SignedSecond Solicitation DD Form 254 160th AITEL recompete20240423.pdf

CLASSIFICATION (When filled in): Unclassified

A2205

PREVIOUS EDITION IS OBSOLETE. Page 1 of 3DD FORM 254, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED (See Instructions)

Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

None (See instructions)

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

Not for award, see block 6a below.

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER

W91RUS-24-R-0020

DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

20240422

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

**This DD Form 254 is for planning/solicitation purposes only. It may not reflect accurate security requirements at time of contract award as changes to requirements may occur after date of signatures on this form. If received w/ a contract award, immediately notify the KO**

b. CAGE CODE

TBD

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

TBD

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

a. NAME, ADDRESS, AND ZIP CODE

N/A

b. CAGE CODE

N/A

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

N/A

8. ACTUAL PERFORMANCE (Click button to add more locations.)

a. LOCATION(S) (For actual performance, see instructions.)

160th Signal Bde, 54th & 25th Signal Battalions.

Encompasses various locations in Kuwait, Qatar, and other locations as may be specified in the Scope (para 2.0) of the PWS.

b. CAGE CODE (If applicable, see Instructions.)

N/A

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

160th Signal Brigade Camp Arifjan, Kuwait

APO AE 09366

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

Performance under this contract will require travel between the various 160th Signal Brigade sites, facilities, and forward deployed locations.The Contractor shall provide Brigade and Battalion levels of staff support services in the areas of Administrative support, Operations support, Information Systems Engineering Support, and Logistics Support to the 160th Signal Brigade and subordinate commands within the CENTCOM Area of Operation (AOR), which is roughly defined as being located in Southwest and Central Asia. Performance under this contract will require travel between the various 160th Signal Brigade sites, facilities, and forward deployed locations.

A2205

PREVIOUS EDITION IS OBSOLETE. Page 2 of 3DD FORM 254, APR 2018

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA

g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.)

h. FOREIGN GOVERMENT INFORMATION

d. FORMERLY RESTRICTED DATA

i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

NIPRNET/SIPRNET/other systems as required.

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDI 5200.48, only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

Have information technology (IT) requirements. See Bloxk 13 continuation sheets.

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

160th Signal Brigade

Public Release Authority:

Contracting Officer

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

(See Block 13 Continuation Sheets for additional guidance and requirements.)

The undersigned acknowledges: they have identified the basic security requirements for this work effort; reviewed, understand, and agree with those requirements as stated in this Security Specification/continuation sheets (to include related attachment(s) or addendum(s), if any). The undersigned will ensure compliance with the provisions within the limits of his/her responsibility. Furthermore, the undersigned will report any security incidents to the supporting Government Security Manager and the Contracting Officer (KO).

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

A2205

PREVIOUS EDITION IS OBSOLETE. Page 3 of 3DD FORM 254, APR 2018

160th Signal Brigade Camp Arifjan, Kuwait

NAME & TITLE OF REVIEWING OFFICIAL

Renee Hunter Contracting Officer Representative

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

See Block 13 Continuation Sheets for additional guidance and requirements.

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

Contractor personnel are embedded into the Government workforce at Government work locations. The 160th Signal Brigade will conduct security inspections of all work locations under this contract. When contractor personnel are embedded or integrated into the Government workforce, they are also integrated into the Government Requiring Activity AR 380-5 inspection program.

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

ACC-APG Huachuca Division

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

W91RUS

c. ADDRESS (Include ZIP Code)

ACC-APG Huachuca Division 2133 Cushing Street Building 61801 (Greely Hall) Fort Huachuca, AZ 85613

d. POC NAME

Brooke J. Henderson

e. POC TELEPHONE (Include Area Code)

+1 (520) 538-7459

f. EMAIL ADDRESS (See Instructions) brooke.j.henderson.civ@army.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

DANIEL, Sandra L.

b. TITLE

Senior Industrial Security Specialist

c. ADDRESS (Include ZIP Code)

NETCOM ACofS, G2 2133 Cushing Street (Building 61801) Fort Huachuca, AZ 85613

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

W61DEG

e. CAGE CODE OF THE PRIME CONTRACTOR (See Instructions.)

