT certified Open

Storage Area, classified storage container, or both, and required access to NSI will be granted on a need-to-know basis per reference (e). NSI will be in the possession of a cleared Contractor employee while on loan from SWFLANT only in the performance of the awarded contract. All

NSI is returned to SWFLANT for appropriate storage or disposition when no longer required.

g. Transmission of Classified Material:

(1) Contractor is not authorized direct receipt or dispatch of NSI at SWFLANT. For postal receipt, Contractor will use the address:

COMMANDING OFFICER

STRATEGIC WEAPONS FACILITY ATLANTIC

1150 USS LOS ANGELES RD

KINGS BAY, GA 31547-2637

Attention: Document Control

(2) NSI to be transmitted by U.S. postal channels directly from SWFLANT must be prepared per references (a) and (b), and processed through the classified information control system of SWFLANT.

(3) Classified material may be hand carried locally within SWFLANT Area of Responsibility

(AOR) by Contractor personnel via a DD Form 2501, Courier Authorization Card. Follow references

(a), (b), and (e) to brief document courier on hand carrying procedures.

h. Disposition of Classified Material. Contractor will return to SWFLANT all NSI they have been provided or created at the end of the contract performance or when no longer required.

Other methods of disposition must be coordinated with SWFLANT CCCM.

i. Reproduction of Classified Material. Only government approved reproduction equipment will be used to reproduce classified materials. Contractor is not authorized to copy classified material without the approval of CCCM or SWFLANT CSM.

j. Security Education. Contractor must brief permanent on-base Contractor personnel, whose duty performance requires access to classified information, on their individual responsibility for safeguarding classified information. Personnel will be briefed on a recurring, but not less than annual basis. The briefing may be tailored only to those responsibilities associated with their assigned duties.

k. Personnel Security Clearances. Contractor will ensure that all personnel have the appropriate security eligibility prior to releasing or granting access to NSI. Contractor is responsible to initiate and track security eligibility investigations for all personnel that will have access to classified information or as required by DD Form 254. Contractor will ensure that all personnel security eligibility is verified through Joint Personnel Adjudication System (JPAS) prior to granting access to NSI. CSM will also verify Contractor personnel security eligibility as required.

(1) Contractor is responsible to manage their personnel through a JPAS account and will submit visit requests annually for all on-base activity personnel to SWFLANT ISS (SMO:

68733). A copy of the visit request will be retained at Contractor on-base operating activity location. SWFLANT will serve as the sponsoring activity for the visit.

(2) SWFLANT CSM will maintain a “Servicing” relationship in JPAS of all Contractor personnel conducting operations in support of SWFLANT.

(3) Standard Form (SF) 312, Classified Information Nondisclosure Agreement, will be used for briefing Contractor personnel; will be retained at Contractor off-base cleared facility; and entered into JPAS. Contractor employees will be required to be debriefed per ref (c); and the debriefing will be recorded on OPNAV 5511/14, Security Termination Statement. OPNAV

5511/14 will be maintained by CSM and destroyed per reference (h). Contractor employees will also be required to complete a SWFLANT Security Debriefing Statement.

l. Reports. Contractor must immediately submit to CSM in writing, required reports outlined in V-3, Enclosure 6, of ref (a). CSM will inform Contracting Officer Representative (COR) and the responsible SWFLANT department the contractor is supporting all security violations committed by contractor employees.

(1) SWFLANT Commanding Officer initiates Preliminary Inquiries (PI) per ref (b). Appointed officials coordinate inquiry/investigation reports with the CSM.

(2) Contractor will advise CSM of any changes in management, personnel, location, or contractual performance requirements at SWFLANT.

m. Access and Restricted Area Badges. Access to SUBASE requires Contractor employees to obtain a Defense Biometrics Identification System (DBIDS) Credential. When required for contract performance, either a locally produced SUBASE Restricted Area Access badge, SWFLANT Limited

Area (LA) badge, or both will be issued to Contractor personnel for entry into SUBASE Restricted

Areas.

