RFP DD254 Embedded Document 2 IT.pdf

INFORMATION TECHNOLOGY (IT) SYSTEMS

PERSONNEL SECURITY PROGRAM REQUIREMENTS

The U.S. Government conducts trustworthiness investigations of personnel who are assigned to positions that directly or indirectly affect the operation of unclassified IT resources and systems that process Department of

Defense (DoD) information, to include For Official Use Only (FOUO) and other controlled unclassified information.

The United States Office of Personnel Management (OPM), National Background Investigation Bureau (NBIB) process all requests for U.S. Government trustworthiness investigations. Requirements for these investigations are outlined in paragraph C3.6.15 and Appendix 10 of DoD 5200.2-R, available at http://www.dtic.mil/whs/directives/corres/dir.html. Personnel occupying an IT Position shall be designated as filling one of the IT Position Categories listed below. The contractor shall include all of these requirements in any subcontracts involving IT support. (Note: Terminology used in DoD 5200.2-R references “ADP” vice “IT”. For purposes of this requirement, the terms ADP and IT are synonymous.)

The Program Manager (PM), Contracting Officer’s Representative (COR) or Technical Representative (TR) shall determine the IT Position category for the contractor personnel.

DoDD Directive 8500.01, Subject: Cybersecurity, stipulates cybersecurity requirements such as "Cybersecurity workforce functions must be identified and managed, and personnel performing cybersecurity functions will be appropriately screened in accordance with this instruction and DoD 5200.2-R and qualified in accordance with

DoDD 8570.01 and supporting issuances”. DoD 5200.2-R stipulates the requirements for background investigations, special access and IT position designations and requirements. An appropriate security clearance and non-disclosure agreement are also required for access to classified information” in accordance with DoDM 5200.01

Vol. 1. DoD 5200.2-R and DoDD 5200.2 require all persons assigned to sensitive positions or assigned to sensitive duties be U.S. citizens. All persons assigned to IT-I and IT-II positions, as well as all persons with access to controlled unclassified information (without regard to degree of IT access) or performing other duties that are considered "sensitive" as defined in DoDD 5200.2 and DoD 5200.2-R must be U.S. citizens. Furthermore, access by non-citizens to unclassified export controlled data will only be granted to persons pursuant to the export control laws of the U.S. The categories of controlled unclassified information are specified in DoDM 5200.01 Vol. 4. These same restrictions apply to "Representatives of a Foreign Interest" as defined by DoD 5220.22-M (National Industrial

Security Program Operating Manual, NISPOM). DoD 8570.01-M further stipulates additional training and/or certification that is required by all persons assigned to Information Assurance functions.

I. Criteria For Designating Positions: updated per OPM Federal Investigations Notice No. 16-02, dated

October 6, 2015:

a. Tier 5/5R = IT-I Position (Privileged)

Responsibility or the development and administration of Government computer security programs, and including direction and control of risk analysis and/or threat assessment.

Significant involvement in life-critical or mission-critical systems.

Responsibility for the preparation or approval of data for input into a system, which does not necessarily involve personal access to the system, but with relatively high risk for effecting grave damage or realizing significant personal gain.

Relatively high risk assignments associated with or directly involving the accounting, disbursement, or authorization for disbursement from systems of (1) dollar amounts of $10 million per year or greater, or (2) lesser amounts if the activities of the individual are not subject to technical review by higher authority in the IT-I category to ensure the integrity of the system.

Positions involving major responsibility for the direction, planning, design, testing, maintenance, operation, monitoring, and/or management of systems hardware and software.

Other positions as designated by Space and Naval Warfare Systems Center Pacific (SSC Pacific) that involve relatively high risk for effecting grave damage or realizing significant personal gain.

Personnel whose duties meet the criteria for IT-I Position designation require a favorably adjudicated Single Scope

Background Investigation (SSBI) or SSBI Periodic Reinvestigation (SSBI-PR) or Tier 5/5R. The SSBI or SSBI-PR http://www.dtic.mil/whs/directives/corres/dir.html or Tier 5/5R shall be updated every 5 years by using the Electronic Questionnaire for Investigation Processing

(eQIP) web based program (SF86 format).

b. Tier 3/3R = IT-II Position (Limited Privileged)

Responsibility for systems design, operation, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the IT-I category, includes but is not limited to:

Access to and/or processing of proprietary data, information requiring protection under the Privacy

Act of 1974, and Government-developed privileged information involving the award of contracts;

Accounting, disbursement, or authorization for disbursement from systems of dollar amounts less than $10 million per year. Other positions are designated by Space and Naval Warfare Systems

Center Pacific (SSC Pacific) that involve a degree of access to a system that creates a significant potential for damage or personal gain less than that in IT-I positions. Personnel whose duties meet the criteria for an IT-II Position require a favorably adjudicated National Agency Check with

Local Agency Check and Credit Check (NACLC) or Tier 3/3R.

c. Tier 1/1R is for Unclassified – Non-Sensitive positions = IT-III Position (Non-Privileged)

All other positions involving Federal IT activities. Incumbent in this position has non-privileged access to one or more DoD information systems, application, or database to which they are authorized access. Personnel whose duties meet the criteria for an IT-III Position designation require a favorably adjudicated National Agency Check with Inquiries (NACI) or Tier 1/1R.

d. Qualified Cleared Personnel Do NOT Require Trustworthiness Investigations:

When background investigations supporting clearance eligibility have been submitted and/or adjudicated to support assignment to sensitive national security positions, a separate investigation to support IT access will normally not be required.