N/A

f. TELEPHONE (Include Area Code)

+1 (571) 588-3920

g. EMAIL ADDRESS (See Instructions) sandra.l.daniel4.civ@army.mil

h. SIGNATURE

i. DATE SIGNED (See Instructions)

20240423

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

As required.

HUNTER.RENEE.

MARIE.1091083643

Digitally signed by

HUNTER.RENEE.MARIE.10910

83643 Date: 2024.04.23 10:31:26 +03'00'

DANIEL.

SANDRA

.LOIS.12

31468575

Digitally signed by

DANIEL.SAND

RA.LOIS.12314

68575 Date: 2024.04.23 06:59:01 -07'00'

Contract # TBD Solicitation # W91RUS-24-R-0020 160th Signal Brigade Administration, Information Technology Engineering and Logistics (AITEL) Support DD Form 254 20240422 Block 13 Continuation Sheet 1 of 20

This contract requires access to proscribed information. Proscribed information is defined in 32 Code of Federal Regulations (CFR) part 117, National Industrial Security Program Operating Manual (NISPOM), as Top Secret information, Communications Security (COMSEC) information or material, excluding controlled cryptographic items when unkeyed or utilized with unclassified keys; Restricted Data (RD), Special Access Program (SAP) information; or Sensitive Compartmented Information (SCI). Subcontracting any work effort that requires access to proscribed information requires prior written approval of the Government Contracting Office (KO).

1. Government responsibility: The 160th Signal Brigade has exclusive responsibility for all classified documents, materials and other classified information and will furnish complete classification guidance for services performed. Storage for all classified material will be the responsibility of the 160th Signal Brigade.

The local US security authority will brief and train contractor personnel on security procedures to be followed at work facilities. The 160th Signal Brigade will provide contractor personnel written security guidelines for the protection of facilities and classified information.

2. Contractor responsibilities: All contractor personnel shall in-process through 160th Signal Brigade S-2 or respective Battalion S-2 for initial security briefings. All contractor personnel shall attend Brigade/Battalion provided annual security briefings/training. Contractor personnel shall comply with all security policies, procedures, and requirements of this contract for the protection of classified information, networks, and facilities. This includes security policies, procedures, and guidelines in effect at all TDY locations. The Contractor shall immediately report any violation of security policies, requirements, or procedures to the Contracting Officer’s Representative (COR), Brigade/Battalion S-2, and if directed by the COR, further reported to the Contracting Officer (KO).

3. Ref Block 1a - The Contractor and all proposed subcontractors require, as a minimum, an Active FINAL SECRET Facility Clearance (FCL) at time of proposal submission. Access to classified information under this contract shall not exceed the SECRET level.

4. Ref Block 1b - There is no requirement for the Contractor to establish or maintain safeguarding capability for classified information in support of this contract, at any Contractor facility.

5. Ref Block 8a and 8c – The ACC-APG (Huachuca Division), Ft. Huachuca, AZ will award and administer this contract.

6. Ref Block 10a – There may be a future need for contractor access to Communications Security (COMSEC) information during the life of this contract so Block 10a of the DD Form 254 is checked and COMSEC requirements are included. The Contractor will not be required to establish a COMSEC account. However, some work performance may require access to classified COMSEC information, COMSEC key, Controlled Cryptographic Items (CCI), and/or Cryptographic High Value Products (CHVP) at Government work locations only. There may be a requirement for a supporting Government KMI Operational Account Manager (KOAM) to hand-receipt COMSEC material to properly identified/trained Contractor personnel at specified Government work locations, in order to perform the mission under the terms of the contract. Contractor access to classified COMSEC information requires U.S. citizenship, a final personnel security clearance at the requisite level, established need-to-know in accordance with this contract, and receipt of all required briefings prior to being granted access to such information.

