RTP_SEC_AttchC-2-PWS_SOW SCI Security Language vSep 2025.docx
DOCX document 45 KB Posted
- Solicitation number
- HM047627XXXX
About this file
This is a Performance Work Statement and Security Classification Specification document outlining comprehensive security requirements for contractor personnel and operations performing classified and unclassified work for the National Geospatial Intelligence Agency (NGA).
Classified Work Requirements: Contractor personnel performing Top Secret/Sensitive Compartmented Information (TS/SCI) work must maintain active TS/SCI clearances and be subject to Counterintelligence-Scope Polygraph examinations, with individuals not tested within five years required to complete polygraph testing within 90 days (maximum three sessions). All cleared contractors must possess current Top Secret Personnel Security Clearances eligible for favorable NGA SCI adjudication and must be enrolled in NGA's Continuous Vetting program, Office of Director of National Intelligence Continuous Evaluation System, and RAPBack programs. Contractors must comply with DD Form 254 requirements, NISPOM (32 CFR Part 117), SEAD directives, and report security issues, foreign travel, arrests, and personnel changes to their Facility Security Officer and NGA personnel security. Classified work at non-NGA facilities requires Contracting Officer Representative (COR) approval and must be performed in NGA-accredited SCIFs, Other Government Agency SCIFs, or approved secure collateral spaces with formal agreements. Contractors are prohibited from bringing weapons, cell phones, cameras, recording devices, flash drives, or removable media into NGA installations without prior written security approval. Contractors must notify NGA when personnel no longer support the contract and return all government-furnished items (badges, CACs, hangtags) within four business days of departure.
Unclassified and Information Security Requirements: Uncleared contractor personnel may work on unclassified contract performance at CUI levels with COR written approval; those requiring CUI access for 60 days or less need favorable HSPD-12 adjudication, while those exceeding 60 days require HSPD-12 Tier 1 adjudication, sponsored by NGA. Foreign nationals are prohibited from performing unclassified work without Contracting Officer or COR written approval. Contractors must comply with NGA, DoD, and Intelligence Community information security policies, implement NIST SP 800-171 requirements and 10 U.S.C. Sections 391 and 393, and ensure cloud service providers meet FedRAMP Moderate baseline standards. Cyber incidents affecting covered defense information must be reported to the DoD Cyber Crime Center and COR within 72 hours of discovery, accompanied by comprehensive forensic analysis. Contractors must establish and maintain insider threat programs consistent with Executive Order 13587, reporting events affecting personnel security clearance eligibility, suspected insider threats, improper safeguarding, and suspected loss or compromise of classified information.
View the file
Other files
Show all 28
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
UNCLASSIFIED
Security
Classified Work Performance Security Requirements
Contractors must abide by the DD Form 254 - Contract Security Classification Specification (referred to as DD254 hereafter), the National Industrial Security Program Operating Manual (NISPOM 32 CFR Part 117), and all other applicable security policies and regulations including operational security (OPSEC) requirements.
Defense Counterintelligence and Security Agency (DCSA) remains the Cognizant Security Agency (CSA) for individuals performing work with collateral (SECRET or TOP SECRET) security clearances. As such, Security Executive Agent Directive (SEAD) 3 reporting should continue to be provided to the Contractor’s Facility Security Officer (FSO) for reporting to DCSA via Defense Information Security System (DISS). DCSA will also dictate mandatory security training as the CSA for the collateral cleared community.
Personnel Security Requirements
Contractor personnel performing Top Secret/Sensitive Compartmented Information (TS/SCI) work on the contract are required to have active TS/SCI clearances for access to TS/SCI facilities, when performing duties within TS/SCI environments, and for access to TS/SCI computer systems for the performance of this contract. Contractors are subject to a Counterintelligence-Scope Polygraph examination, as requested by NGA. As a condition of employment and assignment, contractors who have not successfully completed polygraph testing within the last five years must immediately schedule a polygraph examination and must complete the process, in no more than three test sessions, within 90 days.
All Contractor personnel shall possess a current Top Secret Personnel Security Clearance and be eligible for favorable NGA adjudication for SCI access. The government will be responsible for verifying security clearances/SCI eligibility of the Contractor personnel in accordance with (IAW) SEAD 7: “Reciprocity of Background Investigations and National Security Adjudications”. If needed, NGA will sponsor SCI accesses at its sole discretion. NGA will provide badges, Common Access Cards (CAC) and other items (e.g. parking hangtags) when applicable, for required Contractor personnel.
