Exhibit_G_Signed_South_Ancho_Canyon_and_Chaquehi_Canyon_1-24-2019.pdf

South Ancho Canyon and Chaquehui Canyon - Exhibit G Physical Security Risk

EXHIBIT G

PHYSICAL SECURITY REQUIREMENTS

Implementation of Investigation Work Plan for South Ancho Canyon Aggregate Area Implementation of the Investigation Work Plan for Chaquehui Canyon Aggregate Area

G1 .o Project/Program Goals and Objectives (November 2018)

The project goals and objectives include the complete site characterization, environmental remediation, extent/confirmation sampling, and restoration at the South Ancho and Chaquehui Canyon Aggregate Areas, as specified within the NMED approved Investigation Work Plan for South Ancho Canyon Aggregate Area (EP2015-0104) and the NMED approved Investigation Work Plan for Chaquehui Canyon Aggregate Area, Revision 1 (EP2010-0485).

1.1 Definitions and Acronyms (Aug 2017) Attachment 1

G2.0 Statements Applicable to Scope of Work (Aug 2018)

CONTRACTOR represents that all of the statements listed below are factually correct and applicable to the scope of work (SOW) for this subcontract. SUBCONTRACTOR has an affirmative duty to immediately notify the Contract Administrator in writing if performance of the SOW contradicts any statement in Section G2.0. In addition, if there is contradiction during the performance of the SOW, CONTRACTOR reserves the right to impose additional security requirements on SUBCONTRACTOR as deemed necessary and appropriate.

2.1 Work under this subcontract will take place at a LANL location that is designated as a General Access Area, a Property Protection Area (PPA) or Limited Area (LA).

2.2 Access authorizations (clearances) are not required for Subcontract workers to perform work under the subcontract. Subcontract workers may however already hold a DOE or LANL Cleared or Uncleared badge.

2.3 Work under this subcontract will require the approval of a Security Plan.

2.4 Subcontract workers will not require any LANL security training to perform work underthe subcontract.

2.5 Subcontract workers will include ONLY US citizens.

2.6 If a Subcontract worker does not hold a valid DOE badge, a LANL Generic Un-cleared US Citizen Visito(s badge will be issued while in DOE/ LANL owned or leased facilities, N3B or LANS leased facilities or on DOE / LANL property.

2. 7 Access to LANL or N3B PII information or data will not be allowed under this subcontract.

2.8 Access to QUO (excluding PII) and UCNI information or data will be granted on a need to-know basis only and shall be protected in accordance with US Government policy.

Subcontract workers will not have access to or process any LANL classified information

2.9 or matter.

Subcontract workers will not have access to Special Nuclear Material, Nuclear Material or

2.1 O Nuclear Material data.

G3.0 Security Requirements (Nov 2018)

SUBCONTRACTOR shall ensure compliance with all security requirements specified in this subcontract and all documents incorporated by reference. All measures taken by CONTRACTOR to correct Subcontract Workers' non-compliance shall be at SUBCONTRACTOR'S expense and the cost thereof, including any stipulated penalties resulting from such non-compliance, shall be deducted from payments otherwise due SUBCONTRACTOR.

3.1 DOE Directives Incorporated By Reference:

RFP-0000297

Clause Number Title Instructions

DDE M470.4B Safeguards and Security Program Applies when contract requires Chg 1 information regarding reporting potential security incidents.

DOEO471.1B Identification and Protection of Applies if contract involves activities that Unclassified Controlled Nuclear may generate, possess or have access Information to information or matter containing UCNI.

Applies if contract involves activities

DOE 0471.3 Identifying Official Use Only Information where Official Use Only (DUO) information and documents will be handled, used or generated.

Applies if contract involves activities

DOE M 471.3-1 Manual for Identifying and Protecting where Official Use Only (DUO) Official Use Only Information information and documents will be handled, used or generated.

Applies if contract includes

DOE O473.3A Protection Program Operations responsibilities for operating, administering, and/or protecting DOE & NNSA safeguards & security interests.

3.2 Goal of Zero Security Incidents

SUBCONTRACTOR and any lower-tier subcontractors shall strive to eliminate all security events, incidents, and adverse impacts to national security.

G4.0 General Security (May 2015)

4.1 Wo d rk Location an Badae Information

LOCATION BADGE REQUIRED FOR THE WORK

IZI General Access Area • No Badge Required

IZI Property Protection Area • Generic Uncleared US Visitor

IZI Limited Area • Generic Uncleared US Visitor Escort Required

IZI LANL Uncleared Site-Specific Badge

4.2 Integrated Safeguards and Security Management (ISSM)

ISSM utilizes a five-step process that LANL incorporates to ensure that security expectations are established, implemented, measured and reinforced in every work activity. The following five-step process defines a systematic approach to actions taken before, during, and after work is performed. SUBCONTRACTOR shall ensure that the five-step ISSM process or an equivalent process is followed by all Subcontract Workers.