6a. Ref Block 10a - Contractor personnel shall be subject to the Department of the Army Cryptographic Access Program (DACAP) prior to being granted access to any SECRET cryptographic information that meets the criteria established in Committee on National Security Systems Policy (CNSSP) 3

160th Signal Brigade Administration, Information Technology Engineering and Logistics (AITEL) Support DD Form 254 20240422 Block 13 Continuation Sheet 2 of 20 and AR 380-40, Chapter 7. Contractor enrollment in DACAP requires: Receipt of a DACAP briefing administered by the supporting Government requiring activity Security Office, G-2/S-2; written acknowledgement that they may be randomly selected to undergo a non-lifestyle, counterintelligence scope polygraph (CSP) examination administered in accordance with applicable directives and law; agreement to report all foreign travel and contacts IAW CNSSP 3 and AR 380-67; and, execution of Part I, Secretary of Defense (SD) 572 (Cryptographic Access Certification and Termination Statement). By executing Part I, SD 572, the Contractor employee acknowledges and agrees to be subject to a CSP examination as a requirement for continuing access to classified cryptographic information. When such access is no longer required, contractor personnel will be debriefed and shall execute Part II of the SD 572. The Government will deny access to classified cryptographic information to any contractor employee who refuses to participate in DACAP. The Government will also immediately terminate access to classified cryptographic information for any contractor employee who declines to submit to a CSP examination, and that employee shall be debriefed by the government requiring activity Security Office, G-2/S-2. In the event a contractor employee is selected for a CSP examination, the Government will reimburse the Contractor, IAW FAR part 31.205-46, for approved travel incurred to comply with CSP examination requirements under the DACAP.

6b. Ref Block 10a – The Contractor shall control, protect, safeguard, and account for COMSEC, CCI, and/or CHVP in accordance with AR 380-40, AR 710-2, TB 380-41, Local Standard Operating Procedures, and other Army, DoD and National level policy, as directed by the Government requiring activity. National level policies are available at https://www.cnss.gov/cnss/index.cfm and are reflected in the applicable documents section of this contract (PWS and DD Form 254 continuation sheets). The Contractor shall ensure all personnel comply with all applicable regulations and directives, including requiring activity policies and procedures in effect at requiring activity work locations. The Contractor shall remove any Contractor employee who fails to comply with COMSEC directives, policies, and procedures from performance on this contract.

Additionally, contractor employees who violate COMSEC directives, policies and procedures could be subject to criminal prosecution or other legal action.

6c. Ref Block 10a – The Contractor shall ensure personnel are familiar with what constitutes a reportable incident as defined in Committee on National Security Systems Instruction (CNSSI) 4003, AR 380-40, Chapter 6, and in specific operational security doctrine for individual products which identifies unique incidents, and shall report initial incidents immediately but no later than 4 hours after discovery, to the responsible KOAM/alternate KOAM, the Contracting Officer’s Representative (COR), and to the Brigade or respective Battalion S-2. Contractor personnel shall be familiar with the security classification guidelines in AR 380-40, Appendix B and shall ensure any incident information is properly marked/protected and reported via approved secure communications (Secure Voice or SIPRNET) from Government requiring activity work locations.

6d. Ref Block 10a – Contractor access to classified COMSEC information requires the Contractor to have an Active FINAL facility clearance commensurate with or higher than the classification level of information involved. Written approval of the Government KO is required prior to sub-contracting any work effort that requires access to COMSEC information.