Upon onboarding, all cleared NGA contractors shall be enrolled into the NGA Continuous Vetting program and the Office of Director of National Intelligence Continuous Evaluation System IAW SEAD 6: “Continuous Evaluation” and Trusted Workforce (TW) 2.0 requirements. Cleared NGA contractors must report new applicable security issues, new foreign travel/contacts, and other required information to their FSO and NGA personnel security IAW SEAD 3: “Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position” and NGA Instruction 5205.3: “Security Reporting Requirements”. Additionally, cleared NGA contractors will be required to be enrolled into a Report of Arrest and Prosecution Background (RAPBack) program, which also complies with TW 2.0 requirements.
Cleared NGA contractors who are designated to participate in NGA’s annual Security Financial Disclosure Program (SFDP) must comply IAW with NGA SFDP requirements.
The Contractor shall inform NGA as soon as practicable when its employees will no longer support the contract (see DD254). NGA desires notification prior to the day the individual no longer supports the contract, but requires notification no later than the day that contract support ends. If Contractor personnel will no longer be supporting NGA via an NGA contract, NGA shall take all appropriate action, up to and including debriefing the contractor from SCI access and terminating logical and physical access to NGA IT systems and facilities.
Upon notifying NGA that a Contractor will no longer support the contract, the Contractor must return all NGA Badges, CAC, hangtag, and any other government furnished property. These items can be returned to the NGA Workforce Support Center, NGA Site Security Office, or the Contracting Officer Representative (COR) as soon as practicable, but no later than four (4) business days from the date of Contractor departure.
When Contractor personnel are unable to turn these items into the NGA Workforce Support Center, NGA Site Security Office, or COR then it is the responsibility of the Contractor’s FSO to collect the items from the individual and return them to NGA as soon as practicable, but no later than four (4) business days from the date of Contractor departure.
If the FSO debriefs their employee, the FSO shall provide a copy of the debriefing statement, plus all applicable Government-furnished items (e.g. NGA Badge, CAC, Courier Card, parking hangtags, etc.) to the NGA Site Security Office or the NGA Workforce Support Center as soon as practicable, but no later than four (4) business days from the date of Contractor departure.
Physical Security Requirements
All classified work performed at a non-NGA facility must be approved by the COR. Any classified work performed at contractor sites must be performed in either an NGA accredited SCIF, Other Government Agency (OGA) SCIF, or an approved secure collateral space that has either a Memorandum of Agreement (MOA), Memorandum of Understanding (MOU), Joint Use Agreement or Co-Use Agreement with NGA for this contract. SCIF or secure facility accreditation shall be at least the level commensurate with the level of safeguarding required by the contract DD254.
Pursuant to “IC Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities Version 1.5.1; IC Tech Specs for ICD/ICS 705”, the NGA accrediting official, or designee, shall conduct periodic security inspections/reviews to ensure the efficiency of NGA accredited SCIF operations, identify deficiencies, and document corrective actions taken. Inspections/reviews of NGA accredited SCIFs shall be conducted based on threat, facility modifications, sensitivity of programs, past security performance, or at least every five years. Technical Surveillance Countermeasures (TSCM) activities in NGA accredited SCIFs will only be conducted by NGA TSCM teams consisting of NGA military, civilian, or contractor personnel who have successfully completed approved TSCM training. Authorized inspectors shall be admitted to a SCIF without delay or hindrance when inspection personnel are properly certified to have the appropriate level of security clearance and SCI indoctrination for the security level of the SCIF.
Contractor personnel are forbidden from bringing prohibited or unauthorized items into any NGA installation or other secure facility covered under this contract. These items include weapons, cell phones, cameras, two-way pagers, laptops, recording devices of any kind, flash drives, or any other removable media. Exceptions may be granted by NGA Security upon the Contractor’s request. If granted, Contractor personnel must bring documentation showing approval prior to entering with the item(s). Violations may subject the Contractor and its offending personnel to civil and/or criminal liability IAW applicable laws and regulations governing access to secure Government facilities.
Unclassified Work Performance Security Requirements If applicable, and after discussion with the COR, and the COR has provided written approval, uncleared Contractor personnel are authorized to work on this contract at the Unclassified level, with access up to DoD Controlled Unclassified Information (CUI) at the Contractor site without the requirement of a security clearance.