(1) SUBASE Restricted Area Access badge. When required for contract performance, Contractor Security or COR (if on-base) will submit a SUBASE badge application and

SWFLANT LA badge application to CSM. Contractor Security or COR will specify area accesses required on the application for employees as required for their job performance. CSM will process the application and notify Contractor Security when complete. Requests for access will be supported by visit request, security eligibility verification, and need-to-know.

(2) Common Access Card (CAC) is only authorized for personnel who require logical access to a government network (.mil email address). For employees meeting that requirement, Contractor Security or COR (if on-base) will request a CAC for employees through CSM, utilizing the Trusted Associate Sponsorship System (TASS). Contractor Security will submit a

TASS Registration Request (TRR) to the sponsor who will verify the need for a CAC. The sponsor will forward the TRR to the Trusted Agent (TA) in SWFLANT Access Controls Branch for processing. The continued need for the CAC will be verified semi-annually by the sponsor, TA, and Contractor FSO. CAC will be turned in to the TA upon contract termination, loss of employment, or when there is no longer a continued need for the CAC. CACs are valid for up to three years or the length of the contract. Expired CACs require a new TRR.

(3) Contractor is responsible for ensuring that each employee is briefed per reference (e) on the proper wear of issued badges while they are on duty in SWFLANT AOR. Refusal or repeated neglect to display the issued badges may result in the unsuitable determination per reference (c). Upon termination of work, resignation, retirement or contract completion, Contractor is responsible for returning all

Government identification, building passes and other Government property issued to that employee.

(4) Contractor will notify the card or badge (CAC, SWFLANT LA badge or SUBASE Access

Badge) issuing authority when an employee has lost their card or badge.

(5) The requirements of this clause are applicable to all sub-contractors that will work under this contract at SWFLANT and will be followed.

n. Security Checks. Contractor will perform security checks within assigned work areas at the on-base operating location. These checks will ensure security precautions are taken to protect NSI issued to Contractor. Contractor personnel will follow references (a), (b), and (e) for end-of-day security checks. Standard Form 701, Activity Security Checklist, and Standard Form

702, Security Container Check sheet, will be used to record these checks and maintained for thirty days from date of completion or as required.

o. Emergency Protection. In the event of a natural disaster, major accident, security alerts, or civil disturbance, Contractor will follow the emergency procedures outlined in references (c), (e), and (f). All employees will be briefed on these procedures by Contractor security personnel prior to performing work.

p. Protection of Government Resources. Contractor will comply with references (a) thru (f).

Classified files will be maintained per reference (h).

q. Clarification of Security Requirements. Contractor will submit written requests for clarification of security requirements through SWFLANT CSM.

r. VGSA and Associated DD Form 254. Contractor will maintain a copy of this VGSA and associated DD Form 254 at the on-base operating location. COR will ensure the DD Form 254 does not expire, revisions are accomplished when required, and biennial reviews are completed.

s. Foreign Involvement. Under the terms of this agreement, Contractor will notify CSM and contracting office, prior to any foreign involvement, regardless of access requirements or the sensitivity of information to be disclosed (classified or unclassified), unless covered under the auspices of the

US/UK Polaris Sales Agreement. In addition, visits to SWFLANT, to include foreign national visits, must be processed through CSM.

2. Program Reviews

a. SWFLANT CSM will conduct an initial program review of Contractor operations upon arrival.

b. Subsequent program reviews will be accomplished per sub paragraphs (1) and (2).

(1) CSM conducts annual program reviews of the on-base activity to ensure compliance with applicable provisions of references (a) through (e) and this security agreement. A written program review report will be provided to the COR and Contractor. Contractor is not required to acknowledge receipt of the report or respond unless directed to do so in the report.

(2) CSM will include Contractor in their annual security self-inspection program. CSM will use the VGSA requirements and the command self-inspection criteria to perform the annual self-inspection on Contractor as well as document and maintain the inspection report as required by references (a) through (d).