(1) Define the Scope of Work

(2) Analyze the Security Risk

(3) Develop and Implement Security Controls

(4) Perform Work within Security Controls

(5) Ensure Performance

4.3 Safeguards, Security and Counterintelligence Awareness

4.3.1. SlJE!CONTRACT Workers shall report all of the following situations to the Office of Counterintelligence and inform the STR or Facility Security Officer (FSO).

• Professional contacts and relationships with sensitive country foreign nationals, whether they occur at one's worksite or abroad.

• Suspicious or provocative actions or behaviors on the part of foreign nationals visiting or assigned to LANL.

• Substantive personal relationships with sensitive country foreign nationals (who are not lawful permanent residents), other than family members.

• Business transactions including financial transactions, partnerships, or other business interests or investments with citizens of sensitive countries who are not lawful permanent residents, whether they involve one-time interactions or ongoing financial relationships. (Small payments for things such as house cleaning or other such personal services or financial support provided to family members are not included).

• Any attempts by unauthorized persons to gain access to classified information. (Not limited to sensitive country foreign nationals or foreign nationals; includes US and non-US citizens)

4.3.2 Subcontractor shall be alert to and report any of the following to the STR:

• Attempts by unauthorized persons to obtain information;

• Unexplained / excessive use of copiers by workers;

• Workers living beyond their means;

• Unusual foreign travel patterns of workers; and

• Personal problems of workers that could affect security or fitness for duty.

4.4 AcknowledgmenVControl of Vehicles On-Site

If requested, SUBCONTRACTOR shall submit to the STR the make, year and license number of all vehicles that will be used on site. Vehicles driven by unbadged drivers delivering construction materials or other supplies will be permitted to enter unsecured areas only if they are under escort by authorized DOE or LANL badged personnel.

Vehicle Searches All non-government owned commercial vehicles and heavy-duly vehicles (the equivalent of a Ford F350 or larger) will be screened by the Protective Force at the truck inspection station near the intersection of East Jemez Road and NM 4. If the search does not disclose anything of concern, the driver will receive an appropriate pass that will allow entry into their LANL destination.

Parking on LANL Premises Subcontract Workers shall park vehicles in designated parking areas only.

Subcontract Workers shall obey all posted designations and park in a safe and courteous manner. Failure to park in designated areas and to obey posted signage shall result in a parking violation. Vehicles that are abandoned or present a safety or security concern are subject to removal at the owner's expense.

4.5 Workplace Violence

N3B maintains a work environment that is free from violent behavior and threats of violence. Violent behavior and threats of violence are unacceptable conduct and are prohibited. Any subcontract worker who participates in workplace violence will be barred from the LANL or N3B worksite and their employer shall be notified.

G5.0 Physical Security (April 2017)

5.1 Prohibited Articles

Prohibited Articles are items never permitted on DOE property (e.g., LANL) which includes leased facilities and parking lots. SUBCONTRACTOR shall ensure that prohibited articles are not brought on to DOE property. Prohibited articles include:

• Dangerous weapons (e.g., guns and knives), explosives, or other instruments or material likely to cause substantial injury or damage to persons or property;

• Non-government-owned fiream,s;

• Alcoholic beverages, including unopened bottles or cans;

• Controlled substances such as illegal drugs and associated paraphernalia, including medical marijuana but not other prescription medicine; and

• other items prohibited by local, state or federal law.

5.2 Escorting

In addition to any facility-specific escorting requirements, Subcontractor Workers shall ensure that all LANL escorting requirements listed below are complied with while on DOE/LANL property or LANL leased property.

An Un-cleared US Citizen may be authorized for escorted access into a Security Area (e.g. a LA) only if such individual is entering an area to conduct official DOE business that can be accomplished only in that Security Area. Subcontract Workers may be escorted into a LANL area where they are not permitted unescorted access. A Subcontract Worker may not escort another Subcontract worker or an Un-cleared individual. The Subcontract worker shall:

• Provide a valid photo ID;

• State country of citizenship for their escort before entering a security area;

• Log in, pursuant to the manner required by the LANL owning/ tenant organization before entering an area where he/she is being escorted;

• Wear their badge in plain sight at all times while on-site at LANL;

• Physically remain with his/her escort at all times;

• Comply with all requirements outlined by LANL, N3B and the escort;

• No more than five (5) individuals shall be escorted at any one time.