A determination that an individual is NOT eligible for assignment to a position of trust will result in the removal of eligibility for security clearance. Likewise, a determination that an individual is NOT eligible for a security clearance will result in the denial of eligibility for a position of trust.

II. Visit Authorization Requests (VARs) for Qualified Employees:

Contractors that have been awarded a classified contract must submit visit requests using “only” the Joint Personnel

Adjudication System (JPAS). All government activities have been directed to use JPAS when transmitting or receiving VARS. Therefore, contractors who work on classified contracts are required to have established an account through JPAS for their facility. This database contains all U.S. citizens who have received a clearance of

Confidential, Secret, and/or Top Secret. The visit request can be submitted for up to one year. When submitting a visit requests to SSC Pacific, use its Security Management Office (SMO) number (660015). This information is provided in accordance with guidance provided to contractors via the Defense Security Service (DSS) website https://www.dss.mil/ (DSS guidance dated 24 April 2007, subject: Procedures Governing the Use of JPAS by

Cleared Contractors).

III. Employment Terminations:

The contractor shall:

Immediately notify the COR or TR of the employee’s termination.

Send email to W_SPSC_SSC_PAC_clearance_US@navy.mil, Code 83310 notifying them of the termination.

Fax a termination VAL to Code 83320 at (619) 553-6169.

Return any badge and decal to Commanding Officer, Space and Naval Warfare Systems Center Pacific, Attn: Code

83320, 53560 Hull Street, San Diego, CA 92152-5001.

mailto:W_SPSC_SSC_PAC_clearance_US@navy.mil

INFORMATION TECHNOLOGY (IT) SYSTEMS PERSONNEL SECURITY PROGRAM

REQUIREMENTS FOR UNCLASSIFIED/POSITION OF TRUST (POT) CONTRACTORS

The U.S. Government conducts trustworthiness investigations of personnel who are assigned to positions that directly or indirectly affect the operation of unclassified IT resources and systems that process Department of

Defense (DoD) information, to include For Official Use Only (FOUO) and other controlled unclassified information.

The United States Office of Personnel Management (OPM), National Background Investigation Bureau (NBIB) process all requests for U.S. Government trustworthiness investigations. Requirements for these investigations are outlined in paragraph C3.6.15 and Appendix 10 of DoD 5200.2-R, available at http://www.dtic.mil/whs/directives/corres/dir.html. Personnel occupying an IT Position shall be designated as filling one of the IT Position Categories listed below. The contractor shall include all of these requirements in any subcontracts involving IT support. (Note: Terminology used in DoD 5200.2-R references “ADP” vice “IT”. For purposes of this requirement, the terms ADP and IT are synonymous.)

The Program Manager (PM), Contracting Officer’s Representative (COR) or Technical Representative (TR) shall determine the IT Position category for the contractor personnel.

DoDD Directive 8500.01, Subject: Cybersecurity, stipulates cybersecurity requirements such as "Cybersecurity workforce functions must be identified and managed, and personnel performing cybersecurity functions will be appropriately screened in accordance with this instruction and DoD 5200.2-R and qualified in accordance with

DoDD 8570.01 and supporting issuances”. DoD 5200.2-R stipulates the requirements for background investigations, special access and IT position designations and requirements. An appropriate security clearance and non-disclosure agreement are also required for access to classified information” in accordance with DoDM 5200.01

Vol. 1. DoD 5200.2-R and DoDD 5200.2 require all persons assigned to sensitive positions or assigned to sensitive duties be U.S. citizens. All persons assigned to IT-I and IT-II positions, as well as all persons with access to controlled unclassified information (without regard to degree of IT access) or performing other duties that are considered "sensitive" as defined in DoDD 5200.2 and DoD 5200.2-R must be U.S. citizens. Furthermore, access by non-citizens to unclassified export controlled data will only be granted to persons pursuant to the export control laws of the U.S. The categories of controlled unclassified information are specified in DoDM 5200.01 Vol. 4. These same restrictions apply to "Representatives of a Foreign Interest" as defined by DoD 5220.22-M (National Industrial

Security Program Operating Manual, NISPOM). DoD 8570.01-M further stipulates additional training and/or certification that is required by all persons assigned to Information Assurance functions.

IV. Criteria For Designating Positions: updated per OPM Federal Investigations Notice No. 16-02, dated

October 6, 2015:

e. Tier 5/5R = IT-I Position (Privileged)

Responsibility or the development and administration of Government computer security programs, and including direction and control of risk analysis and/or threat assessment.

Significant involvement in life-critical or mission-critical systems.

Responsibility for the preparation or approval of data for input into a system, which does not necessarily involve personal access to the system, but with relatively high risk for effecting grave damage or realizing significant personal gain.

Relatively high risk assignments associated with or directly involving the accounting, disbursement, or authorization for disbursement from systems of (1) dollar amounts of $10 million per year or greater, or (2) lesser amounts if the activities of the individual are not subject to technical review by higher authority in the IT-I category to ensure the integrity of the system.

Positions involving major responsibility for the direction, planning, design, testing, maintenance, operation, monitoring, and/or management of systems hardware and software.

Other positions as designated by Space and Naval Warfare Systems Center Pacific (SSC Pacific) that involve relatively high risk for effecting grave damage or realizing significant personal gain.