Uncleared Personnel Security Requirements
| If applicable, and after discussion with the COR, and the COR has provided written approval, any Contractor personnel working with CUI information must receive a favorable HSPD-12 and/or HSPD-12 Tier 1 adjudication prior to accessing CUI information. Contractor personnel who require access to CUI for 60 days or less must receive a favorable HSPD-12 adjudication. Contractor personnel who require CUI access for more than 60 days must receive a favorable HSPD-12 Tier 1 adjudication. NGA will sponsor the HSPD-12 and HSPD-12 Tier 1 background investigation for Contractor personnel as needed. |
| Foreign nationals are not permitted to perform unclassified work under the terms of this contract without prior written approval from the Contracting Officer (CO) or the COR. Should NGA identify the use of unauthorized personnel, the CO may direct the Contractor, at its own expense, to remove and replace any unauthorized Contractors, Subcontractors, or other personnel performing on the contract. Such action may be taken at the NGA's discretion without prejudice to its rights under any other contract provision, e.g., termination for default. |
Uncleared Contractor personnel visiting NGA facilities or other sites may receive the appropriate visitor badge and be escorted, as appropriate. The Contractor will return the visitor badge at the end of each visit day.
Information Security Requirements NGA shall have the sole authority to determine whether, and to what extent, protected information shall be provided to the Contractor under the terms of the contract. Access to classified information will be pursuant to the security requirements established in the DD254. The Contractor shall not access, download, print, or further disseminate any classified information outside the execution of the defined contract requirements without the guidance and written permission from the COR.
When the Contractor receives protected information under the terms of this contract, the Contractor will comply with all applicable NGA, DoD, and IC information security policies (including the Consolidated NGA (CoNGA) Security Classification Guide) for the proper marking, handling, processing, storing, and safeguarding of classified and unclassified material. The Contractor will ensure that document markings are given the lowest possible security classification to maximize dissemination while still maintaining the information’s confidentiality and integrity as necessary.
Access to CUI will be pursuant to DFARS clause 252.204.7012. The prime contractor shall include this clause, including paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support or for which subcontract performance will involve covered defense information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for Subcontractor performance retains its identity as covered defense information and will require protection under this clause. Contractor personnel shall not release any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the COR has given prior written approval or in performance of a project that has been scoped and negotiated by NGA.
NGA will assess and authorize Contractors to process classified information on government-owned information systems, conduct oversight of such information system processing, and provide information system security guidelines IAW with FAR clause 52.204-21 and other information system security control policies, standards, and procedures. Contractor will be responsible for executing specific provisions under the contract for the accreditation of classified information systems, and upon request, shall provide the COR a written statement confirming accreditation compliance with the minimum information systems requirements established in the DD254. The Contractor shall include the substance of FAR clause 52.204-21 in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the Subcontractor may have federal contract information residing in or transiting through its information system.
In accordance with FAR Part 4.7 and FAR clause 52.215-2, the Contractor may retain one archival copy of any Government-furnished information provided to the Contractor during the course of performance of the contract, subject to Contractor following relevant data safeguarding practices and CUI restrictions. The disposition of such Government-furnished information is otherwise solely at the discretion of the Government. As directed by the NGA CO or COR, the Contractor will destroy or return to NGA all Government-furnished information upon contract termination or when no longer required for contract performance.
In situations when electronic transmission is not practicable, Cleared Contractor personnel may hand-carry contract-related classified information when authorized by the COR in writing. Approved Contractor personnel must obtain NGA courier authorization prior to hand-carrying of classified contract-related information. Only classified information related to the performance of this contract may be hand-carried. Contractor personnel will be limited to hand-carrying classified information between approved Contractor facilities and US Government facilities unless the COR approves other circumstances in writing, when applicable, on a case-by-case basis.
Cybersecurity Requirements
| The Contractor must, at a minimum, implement 10 U.S.C. Sections 391 and 393 along with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” requirements. |
| If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/) |
| In the event that the Contractor discovers a cyber incident that affects a covered Contractor information system or covered defense information residing therein, or that affects the Contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall— |
1. Notify the DoD Cyber Crime Center (DC3) and the COR in writing within 72 hours of incident discovery
2. Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered Contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support.
In the event the Contractor discovers and isolates malicious software in connection with a reported cyber incident, the Contractor shall submit the malicious software to DC3 in accordance with instructions provided by the COR. The Contractor should NOT send the malicious software to the COR.
Insider Threat Requirements Contractor will establish and maintain an insider threat program to gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O. 13587 “Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information” and Presidential Memorandum “National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs.” As soon as practicable, Contractor shall report to the COR events that may have an effect on the status of the entity's or an employee's eligibility for access to classified information; report events that indicate an insider threat to classified information or to employees with access to classified information; report events that affect proper safeguarding of classified information; and report events that indicate classified information has been, or is suspected to be, lost or compromised.
File details come from the government source that posted it. Updated .