G6.0 Personnel Security (Nov 2018)

6.1 Substance Abuse Policy

The unauthorized use of alcohol and/or illegal drugs or being under the influence of alcohol and/or illegal drugs is prohibited on the LANL site. LANL's substance abuse policy applies to all who perform work at or for LANL and calls for drug and/or alcohol testing on the basis of reasonable suspicion that the policy has been violated; and drug and/or alcohol testing due to an incident or accident that results in a serious injury or has the potential to cause serious injury. All drug collections and alcohol testing are conducted in accordance with 49 CFR Part 40.

6.1.1 If a Subcontract Worker is reasonably suspected of being impaired by either drugs or alcohol, CONTRACTOR will require Subcontract worker to submit to drug/ alcohol testing. The testing will be conducted and paid for by the CONTRACTOR.

6.1.2 Drugs currently used in CONTRACTOR'S random testing panel include marijuana, cocaine, opiates, heroine, phencyclidine and amphetamines. The use of medical marijuana is illegal under federal law and therefore is prohibited in accordance with these substance abuse requirements. When conducting reasonable suspicion or occurrence testing, CONTRACTOR may test for any drug listed in Schedules I or II of the Controlled Substances Act.

6.1.3 SUBCONTRACTOR shall ensure that Subcontract Workers comply with all requirements of LANL's Substance Abuse program. Failure to comply with requirements may result in termination of a Subcontract Worker's permission to work on LANL property or on the subcontract.

6.1.4 Subcontract Workers shall:

• Be fit for duty and avoid behavior that compromises the health, safety or security of others;

• Notify the STR and FSO immediately if cited, arrested or convicted of a drug or alcohol statute violation;

• Notify the STR and FSO immediately if they are cited, arrested or convicted of any alcohol-related incident such as (e.g.) DUI, DWI, or public intoxication, open container;

• Meet Occupational Medicine promptly when asked to perform a drug and/ or alcohol test;

• Immediately report accidental ingestion of illegal drugs to the STR so the appropriate action can be taken.

6.1.5 Other testing shall be required if

• An incident or accident occurs at work that results in a serious injury or had the potential for serious injury.

• A vehicle accident that results in or had the potential for injury while driving any government-owned vehicle on or off Laboratory property; or while driving any private vehicle within the boundaries of a LANL Technical Area.

6.1.6 Failure to Show or Refusal of Drug and/or Alcohol Test

• If the worker fails to show up or refuses to be tested, such failure or refusal shall be reported and treated as a confirmed positive.

• Failure to cooperate and submit to a drug/alcohol test shall be grounds for the

CONTRACTOR to bar the worker from the LANL site.

6.1.7 Confirmed Positive Drug and/or Alcohol Test

The STR or FSO shall take the following actions if a Subcontract Worker has a confirmed positive drug test:

• Immediately stop the worker from performing any additional work on site and escort the worker off -site confiscating the worker's badge.

6.2 Badging

SUBCONTRACTOR shall ensure compliance with the badge requirements outlined in the following subsections. Any individual performing work under a contractual agreement with N3B, shall obtain a LANL badge. (Subcontract workers, Guests and Affiliates)

All badges issued by the LANL Badge Office, including a Generic Un-cleared US Citizen Visitor badge supplied by a N3B host, are accountable. Therefore, SUBCONTRACTOR shall ensure that every badge issued under this subcontract is returned to the N3B Security.

Failure to return any badge will result in denial of future badging services to the subcontract worker.

6.2.1 General Badging Requirements

A Subcontract Worker will completely fill out a DOE EM-LA External Agency Request for Badging form, 10 - 14 days in advance of visit(Attachment 2) and provide to N3B Security for processing. Form must have full name to include middle name, if no middle name please indicate NMN, initials only must be indicated by 10, dates access is required, and subcontractor information to include name of subcontractor, the subcontractor point of contact and phone number and email. Subcontractors never badged at LANL will have to be approved in the LANL Badging System, which can take up to 7 working days.

To obtain a Generic Un-cleared US Citizen Visitor's badge requires Real ID approved proof of U.S. citizenship to the LANL Badge office.

Badge requests will only be issued for the length of the subcontract.

Proof of citizenship includes a declaration of US Citizenship with presentation of an original photo identification card (such as a current and valid state driver's license) together with certified copy of a birth certificate and or passport.

Individuals who attempt to falsely certify their citizenship will be removed from the Laboratory and will be denied future access to LANL.

6.2.2 N3B Security Badge Request Form (Attachment 2)

Form requirements for security badge processing:

Enter the following:

Employee's full name (no initials).