Personnel whose duties meet the criteria for IT-I Position designation require a favorably adjudicated Single Scope

Background Investigation (SSBI) or SSBI Periodic Reinvestigation (SSBI-PR) or Tier 5/5R. The SSBI or SSBI-PR or Tier 5/5R shall be updated every 5 years by using the Electronic Questionnaire for Investigation Processing

(eQIP) web based program (SF86 format).

http://www.dtic.mil/whs/directives/corres/dir.html

f. Tier 3/3R = IT-II Position (Limited Privileged)

Responsibility for systems design, operation, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the IT-I category, includes but is not limited to:

Access to and/or processing of proprietary data, information requiring protection under the Privacy

Act of 1974, and Government-developed privileged information involving the award of contracts;

Accounting, disbursement, or authorization for disbursement from systems of dollar amounts less than $10 million per year. Other positions are designated by Space and Naval Warfare Systems

Center Pacific (SSC Pacific) that involve a degree of access to a system that creates a significant potential for damage or personal gain less than that in IT-I positions. Personnel whose duties meet the criteria for an IT-II Position require a favorably adjudicated National Agency Check with

Local Agency Check and Credit Check (NACLC) or Tier 3/3R.

g. Tier 1/1R is for Unclassified – Non-Sensitive positions = IT-III Position (Non-Privileged)

All other positions involving Federal IT activities. Incumbent in this position has non-privileged access to one or more DoD information systems, application, or database to which they are authorized access. Personnel whose duties meet the criteria for an IT-III Position designation require a favorably adjudicated National Agency Check with Inquiries (NACI) or Tier 1/1R.

V. Procedures for submitting U.S. Government Trustworthiness Investigations:

Only the e-QIP version of SF-85 and SF 86 are acceptable by OPM-NBIB.

After determining that an individual requires Public Trust Position determination, the FSO will identify the individual to the COR. The COR will notify SSC Pacific Personnel Security Office with the specific IT Level category assigned for requesting the appropriate type of investigation. The FSO will also provide the following information to the COR so that the SSC Pacific Personnel Security Office can initiate a request thru e-QIP:

Full SSN of the applicant

Full Name

Date of Birth

Place of Birth

Email Address

Phone Number

A spreadsheet will be provided by the COR for the FSO to complete that includes the above information and any additional information required by the Personnel Security Office.

The Personnel Security Office will send email notification and instructions to the applicant to complete and submit e-QIP expeditiously.

The FSO or SSC Pacific Personnel Security Office will take and submit fingerprints using SF-87, FD-258 or electronic submission. The FSO must obtain from SSC Pacific Personnel Security Office the e-QIP Request Number for inclusion in submitting the fingerprints. For immediate fingerprint result, electronic transmission of fingerprints is encouraged. OPM no longer accepts the submission of hard copy fingerprints (SF-87 or FD-258).

If fingerprints are obtained via hardcopy, the hardcopies will be sent to SSC Pacific Personnel Security via Priority, Certified, or Express mail:

COMMANDING OFFICER, SSC PAC

ATTN: Personnel Security, Code 83310

53560 Hull St

San Diego CA 92152

SSC Pacific Personnel Security Office will update Joint Personnel Adjudication System (JPAS), PSQ Sent Date, when the Public Trust Investigation request is released to the Parent Agency, OPM.

Contractor fitness determinations made by the DOD CAF are maintained in the JPAS. Favorable fitness determinations will support public trust positions only and not national security eligibility. If no issues are discovered, according to respective guidelines a “Favorable Determination” will be populated in JPAS and will be reciprocal within DoN. If issues are discovered, the DOD CAF will forward the investigation along with all supporting documentation to the SSC Pacific Security Office for local determination. The local fitness determination will be made by the Command Security Manager and your company will be notified of the decision in writing. If an individual receives a negative trustworthiness determination, they will be immediately removed from their position of trust, the FSO will be notified, and the company will replace any individual who has received a negative trustworthiness determination.

If you require additional assistance with the submission of Public Trust Investigations, you may send an email to

SSC Pacific at W_SPSC_SSC_PAC_clearance_US@navy.mil.

VI. Employment Terminations:

The contractor shall:

Immediately notify the COR or TR of the employee’s termination.

Send email to W_SPSC_SSC_PAC_clearance_US@navy.mil, Code 83310 notifying them of the termination.

Fax a termination VAL to Code 83320 at (619) 553-6169.

Return any badge and decal to Commanding Officer, Space and Naval Warfare Systems Center Pacific, Attn: Code 83320, 53560 Hull Street, San Diego, CA 92152-5001.

mailto:W_SPSC_SSC_PAC_clearance_US@navy.mil.