3. Review of this Agreement. All parties must review this agreement at least annually for accuracy.

SWFLANT is responsible for keeping this agreement current. COR is responsible for the agreement and will maintain a copy of the last program review. In addition, CSM will keep on file copies of evaluations and self-inspections or equivalent reviews for three years. Copies of reports will be forwarded to Contractor for their files.

4. Communication Security (COMSEC). Contractor will use secure communication (STE or OMNI) when discussing sensitive-unclassified information or classified information pertaining to this contract, made available under the terms of this contract by SWFLANT. SIPRNET will be used when classified information is to be sent via automated system.

a. SIPRNET accounts are available to Contractor upon request. Need for a SIPRNET account will be verified by Contractor Security, who will submit a System Access Authorization Request

(SAAR) to SWFLANT Information Technology Division (SPK16) for account creation. CSM will be notified of all Contractor requests for SIPRNET accounts.

b. Contractor Security and CSM will validate that the employee has the appropriate security eligibility, ensure derivative classification training has taken place, ensure that all information is correct, and the SAAR is signed by the requestor and supervisor. CSM will verify JPAS eligibility and document on the SAAR. Contractor Security will sign the SAAR and provide employee a North Atlantic Treaty Organization (NATO) briefing and certificate to be signed by the employee.

5. Computer Security (COMPUSEC). Information systems (IS) (i.e., computers, word processors, networks and stand-alones, etc.) used in the processing of classified information in support of this contract must be approved prior to commencement of classified operations. Contractor will comply with

SSP and SWFLANT policy for accreditation of information systems used in classified processing.

6. Operation Security (OPSEC): Contractor must protect critical or sensitive-unclassified operational information; will not engage in any illegal or unethical conduct, or any activity which would constitute a conflict of interest; will not reveal or use information received in confidence during a professional assignment, without proper authorization; will report all information obtained during the course of an assignment accurately and completely.

7. Other Security Programs: All Contractor employees and any sub-contractors will be subject to applicable regulations, policies and procedures on Physical Security, Anti-Terrorism/Force Protection

(AT/FP) and Law Enforcement.

8. Other:

a. Forms. COR or CSM furnishes all government forms and Navy Instructions to Contractor as required by this agreement.

b. Sub-contracts. A VGSA will be initiated whenever Contractor enters into a sub-contractual arrangement with another contractor for classified performance at SWFLANT. It must address the sub-contractor’s operation separately. CSM, Commanding Officer and both

Contractor, and sub-contractors must sign the agreement. A DD Form 254 is completed for each subcontractor requiring access to classified information. Contractor is responsible for preparing the DD Form 254 and must provide a copy to CSM for review to ensure it correctly reflects the instructions furnished by the Prime Contracting Officer (PCO). The PCO must ensure that any questions regarding adequacy of the DD Form 254 are resolved to the mutual satisfaction of

Contractor, subcontractor, and the contracting officer, or are referred to the COR for resolution.

The prime contractor signs item 16 of the DD Form 254 for subcontracts and makes required distribution.

c. Notification. Notify SWFLANT CSM 30 days prior to contract completion/shutdown at

SWFLANT in order to review Contractor operations and ensure proper disposition of classified materials per references (a) through (e) and this security agreement.

9. Expenditure of Funds for Security. This agreement is not an authorization for a commitment of funds. Nothing in this agreement will be construed to impose any liability on the part of the U.S.

government for injury to the agents, employees of Contractor, its subcontractors, assignees, or other individuals acting for or on behalf of Contractor, to the property of the same, nor will anything in this agreement be construed to modify the provisions of existing contracts.

10. Government Liability. Nothing in this agreement will be construed to impose any liability on the

U.S. Government for injury or loss to the person or property of the agents, employees, subcontractors, assignees, or other individuals, acting for or on the behalf of Contractor.