- First or middle name are initial only indicate: (10)

- No middle name indicates: (NMN) Check citizenship Date of Birth and Place of Birth (City and State or Foreign Country and City) Social Security Number Personal Mailing Address N3B Oracle Code: 13890

• N3B Division Codes (Choose from chart below):

Oracle Codes N3B Division Codes

01N000 PM Proarams, HR and Securitv

01N100 CH-TRU

01N200 Environmental Remediation

01 N300 Environment, Safety & Health

01N400 Enaineerina and Nuclear Safetv

01N500 Plannina and lntearation

01 N600 Reaulatory and Stakeholder Interface

01N700 Quality Assurance and Transformation

01N800 Business Services

Phone Number and Position Title Subcontract Organization Name and Subcontract Oracle Code (Choose from chart below):

Subcontractor Organization Oracle Codes Name

3047 Tetra Tech

14077 Sealaska

8411 TPMC

8907 Robert Half Technoloaies

9942 Peak Solutions

8326 Edaewater

1980 Comoa

14191 Lonaenecker & Associates

4134 Adelante

Note: Subcontractor organizations require a subcontract organization code. If a subcontractor does not have an assigned Oracle code a request by the N3B Security Specialist will have to be made to the Oracle Data Entry Group which can take 5 - 10 additional business days.

Subcontract Organization Point of Contact with Telephone and Email

• N3B Contract Number

Gender Email Address Mail Stop (Not required for subcontractors) Visitor (Check for short term visit) Z# (please indicate if Z # was issued in the past) Start and End Date - Time frame of the subcontract Employee Signature and Date Supervisor or Manager Signature and Date

N3B SECURITY BADGE REQUEST FORM EXAMPLE

Name: (Last, First, Full Middle name -110 initials) Please Pri11t Legibly: Citizenship:

I I us I I Other

Date of Birth: Place of Birth: (requiretl to create Z#) Social Security Number:

Address: (personal mailing address) Email Address:

Organization/Contract: Telephone Number: Position Title:

N3B Oracle Company Code:

N3B Division:

Subcontract Org Name: Subcontract Org POC:

Oracle Company Code: Telephone/email:

6.2.3 Subcontract Workers shall:

• Wear the badge, photo-side out, above the waist, on the front side of the body, at all times while on DOE-owned property (i.e., LANL) or on Contractor leased or rented premises;

• Remove the badge and protect it from public view when leaving DOE owned property or Contractor leased or rented premises;

• Present the badge whenever requested by LANL Protective Force personnel.

6.2.4 Lost or Stolen Badge(s)

• Lost or stolen badges must be reported to the STR and LANL Badge Office within 24 hours or the next business day after discovery of the loss, whichever is soonest.

G7.0 Information Security (May 2015)

7.1 Official Use Only (OUO)

QUO information is unclassified with the potential to damage government, commercial or private interests if disseminated to persons who do not have a need-to- know the infonmation to perform their jobs or other DOE-authorized activities.

SUBCONTRACTOR shall protect such information from unauthorized dissemination and shall follow all requirements for QUO and LPI documents specified below.

7.1.1 Access

No security clearance is required for access to QUO or LPI.

7.1.2 Storing

QUO information shall be stored in a locked room or locked receptacle (e.g.

desk, file cabinet, safe). QUO information stored on a computer shall have passwords, authentication, encryption or file access controls in place to protect the files from unauthorized access.

7.1.3 Reproduction

All copies of LANL or N3B QUO must be protected, accessed, stored, marked, transmitted and destroyed in the same manner as the originals.

7.1.4 Transmitting

E-mail messages that contain QUO information should indicate QUO in the first line, before the body of the text. QUO disseminated over networks outside of N3B should be encrypted with NIST-validated encryption software (e.g., Entrust®).

In the case of hard copies being sent outside of LANL, QUO shall be placed in a sealed, opaque envelope marked with the recipient's name, a return address and the words ''To Be Opened by Addressee Only". For interoffice mail within LANL, QUO shall be placed in a sealed, opaque envelope with the recipient's address and the words "To be Opened by Addressee Only" on the front of the envelope.

7.1.5 Destroying

Users are not required to destroy electronic media that contains QUO;

however, disks should be overwritten using approved software before they are thrown away. Hard copy QUO documentation shall be destroyed by using an approved shredder (strips no more than¼ inch wide).

7.2 Unclassified Controlled Nuclear Information (UCNI)

UCNI is certain unclassified but sensitive government information whereby unauthorized dissemination is prohibited. UCNI is intended to be viewed only by those individuals with a need-to-know the specific UCNI to perform their official duties or DOE-authorized activities. SUBCONTRACTOR shall protect such information from unauthorized dissemination and shall follow all requirements for UCNI documents specified below.

7.2.1 Access

No security clearance is required for access to UCNI; however, access is permitted only to those authorized for routine or special access and those who have a need-to-know. UCN/ stored on a computer shall be restricted (passwords, authentication, file access control encryption and offline storage) to only those who have a need-to-know.