mailto:W_SPSC_SSC_PAC_clearance_US@navy.mil

SPECIFIC ON-SITE SECURITY REQUIREMENTS

I. GENERAL.

a. Contractor Performance. In performance of this Contract the following security services and procedures are incorporated as an attachment to the DD 254. The Contractor will conform to the requirements of DoD 5220.22-M, Department of Defense National Industrial Security Program, Operating Manual (NISPOM), as revised. The Contractor will follow all export laws and regulations in the performance of this contract. When visiting Space and Naval Warfare Systems Center Pacific (SSC Pacific) at either the Point Loma Campus (PLC) or Old Town Campus (OTC) the Contractor will comply with the security directives used regarding the protection of classified and controlled unclassified information, SECNAV M-5510.36 (series), SECNAV M-5510.30 (series), DOD M-5200.01 Volumes 1 through 4, and SSCPACINST 5720.1A (series). Both of the SECNAV Instructions and Manuals are available online at http://doni.daps.dla.mil/SECNAV.aspx and the DOD Instructions can be found at http://www.dtic.mil/whs/directives/corres/pub1.html. A copy of SSCPACINST 5720.1A will be provided upon receipt of a written request from the Contractor’s Facility Security Officer (FSO) to the SSC Pacific Security’s Contracting Officer’s Representative (COR), Code 83310. If the Contractor establishes a cleared facility or Defense Security Service (DSS) approved off-site location at SSC Pacific, the security provisions of the NISPOM will be followed within this cleared facility.

b. Security Supervision. SSC Pacific will exercise security supervision over all contractors visiting SSC Pacific and will provide security support to the Contractor as noted below. The Contractor will identify, in writing to Security’s COR, an on-site Point of Contact to interface with Security’s COR.

II. HANDLING CLASSIFIED MATERIAL OR INFORMATION.

a. Control and Safeguarding. Contractor personnel located at SSC Pacific are responsible for the control and safeguarding of all classified material in their possession. All contractor personnel will be briefed by their FSO on their individual responsibilities to safeguard classified material. In addition, all contractor personnel are invited to attend SSC Pacific conducted Security Briefings, available at this time by appointment only. In the event of possible or actual loss or compromise of classified material, the on-site Contractor will immediately report the incident to SSC Pacific Code 83310, (619) 553-3005, as well as the Contractor's FSO. A security specialist, Code 83310 representative will investigate the circumstances, determine culpability where possible, and report results of the inquiry to the FSO and the Cognizant Field Office of the DSS. On-site contractor personnel will promptly correct any deficient security conditions identified by a SSC Pacific representative.

b. Storage.

1. Classified material may be stored in containers authorized by SSC Pacific PLC Physical Security Group, Code 83320 for the storage of that level of classified material. Classified material may also be stored in Contractor owned containers brought on board SSC Pacific PLC with Code 83320's written permission. Areas located within cleared contractor facilities on board SSC Pacific will be approved by DSS.

2. The use of Open Storage areas must be pre-approved in writing by Code 83320 for the open storage, or processing, of classified material prior to use of that area for open storage. Specific supplemental security controls for open storage areas, when required, will be provided by SSC Pacific, Code 83320.

c. Transmission of Classified Material.

1. All classified material transmitted by mail for use by long term visitors will be addressed as follows:

(a) TOP SECRET, Non-Sensitive Compartmented Information (SCI) material using the Defense Courier Service: SPAWARSYSCEN-PACIFIC: 271582-SN00, SPAWARSYSCEN PACIFIC.

(b) CONFIDENTIAL and SECRET material transmitted by FedEx will be addressed to COMMANDING

OFFICER, SPACE AND NAVAL WARFARE SYSTEMS CENTER PACIFIC, ATTN RECEIVING

OFFICER CODE 43150, 4297 PACIFIC HIGHWAY, SAN DIEGO, CA 92110.

(c) CONFIDENTIAL and SECRET material transmitted by USPS Registered and Express mail will be http://doni.daps.dla.mil/SECNAV.aspx http://www.dtic.mil/whs/directives/corres/pub1.html addressed to COMMANDING OFFICER, SPACE AND NAVAL WARFARE SYSTEMS CENTER PACIFIC, 53560 HULL STREET, SAN DIEGO CA 92152-5001. The inner envelope will be addressed to the attention of the Contracting Officer's Representative (COR) or applicable Technical Representative (TR) for this contract, to include their code number.

2. All SECRET material hand carried to SSC Pacific by contractor personnel must be delivered to the Classified Material Control Center (CMCC), Code 83430, Building 58, Room 102, for processing.

3. All CONFIDENTIAL material hand carried to SSC Pacific by contractor personnel must be delivered to the Mail

Distribution Center, Code 83430, for processing. This applies for either the OTC or PLC sites.

4. All SSC Pacific classified material transmitted by contractor personnel from the SSC Pacific will be sent via SSC Pacific COR or TR for this contract.

5. The sole exception to the above is items categorized as a Data Deliverable. All contract Data Deliverables will be addressed to COMMANDING OFFICER, ATTN DOCUMENT CONTROL CODE 83430, SPACE AND NAVAL WARFARE SYSTEMS CENTER PACIFIC, 53560 HULL STREET, SAN DIEGO, CA 92152-5001.

III. INFORMATION SYSTEMS (IS) Security.

a. Contractors using ISs, networks, or computer resources to process classified, sensitive unclassified and/or unclassified information will comply with the provisions of SECNAVINST 5239.3 (series) and local policies and procedures. Contractor personnel must ensure that systems they use at SSC Pacific have been granted a formal letter of approval to operate by contacting their Information System Security Officer (ISSO). Any suspected cybersecurity incident, such as spillage of classified information to an unclassified system, regardless of the location of the computer system, must be reported immediately to the COR/TR/PM, Security's COR, ISSO, the Contractor's Facility Security Officer (FSO), and the Contracting Officer. Contractors who willfully misuse Government computer resources will be held liable to reimburse the Government for all associated costs.

b. Contractors receiving, transmitting or accessing unclassified controlled technical information on or through its contractor information (s) must safeguard the information to avoid compromise, including but not limited to disclosure of information of information to unauthorized persons, unauthorized modification, destruction, or loss of an object, or the copying of information to unauthorized media, as required per DFARS subpart 2014.73 and clauses 204.7304 and 252.204-7012. Contractors shall report to the DOD each cybersecurity incident that affects unclassified controlled technical information resident on or transiting contractor information systems in accordance with DFARS clause

204.7304 and 252.204-7012. Detailed reporting criteria and requirements are set forth in the clause at 252.204-7012 safeguarding of unclassified controlled technical information.

IV. VISITOR CONTROL PROCEDURES.

Title 18 USC 701 provides for criminal sanctions including fine or imprisonment for anyone in possession of a badge who is not entitled to have possession. Sec.701. Official badges, identification cards, other insignia. Whoever manufactures, sells, or possesses any badge, identification card, or other insignia, of the design prescribed by the head of any department or agency of the United States for use by any officer or employee thereof, or any colorable imitation thereof, or photographs, prints, or in any other manner makes or executes any engraving, photograph, print, or impression in the likeness of any such badge, identification card, or other insignia, or any colorable imitation thereof, except as authorized under regulations made pursuant to law, shall be fined under this title or imprisoned not more than six months, or both.

a. Contractor personnel assigned to SSC Pacific will be considered long-term visitors for the purpose of this contract.

b. Contractors that have been awarded a classified contract must submit visit requests using “only” the Joint Personnel

Adjudication System (JPAS). All government activities have been directed to use JPAS when transmitting or receiving Visit Authorization Letters (VALs). Therefore, contractors who work on classified contracts are required to have established an account through JPAS for their facility. This database contains all U.S. citizens who have received a clearance of Confidential, Secret, and/or Top Secret. The visit request can be submitted for one year.

When submitting visit requests to SSC Pacific use its Security Management Office (SMO) number (660015). This information is provided in accordance with guidance provided to contractors via the Defense Security Service (DSS) website https://www.dss.mil (DSS guidance dated 24 April 2007, subject: Procedures Governing the Use of JPAS by Cleared Contractors).

c. For visitors to receive a SSC Pacific badge their Government point of contact must approve their visit request and the visitor must present government issued photo identification.

d. Visit requests for long-term visitors must be received at least one week prior to the expected arrival of the visitor to ensure necessary processing of the request.

e. Code 83320 will issue temporary identification badges to Contractor personnel following receipt of a valid VAL from the Contractor's FSO. The responsible SSC Pacific COR will request issuance of picture badges to contractor personnel. Identification badges are the property of the U.S. Government, will be worn in plain sight, and used for official business only. Unauthorized use of an SSC Pacific badge will be reported to the DSS. For additional information see paragraph g below.

f. Prior to the termination of a Contractor employee with a SSC Pacific badge or active VAL on file the FSO must:

1. Notify in writing Code 83320, the Contracting Officer, the COR, Security’s COR, and the laboratory managers of any laboratories into which the employee had been granted unescorted access of the termination, resignation or reassignment and the effective date that the contractor employee no longer requires admittance to the Federally-controlled facility or access to Federally-controlled information systems. In emergencies, a facsimile may be sent or a telephone notification may be used. The telephone notification, however, must be followed up in writing within five working days.

2. Immediately confiscate any SSC Pacific issued identification badge, common access card (CAC), and return them to Code 83320 no later than five working days after the effective date of the termination. In addition, the contractor will relay departure information to the cognizant Personnel Security Office (W_SPSC_SSC_PAC_clearance_US@navy.mil) and Trusted Agent (TA) (ssc_pac_trustedagent@navy.mil) that entered the individual into the Trusted Associated Sponsorship System (TASS).

3. The Contractor will ensure each departed contractor employee has completed the SSC Pacific Out-Processing Checklist, when applicable.

g. Common Access Card (CAC).

1. VAL must be on file, form completed and signed, approved by the contractor’s COR, and sent to the Badge and Pass Office, Code 83320.

2. All contractors coming aboard SSC Pacific will need a SSC Pacific badge whether it is a Picture or Temporary Badge. You will also need one of the following: a) Common Access Card (CAC), or 2) a Navy Commercial Access Credentialing System (NCACS). If you do not have either one of these you will need to be vetted by filling out the SECNAV 5512 which will be forwarded to NBPL for approval. Contractors will not be able to use their Retired or Dependent Military ID in lieu of the CAC or NCACs.

3. Eligibility for a CAC or NCACS rests with the COR. If the need for a CAC is identified, the COR will instruct the employer to provide a DD Form 1172-2 to the COR for the subject needing a CAC. The COR may contact the Trusted Agent Security Manager (TASM) at SSC_PAC_TRUSTEDAGENT@NAVY.MIL, for instructions on filling out the 1172-2. Not all fields on the 1172-2 are required on a contractor CAC application.

4. If the contractor does not possess a closed and favorably adjudicated investigation, the CAC will not be issued until a background investigation has started (open) at the Office of Personnel Management (OPM) and the SSC Security office has verified fingerprints are clear on the check of the FBI database. Note: The SSC Security office is the only entity capable of checking this. An “interim” clearance in JPAS does not mean fingerprints were checked in the FBI database.

https://www.dss.mil/ mailto:SSC_PAC_TRUSTEDAGENT@NAVY.MIL

V. INSPECTIONS. Code 83310 personnel may conduct periodic inspections of the security practices of the on-site Contractor. All contractor personnel will cooperate with Code 83310 representatives during these inspections. A report of the inspection will be forwarded to the Contractor's employing facility and COR. The Contractor must be responsive to the Code 83310 representative's findings.