7.2.2 Storing

When using UCNI, physical control shall be maintained over the material to prevent unauthorized access to the information. When not in use, UCNI matter shall be stored in a locked room or receptacle (e.g. desk, file cabinet, bookcase or safe). The Jocked receptacle shall have controls that limit access to only approved workers. UCNI stored on a computer shall have passwords, authentication, encryption or file access controls in place for protection.

7.2.3 Transmitting

Ensure that UCNI is marked correctly prior to transmitting it over any media.

Only a qualified Reviewing Official can identify and mark UCNI. Contact the STR or FSO for assistance.

When transmitting over telecommunication circuits (including telephone, fax, radio, e-mail or Internet) encryption algorithms that comply with all applicable Federal Jaws, regulations and standards for the protection of UCNI shall be used.

Transmission over open phone lines is prohibited. A Secure Terminal Equipment (STE) line is required. All cellular devices, including LANL-issued smart phones such as Blackberries must be turned off completely when in proximity to UCNI discussions.

When using e-mail, UCNI shall be encrypted with NIST-validated encryption software such as Entrust®.

7.2.4 Destroying

Hard copy UCNI documents are to be destroyed by shredding in an approved shredder. SUBCONTRACTOR shall coordinate with the Classified Matter Protection and Control Team through the RLM or STR to properly destroy UCNI information.

7.2.5 Noncompliance Consequences

SUBCONTRACTOR'S failure to comply with the requirements pertaining to UCNI may result in the imposition of a civil and/or criminal penalty for each violation.

GB.O Controlled Portable Electronic Devices/ Wireless Technology (April 2017)

The level of control of wireless computing devices and other controlled articles depends on the type of device, who owns it (Government or non-Government), and where it will be located and how it will be used.

8.1 Controlled Portable Electronic Devices (PEDs)

Controlled PEDs are stand-alone devices that can store, read, write, record or transmit data. Certain controlled articles can read and/or write nonvolatile information and plug into a computer. They are not stand-alone devices like other types of controlled articles.

Controlled PEDs are allowed in General Access Areas and Property Protection Areas for official use only. Controlled PEDs are not permitted in a Limited Area without prior authorization. SUBCONTRACTOR shall ensure that controlled articles are not brought into a Limited Area without prior written approval with concurrence by the STR and coordination with LANL.

Controlled PEDs include:

• Smart watch, fitness trackers with Bluetooth, USB or other connect/transmit capabilities;

• Recording equipment (audio, video, optical, or data);

• Copiers or scanners with hard drives;

• Radio frequency (RF) transmitting equipment (including ankle monitoring devices), Infrared (IR), computers or peripherals with active Bluetooth, or other wireless transmission capabilities, unless disabled;

• Electronic equipment with a data exchange port capable of being connected to automatic information system equipment;

• Portable computers including by not limited to: laptops, tablet computers, personal digital assistant (PDAs), palm-top computers, Blackberry devices, Notebooks, iPhones or iPads and watches;

• Portable electronic reading, web-browsing and data collection devices with WiFi or USB connectivity, including but not limited to: Kindles, iPads, Nextbook Tablets, Nook eReaders, Sony Digital Readers, or iPods;

• Any device with a capability to connect to computers or use wireless;

• Cameras -video, still, digital, film or in cell phones. If the use of cameras - either inside or outside of a security area is deemed mission essential - then use of cameras shall be authorized via coordination with the STR and LANL prior to the use of such cameras. A Subcontract Worker using a non- government owned camera on DOE property shall possess a valid DOE/ LANL badge;

• USB memory devices (i.e. thumb drives, memory sticks, jump drives)

8.2 Approvals Required Before Commencement of Work

8.2.1 Prior to the introduction of any controlled PEDs into a Limited Area approval shall be obtained from the STR and with coordination and approval from LANL.

8.2.2 Subcontractors using wireless technology, including construction sites, need to obtain certification and approval from the Cyber Information Security Office prior to engaging the wireless technology. Violations of this requirement may constitute a security infraction and may result in administrative actions up to and including exclusion of a Subcontract Worker from LANL and/or from working on this subcontract.

8.3 Rules for Using Authorized Controlled PEDs in Security Areas

Authorized controlled articles with audio recording or data transmitting capabilities in a Limited Area shall be turned off (for UCNI) or placed in an approved Radio Frequency container whenever:

• An UCNI discussion or phone call is taking place within audible range;

• UCNI computer processing is taking place in the immediate area of the device;

• UCNI faxing is taking place within the immediate area of the device; and

• UCNI copying is taking place on a digital copier in the immediate area of the device.

8.4 Wireless Device Requirements

8.4.1 The use of wireless computing and printing devices such as "Bluetooth" technology or wireless networking protocol is prohibited anywhere at

LANL.