VI. REPORTS. As required by the NISPOM, Chapter 1, Section 3, contractors are required to report certain events that have an impact on the status of the facility clearance (FCL), the status of an employee's personnel clearance (PCL), the proper safeguarding of classified information, or an indication classified information has been lost or compromised.

a. The Contractor will ensure that certain information pertaining to assigned contractor personnel or operations is reported to Security’s COR, Code 83310. If further investigation is warranted it will be conducted by Code 83310. This reporting will include the following:

1. The denial, suspension, or revocation of security clearance of any assigned personnel;

2. Any adverse information on an assigned employee's continued suitability for continued access to classified access;

3. Any instance of loss or compromise, or suspected loss or compromise, of classified information;

4. Actual, probable or possible espionage, sabotage, or subversive information; or

5. Any other circumstances of a security nature that would affect the contractor's operation on board SSC Pacific.

b. In addition to the NISPOM reporting requirements, any conviction and/or violation of the Foreign Corrupt Practices Act, or any other violation of the International Traffic in Arms Regulations (ITAR) shall immediately be reported to the Designated Disclosure Authority (DDA), COR/TR/PM and Contracting Officer.

VII. PHYSICAL SECURITY.

a. SSC Pacific will provide appropriate response to emergencies occurring onboard this command. The Contractor will comply with all emergency rules and procedures established for SSC Pacific.

b. A roving Security Guard patrol will be provided by SSC Pacific. Such coverage will consist of, but not be limited to, physical checks of the window or door access points, classified containers, and improperly secured documents or spaces. Specific questions or concerns should be addressed to Code 83320.

c. All personnel aboard SSC Pacific are subject to random inspections of their vehicles, personal items and of themselves. Consent to these inspections is given when personnel accept either a badge or a vehicle pass/decal permitting entrance to this command.

d. Information about parking restrictions can be found in the SSCSDINST 5560.1F, Vehicle Parking Policy, Regulations, an Enforcement Procedures. A copy of this instruction can be obtained through your designated COR or TR.

e. Required trainings:

1. Anti-Terrorism/force Protection (AT/FP) briefings are required for all personnel (military, DOD civilian, and contractor) prior to commencement of foreign travel. The briefing is available at Joint Knowledge Online (JKO):

https://jkodirect.jten.mil (prefix): JS; course number: US007; title: Level 1 Anti-terrorism awareness training, if experiencing problems accessing this website contact ssc_fortrav@navy.mil. Note: Per OPNAVINST F3300.53C contractor employees must receive the AT/FP briefing annually.

2. USFF FORCE PROTECTION (FP) DIRECTIVE MSG 16-00 directs all personnel (Military, DOD Civilian, and contractor) to complete the Training and Readiness - The Active Shooter. The training is available at https://wwwa.nko.navy.mil/. You will find the training under Course Catalog "Prefix: CNIC, Number: CNIC- TRATAS-1.1.”, if experiencing problems accessing this website contact ssc_fortrav@navy.mil.

https://jkodirect.jten.mil/ mailto:ssc_fortrav@navy.mil

Contractors must comply with installation access control procedures. Any Contractor who repeatedly violates access control requirements will be issued an Apparent Security Incident (ASI). After the ASI has been investigated, a letter will be forwarded to the contracting facility’s Security Officer via the Center’s Contracting Officer for resolution.

VIII. COR RESPONSIBILITIES.

a. Review requests by cleared contractors for retention of classified information beyond a two-year period and advise the contractor of disposition instructions and/or submit a Final DD 254 to Security’s COR.

b. In conjunction with the appropriate transportation element, coordinates a suitable method of shipment for classified material when required.

c. Certify and approve Registration For Scientific and Technical Information Services requests (DD 1540) (DTIC).

d. Ensure timely notice of contract award is given to host commands when contractor performance is required at other locations.

e. Certify need-to-know on visit requests and conference registration forms.

IX. SPECIAL CONSIDERATIONS FOR ON-SITE CLEARED FACILITIES.

Any cleared contractor facility on board SSC Pacific will be used strictly for official business associated with this contract.

No other work may be performed aboard this facility. Additional SSC Pacific contracts may be performed in this cleared facility, but only on a case-by-case basis. The COR, Security’s COR, and Contracting Officer must all be in agreement that this particular arrangement best suits the needs of the Government. At the end of this contract the on-site facility must be vacated, with proper written notification being submitted to the DSS and Security’s COR.

X. ITEMS PROHIBITED ABOARD SSC PACIFIC.

The following items are prohibited within any SSC Pacific controlled areas, with the exception of personnel authorized to possess weapons in the performance of required duties.

If an individual is attempting entry onto SSC Pacific controlled spaces and discloses the possession of a weapon prior to being instructed to comply with an administrative weapons inspection, the gate guard or inspection team will deny base entry to that individual and will report the circumstances to the SSC Pacific Security Officer. If the disclosure of a firearm, explosive or dangerous weapon is made during the inspection or if no disclosure is made at all, the individual will be detained and the SUBASE Precinct will be notified.

WEAPONS

a. Ammunition.

b. Fireworks.

c. Molotov Cocktail.

d. Pipe Bomb.

e. Black Jack.

f. Slingshots.

g. Billy/Sand Club.

h. Nunchakus.

i. Sand Bag: Partially filled with sand and swung like a mace.

j. Metal (Brass) Knuckle.

k. Dirk or Dagger.

l. Switch Blade or Butterfly Knife.

m. Knife with a blade (cutting edge) longer than 4 inches. NOTE: this represents a change from the previous 2.5-inch limit.

n. Razor with Unguarded blade.

o. Pipe, Bar or Mallet to be used as a club.

p. Compressed Air or Spring Fired Pellet/BB gun.

q. Tear Gas/Pepper Spray Weapon.

r. Pistol, Revolver, Rifle, Shotgun or any other Firearm.

s. Bows, Crossbows, or Arrows.

t. Bowie Style Hunting Knife.

u. Any weapon prohibited by State law.

v. Any object similar to the aforementioned items.

w. Any offensive or defensive weapons not described above, but likely to cause injury (i.e., Stun Gun, Blow Gun).

x. Any abrasive, caustic, acid, chemical agent, or similar substance, with which to inflict property damage or personal injury.

y. Combination Tools with Knife Blades Longer Than 4 inches (i.e., Gerber, Leatherman, etc.).

Military personnel aboard SSC Pacific controlled areas not authorized to possess a firearm, as part of prescribed military duties will be apprehended if found in possession. Civilians in unauthorized possession of a firearm will be detained while civilian authorities are notified.

CONTROLLED SUBSTANCES

Unauthorized possession or use of controlled substances defined as marijuana, narcotics, hallucinogens, psychedelics, or other controlled substances included in Schedule I, II, III, IV, or V established by Section 202 of the Comprehensive Drug Abuse Prevention and Control Act of 1970 (84 Stat. 1236) is prohibited.

CONTRABAND

Contraband defined as all equipment, products and materials of any kind which are used, intended for use, or designed for use in injecting, ingesting, inhaling, or otherwise introducing into the human body, marijuana or other controlled substances, in violation of law. This includes: hypodermic syringes, needles, and other objects to inject controlled substances in the body or objects to ingest, inhale or otherwise introduce marijuana, cocaine or hashish oil into the body is prohibited.

ALCOHOL

Permission to possess and consume alcohol on-site at SSC Pacific is at the exclusive discretion of the Commanding Officer. That includes the determinations of where and when alcohol may be brought on board the Center and consumed.

SSC Pacific personnel may bring unopened containers of alcohol on board the Center, if it remains in their private vehicles except where expressly authorized for an approved event.

Open containers of any alcoholic beverage unless for use at a function approved by the SSC Pacific Commanding Officer.

Employees desiring to hold a function and serve alcohol, should send a memo (hard copy) to the Commanding Officer, via the appropriate division head, the Director of Security, and the Public Affairs Officer. The Public Affairs Officer will approve or disapprove the facility use request based on availability and general use policy. If facility use is approved, the Public Affairs Officer will forward the memo to the Commanding Officer for approval/disapproval. Manufacturer sealed containers of alcoholic beverage are authorized as long as the containers remain sealed while within SSC Pacific controlled spaces.

Further information is available at https://blog.spawar.navy.mil/pacsecurity/security-info/physical-security.html.

COUNTERFEIT CURRENCY

Counterfeit currency defined as any copy, photo, or other likeness of any U.S. currency, either past or present, not authorized by the U.S. Treasury Department is prohibited.

XI. ESCORTING POLICY.

a. All personnel within SSC Pacific fenced perimeters, with the exception of emergency personnel such as fire, ambulance, or hazardous material response personnel responding to an actual emergency, must wear an SSC Pacific issued badge. Code 83300 or Code 83500 employee’s with badges displaying the word “Security” or “Safety” authorizes the bearer to escort unbadged emergency vehicles and operators and support personnel during emergencies. U.S. citizens, Permanent Residents (former immigrant aliens), and Foreign Nationals may be escorted under this policy. ALL FOREIGN NATIONAL VISITORS MUST BE PROCESSED THROUGH THE SSC PACIFIC

FOREIGN VISITS COORDINATOR OFFICE, CODE 83310, 553-0437.

https://blog.spawar.navy.mil/pacsecurity/security-info/physical-security.html

XII. CELLULAR PHONE USAGE.

a. Cellular phone use is prohibited in all secure spaces, i.e. Open Storage areas, classified laboratories.

b. Vehicle operators on DoD installations and operators of Government vehicles shall not use cellular phones, unless the vehicle is safely parked or unless they are using a hands-free device, and are also prohibited from wearing of any other portable headphones, earphones, or other listening devices while operating a motor vehicle.

d. The use of cellular phones, portable headphones, earphones, or other listening devices while jogging, walking bicycling, or skating on roads and streets on Navy installations is prohibited except for use on designated bicycle and running paths and sidewalks.

XIII. PERSONAL ELECTRONIC MEDIA

The use of personal electronic media (computer laptops, flash (thumb), or other removable drives) is prohibited in SSC Pacific spaces. Contact the Command Information System Security Manager (SPSC_SSCPAC_ISSM@NAVY.MIL) if you have question. All removable electronic media must be labeled (unclassified, etc.) to the highest classification of data stored, and/or for the classification of the system in which it is used. If classified, any removable electronic media must be tracked and stored appropriate to that level of classification.