8.4.2 The use of wireless networking, Bluetooth and cell phone technologies is allowed in public areas of the Bradbury Science Museum, the Otowi Cafeteria and public access areas outside buildings such as roadways, sidewalks and parking lots.

8.4.3 The use of wireless networking is not restricted in non-LANL occupied areas of LANL or N3B leased properties such as the Pueblo Complex, White Rock Training Center, and the Merrick and Central Park Square.

8.4.4 These wireless device requirements do not apply to the wireless computing capability used by Subcontractor delivery and shipping workers in the LANL receiving area outside of a building.

8.5 Non-government Owned Controlled PEDs

8.5.1 Non-government owned controlled PEDs may not be connected to any LANL or N3B owned information system or network without written approval; and may not be used to store or process any government controlled unclassified information unless formal approval has been granted and full disc encryption is utilized.

8.5.2 All non-government owned cellular devices, including smart phones such as Blackberries shall be turned off completely when in proximity to UCNI discussions.

8.5.3 When privately-owned vehicles are allowed to enter a Limited Area, controlled articles that are attached to the vehicle (i.e. built-in cell phones, On Star and CD radios) shall be turned off if capable and left in the vehicle. Additional restrictions may apply in some areas and Subcontract workers shall follow local controls.

8.6 Non-government Owned Controlled PEDs

8.6.1 Non-government owned controlled PEDs may not be connected to any LANL or N3B owned information system or network without written approval; and may not be used to store or process any government controlled unclassified information unless formal approval has been granted and full disc encryption is utilized.

8.6.2 All non-government owned cellular devices, including smart phones such as Blackberries shall be turned off completely when in proximity to UCNI discussions.

8.6.3 When privately-owned vehicles are allowed to enter a Limited Area, controlled articles that are attached to the vehicle (i.e. built-in cell phones, On Star and CD radios) shall be turned off if capable and left in the vehicle. Additional restrictions may apply in some areas and Subcontract Workers shall follow local controls.

8. 7 Non-government Wireless Computing Devices

8. 7.1 LANL approval may be required before bringing a non-government computing device (e.g. laptop, Tablet computer, iPad) into a PPA based on local security requirements.

G9.0

G10.0

8. 7.2 LANL Cyber Information Security Office approval is required if computing devices will be in a Limited Area.

8.7.3 Non-government owned wireless computing devices shall be authorized before connecting to any LANL wireless computing resource.

8.8 Connecting to Presentation Systems and Using Equipment Remote Controls

8.8.1 Non-government owned controlled PEDs may be connected to stand-alone presentation equipment and stand-alone systems in PPAs (not LAs)provided:

• The information system has virus detection software active, automatically scanning for malicious code and using the most current definition file and,

• The information system shall not contain any sensitive information that the controlled article owner does not have authorization to access.

Contacts (Aug 2018)

Fire, Bomb Threat, etc. 911

Emergency Management & Response 505-667-6211

After-hours on-call Officer cell phone 505-699-4094

After-hours on-call Duty Officer Pager 505-949-0156

LANL Badge Office 505-667-6901 badge@lanl.gov

Protective Force 505-667-4437

Protective Force after-hours Reporting 505-665-7708

N3B Facility Security Officer 505-695-4108

CONTRACTOR Reviews and Approvals

The undersigned CONTRACTOR representative has reviewed the SOW for the proposed Purchase Request referenced in the footer of this document and represents that all statements listed in Section G2.0 are factually correct.

Jan Penny 01/23/2019

Facility Security Officer ignature Date

Attach men! 1 Security Definitions and Acronyms (Nov 2018)

Word, Phrase or Term Definition

Access Authorization An administrative determination that an individual is eligible for access to classified matter when required by official duties or is eligible for access to, or control over special nuclear material. An access authorization is granted only when it has been determined there is a clearly justified need for an individual to have such access. When granted, an access authorization is referred to as a clearance.

Badge A distinctive tag used for controlling access to facilities & security areas as well as data/information; that provides an individual's name, possibly a photograph, and access authorization type and that may include additional information in electromagnetic, optical, or other form.

Barriers Security area devices that include, but are not limited to, chain link fences, access control points, standard walls that provide the basis for LANL structures and buildings;

and reinforced concrete structures (e.g. vault and vault-type rooms) that are specifically designed to house special nuclear materials and classified matter.

Camera Any photographic device that captures still or video images, either digitally or on film. Any multifunction device with photographic capability is considered a camera.

Contract Administrator/ The duly authorized CONTRACTOR representative who will administer the terms and Procurement Specialist conditions of this subcontract.