CONTRACTOR REQUIREMENTS FOR ACCESS TO INTELLIGENCE INFORMATION

1. Intelligence material and information, either furnished by the user agency or generated under the contract performance, will not be:

a. Reproduced without prior approval of the originator of the material. All Intelligence material shall bear a prohibition against reproduction while in your custody; or

b. Released to foreign nationals or immigrant aliens who you may employ, regardless of their security clearance or access authorization, except with the specific permission of SSO Navy, via Security’s COR; or

c. Released to any activity or person of the contractor’s organization not directly engaged in providing services under the contract or to another contractor (including subcontractors), government agency, private individual, or organization without prior approval of the originator of the material, and prior approval and certification of need-to-know by the designated project manager/contract sponsor.

2. Intelligence material does not become the property of the contractor and may be withdrawn at any time. Upon expiration of the contract, all intelligence released and any material using data from the Intelligence must be returned to the Contracting Officer’s Representative (COR) or authorized representative for final disposition. The contractor shall maintain such records as will permit them to furnish, on demand, the names of individuals who have access to Intelligence material in their custody.

3. Access to Intelligence data will only be through cognizant government program managers/project engineers. Independent access is not inferred or intended.

4. Classified Intelligence, even though it bears no control markings, will not be released in any form to foreign nationals or immigrant aliens (including U.S. government employed, utilized or integrated foreign nationals and immigrant aliens) without permission of the originator.

5. You will maintain records which will permit you to furnish, on demand, the names of individuals who have access to Intelligence material in your custody.

6. Access to SCI Intelligence data requires the adherence to the requirements set forth in the DoD 5105.21 Volumes 1 through 3, Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Information and Information Systems Security.

FOR OFFICIAL USE ONLY (FOUO) INFORMATION

1. The For Official Use Only (FOUO) marking is assigned to information at the time of its creation. It isn’t authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

2. Use of FOUO markings doesn’t mean that the information can’t be released to the public, only that it must be reviewed by Space and Naval Warfare Systems Center Pacific, San Diego, CA prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

3. An UNCLASSIFIED document containing FOUO information will be marked “FOR OFFICIAL USE ONLY” on the bottom face and interior pages.

4. Classified documents containing FOUO do not require any markings on the face of the document; however, the interior pages containing only FOUO information shall be marked top and bottom center with “FOR OFFICIAL USE ONLY.” Mark only unclassified portions containing FOUO with “(FOUO)” immediately before the portion.

5. Any FOUO information released to you by Space and Naval Warfare Systems Center Pacific, San Diego, CA is required to be marked with the following statement prior to transfer:

THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FOIA.

EXEMPTION(S) _____ APPLY.

6. Removal of the FOUO marking can only be accomplished by the originator or other competent authority. DO NOT REMOVE ANY FOUO MARKING WITHOUT WRITTEN AUTHORIZATION FROM SPACE AND NAVAL WARFARE SYSTEMS CENTER PACIFIC, SAN DIEGO, CA OR THE AUTHOR. When the FOUO status is terminated you will be notified.

7. You may disseminate FOUO information to your employees and subcontractors who have a need for the information in connection with this contract.

8. During working hours, reasonable steps should be taken to minimize risk of access by unauthorized personnel. FOUO information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored in locked desks, file cabinets, bookcases, locked rooms, or similar items.

9. FOUO information may be transmitted via first-class mail, parcel post, fourth-class mail for bulk shipments only.

10. When no longer needed, FOUO information may be disposed by tearing each copy into little pieces to preclude anyone from reconstructing the document, and placing it in a regular trash, or recycle, container or in the uncontrolled burn. To ensure the document is precluded from being reconstructed it is recommended that FOUO be shredded using a crosscut shredder.

11. Unauthorized disclosure of FOUO information doesn’t constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions.

12. Electronic transmission of FOUO information (voice, data, or facsimile) should be by approved secure communications systems whenever practical.

13. To obtain for official use only (FOUO) guidance refer to the DoD Information Security Program Regulation, DoDM 5200.01 Volume 4, Enclosure 3, located at http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf.

OPERATIONS SECURITY REQUIREMENTS

All work is to be performed in accordance with DoD and Navy Operations Security (OPSEC) requirements, per the following applicable documents:

- National Security Decision Directive 298 -National Operations Security Program (NSDD) 298

- DOD 5205.02 -DOD Operations Security (OPSEC) Program

- OPNAVINST 3432.1 -DON Operations Security

- SPAWARINST 3432.1 -Operations Security Policy

The contractor will accomplish the following minimum requirements in support of Space and Naval Warfare Systems Center Pacific (SSC Pacific) Operations Security (OPSEC) Program:

- The contractor will practice OPSEC and implement OPSEC countermeasures to protect DOD Critical Information.

Items of Critical Information are those facts, which individually, or in the aggregate, reveal sensitive details about SSC Pacific or the contractor’s security or operations related to the support or performance of this SOW, and thus require a level of protection from adversarial collection or exploitation not normally afforded to unclassified information.

- Contractor must protect Critical Information and other sensitive unclassified information and activities, especially those activities or information which could compromise classified information or operations, or degrade the planning and execution of military operations performed or supported by the contractor in support of the mission.