Controlled Articles Articles that are controlled due to their potential to be used to record or transmit information without authorization. All such articles are not permitted in a LANL Limited security area or higher security area without prior authorization. Items include government and non-government owned: recording equipment (audio, video, optical or data), cameras (still or video, includes cell phones and iPads with cameras); cell phones;

two-way pagers and personal electronic devices; palm pilots; blackberries; radio frequency transmitting equipment; computers, thumb drives and associated media, including palm-top computers. Additional facility-specific requirements may exist.

Cyber Security Program The program mandated to ensure that the confidentiality, integrity and availability of electronic data, networks and computer systems are maintained, including the protection of data, networks and computing systems from unauthorized access, alteration, modification, disclosure, destruction, transmission, denial of service, subversion of security measures and improper use.

Escort The process of physically accompanying an individual continuously while entering, occupying, and leaving a Security Area to prevent unauthorized disclosure of classified matter or controlled unclassified information.

Foreign National Any person who is not a U.S. citizen (i.e., not a U.S. national). A "stateless" person is considered a foreign national.

Government- Owned All land, buildings, and structures (real property) and portable equipment, records, and EquipmenV Property supplies (other property) that are owned, rented, or leased by the Government and subject to the administrative custody or jurisdiction of DOE.

Word, Phrase or Term Definition

Incident of Security Concern Events which are of concern to the DOE Safeguards & Security Program that warrant preliminary inquiry and subsequent reporting.

Information Security A system of administrative policies and procedures for identifying, marking, and protecting from unauthorized disclosure, information that is authorized protection by executive order or statute.

Information Security Incident Any adverse event caused by an outsider or an insider that threatens the (cyber) security of information resources. May include compromises of integrity, denial-of-service attacks, compromises of confidentiality, loss of accountability or damage to any part of the system.

Key Custodian Personnel appointed by a LANL Group Leader or above to be responsible for keys, cores and padlocks within a specified group or area.

Lab or Laboratory Los Alamos National Laboratory

LANL Property Any area within LANL designated as a "Technical Area" except TA-00, which may be DOE-leased property.

LANL Site- Specific Badge Any non-DOE standard badge issued by the LANL Badge Office and valid for use only at LANL and the federal Los Alamos Field Office.

Need-to-Know A determination made by an authorized holder of classified or unclassified controlled information that a prospective recipient requires access to specific classified or unclassified controlled information in order to perform his or her official or contractual duties of employment.

Non-Government Owned Property owned by a Subcontract worker or Subcontract worker's company.

Official Use Only Information that is unclassified but has the potential to damage government, commercial or private interests if disseminated to persons who do not need to know the information; and falls under at least one of eight Freedom of Information Act (5 U.S.C. 552) exemptions.

Official Visitor A person who works for and primarily represents the interests of an organization other than LANL and its subcontractors and vendors, or a person whose clearance is held on behalf of a DOE organization other than LANL or DOE/LASO, even if such person is employed directly or indirectly by LANL.

Off-site (work) Work conducted at locations/facilities that are not DOE or LANS' owned/leased.

e.g. - at subcontractor's facility.

On-site (work) Work conducted at DOE owned/leased or N3B owned/leased facilities or property.

Operations Security (OPS EC) A systematic process designed to disrupt or defeat the ability of foreign intelligence or other adversaries to exploit sensitive departmental activities or information and to prevent the inadvertent disclosure of such information.

Personal Identification Information that could be used to compromise an individual's identity. Includes Verification documents information that is associated with an individual such as SSN, place of birth, date of birth, mother's maiden name, biometric records, medical history, previous diseases, weight, height, blood pressure, employment history, rating, disciplinary actions, financial information, security clearance history, credit card numbers, and bank account numbers. Typically, information that is readily and easily available (e.g., name, address, e-mail address) is not PII.

Personnel Security A defined set of policies, procedures and activities established to ensure that granting an individual access to classified matter and/or special nuclear material would not endanger the common defense and security, and would be clearly consistent with the national interest.

Prohibited Articles Any item restricted from being introduced into DOE and LANL property, including leased facilities and parking lots. Articles not permitted include leased facilities, and parking lots include: any dangerous weapons (guns, knives), explosives or other dangerous instrument or material likely to cause substantial injury or damage to persons or property; alcoholic beverages including unopened bottles or cans; controlled substances (illegal drugs and associated paraphernalia, but not prescription medication); and other items prohibited by law.

Property Protection Area (PPA) Easily portable, stand-alone devices that can store, read, write, record or transmit data or information. Certain PEDs can read and/or write nonvolatile information and plug into a computer. They are not stand-alone devices (e.g. thumb drives, CD/DVD write-drives, flash memory cards, external hard drives, etc.) like other types of controlled PEDs. PEDs include items capable of recording information or transmitting data such as recording equipment, cameras, portable computers, cell phones, PDAs, iPods, iPads, Blackberry devices, watches, Kindles, Notebooks, etc.

Protective Force Those personnel assigned to protective duties at LANL involving the safeguards and security interests of LANL.

Responsible Line Manager First level of LANL management in the line-management chain responsible for security in his/her organization (e.g., division leader, group leader, program manager or office leader) that establishes and manages security initiatives, allocates resources, assesses performance and provides methods of accountability.

Safeguards and Security Interest A general term for any DOE resource or property that requires protection from malevolent acts. It may include but is not limited to classified matter, special nuclear material and other nuclear materials, secure communications centers, sensitive compartmented information facilities, automated data processing centers, facilities storing and transmitting classified information, vital equipment, or other DOE property.

Security Area A physical space designated for DOE safeguards and security interests that requires physical protection measures. Such protection would entail controlling access to and from the designated area. Security Areas include Property Protection Areas, Limited Areas and Limited Areas with Special Administrative Access Controls, Protected Areas, Material Access Areas, SCIFs and SAPFs.

Security Infraction The documentation of an administrative and/or disciplinary action assigned to an individual or organization which is taken in response to an incident of security concern. Issued to the person or organization determined to be responsible for an incident of security concern.

Subcontract Technical Representative The N3B employee who has technical and performance oversight of the (STR) subcontractor's scope of work including, but not limited to, engineering, procurement, safety, quality, schedule, and coordinated execution of the work that is carried out by the subcontractor. The STR has no authority to direct c.ommercial or technical changes to any subcontract.

Subcontract Worker Includes all individuals employed by SUBCONTRACTOR and those individuals employed by SUBCONTRACTOR'S lower-tier subcontractors and suppliers, who work forN3B (on-site and /or off-site); and deliver services to N3B.

Violation Any action or intent that constitutes a violation of U.S. law or Executive Order or implementing directives. An infringement of security rules and regulations.

Visitor An individual who is not employed to work at LANL on either A full or part- time basis.

Vouching An activity in which an individual (other than a member of the Protective Force) visually verifies the access authorization of another person for the purpose of piggybacking into a Security Area. Vouching is not allowed in security areas.

Wireless Devices Any device that enables electronic communication without physical connections. Such technologies typically use radio frequency (RF) or infrared (IR) transmissions as the means for transmitting data.

Worker Any person who performs work at or for the Laboratory; whether at the Laboratory's DOE-owned, leased or rented property or at off-site locations. Workers include LAN$ employees, subcontractors, vendors, external organization employees, affiliates and official visitors.

Acronym Full Name

Ad/STR Administrative Subcontract Technical Representative AT Applied Technology CA/PS Contract Administrator/ Procurement Specialist CMPC Classified Matter Protection and Control CSSM Cyber Security Site Manager csso Cyber Systems Security Officer DC Derivative Classifier

DOE Department of Energy GET General Employee Training ISSM Integrated Safeguards and Security Management ISSO Information Systems Security Officer

LA Limited Area

LANL Los Alamos National Laboratory NNSA National Nuclear Security Administration OPSEC Operations Security OUO Official Use Only

PED Portable Electronic Device PESD Portable Electronic Storage Devices PII Personally Identifiable Information

POC Point of Contact

PPA Property Protection Area

RLM Responsible Line Manager sow Statement of Work/Scope of Work

STR Subcontract Technical Representative UCNI Unclassified Controlled Nuclear Information

Attachment 2

U.S. Department of Energy EM Los Alamos Site Office

External Agency Request for Badging and Z#'s By signing the official signature block, I hereby declare and certify that I am a citizen of the below stated country.

Name: (Last, First, Full Middle name - no initials) Please Print Legibly: Citizenship:

I I us I I Other

Date of Birth: Place of Birth: (required to create Z#) Social Security Number:

Address: (personal mailing address) Email Address:

Organization/Contract:

N3B Oracle Company Cotle:

Telephone Number: Position Title:

N3B Division:

Subcontract Org Name: Subcontract Org POC:

Oracle Company Cotle: Telepl,one/email:

Contract Number: N3B Contract# 89303318CEM000007 Gender: [ ] Male [ ] Female

E-mail address:

Z#: Contract Start Date: 1

, Contract End Date: (Maximum 1 Year)

Employee's Signature: Date:

Subcontract POC or Supervisor's Name Subcontract POC or Supervisor's Signature:

Please Pri11t Legibly:

Telephone Number: Email Address: Date:

Revised: August 2018 Submit Requests to: Reggie Bryant - Phone: (505) 695-4113 or Jan Penny- Phone: (505) 695-4108 Reggie.bryant@em-la.doe.gov