7. Ref Block 10e(2) – Access to non-Sensitive Compartmented Information (SCI) intelligence information may be a requirement during some work performance. Non-SCI National Security Intelligence information is not authorized for public release. Access to intelligence information requires a FINAL personnel security clearance at the requisite level. ICD-703, Protection of Classified National Intelligence, Including Sensitive Compartmented Information (SCI), provides policy on control, access, and dissemination of intelligence information. This policy is available from the Government requiring activity. Written approval of the Government KO is required prior to subcontracting any work effort that requires access to intelligence information.

https://www.cnss.gov/cnss/index.cfm

160th Signal Brigade Administration, Information Technology Engineering and Logistics (AITEL) Support DD Form 254 20240422 Block 13 Continuation Sheet 3 of 20

8. Ref Block 10g - (See 10k below).

9. Ref Block 10h – Foreign Government Information (FGI). This block includes any FGI except NATO. Some contractor personnel may have access to FGI by virtue of the functions they are required to perform. Access to FGI requires a FINAL personnel security clearance at the appropriate level, any required on-site briefings, and requires approval of the Government KO prior to subcontracting.

10. Ref Block 10j – Controlled Unclassified Information (CUI). Access to CUI will be a requirement for some work performance on this contract. CUI is unclassified information requiring safeguarding and dissemination controls, consistent with applicable law, regulation, or government-wide policy. CUI includes information such as legacy marked For Official Use Only (FOUO) information, OPSEC sensitive information, critical technology, intelligence information, Privacy information, and Personally Identifiable Information (PII). CUI received or generated under this contract shall be controlled and protected, marked, safeguarded, transmitted, and destroyed as specified in DAG2 (DAMI-CD) Memorandum, 27 Aug 2020. Subject: Implementing Guidance for Department of Defense Instruction 5200.48, Controlled Unclassified Information and DoDI 5200.48, Controlled Unclassified Information (CUI). This includes PII as defined in DoDI 5400.11 (DoD Privacy and Civil Liberties Programs). The Government requiring activity may impose additional protective measures in accordance with theater policy, or as locations or situations dictate. In the case of COMSEC/CCI/CHVP information, provisions of AR 380-40 and National level policies govern.

10a. Ref Block 10j – CUI Training. The Contractor shall ensure that all contractor and subcontractor personnel successfully complete the DoD CUI training. Training is available at Center for Development of Security Excellence (CDSE) website https://securityawareness.usalearning.gov/cui/index.html or at https://www.dodcui.mil/Home/Training/. The Contractor shall ensure all new contractor employees and subcontractors performing work under this contract complete CUI training during new employee in-processing on this contract and annually thereafter. The Contractor shall maintain all CUI training records and shall provide copies to the COR.

11. Ref Block 10k – This work performance will require Contractor access to Non-secure Internet Protocol Router Network (NIPRNET), Secure Internet Protocol Router Network (SIPRNET), and other systems as stated in the Performance Work Statement (PWS). All access to SIPRNET or any other classified systems shall only be at U.S Government controlled work locations. The Contractor shall not access, download or further disseminate any special access data (i.e. intelligence, NATO, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the Government KO.

11a. Ref Block 10k - There is not a defined requirement for access to NATO documents or information under this contract so Block 10g is not checked. However, accreditation of the SIPRNET backbone to transport NATO Secret and below information resulted in additional security measures across the board. Per DoDM 5200.01-V1, all cleared Department of Defense (DoD) military, civilian, and contractor personnel briefed on their responsibilities for protecting U.S. classified military information shall be briefed simultaneously on the requirements for protecting NATO classified information. Access to NATO classified information requires a final personnel security clearance at the requisite level. The Contractor Facility Security Officer (FSO) shall provide a NATO “awareness briefing” to contractor personnel performing work at U.S. Government requiring activity work locations and shall maintain a written acknowledgment of the individual's receipt of the awareness briefing along with statement of understanding of responsibilities for safeguarding NATO classified information.

The NATO awareness briefing is located at the Central United States registry (CUSR) https://cusrcac.army.mil/Training/BriefTraining.aspx?T=3. The general awareness briefing is not a “NATO access briefing” and does not constitute “need to know or approval for access” to NATO classified information.

This briefing shall be recorded in the Defense Information System for Security (DISS), or approved successor system National Background Investigation Services (NBIS) system, when fully implemented. The Contractor https://securityawareness.usalearning.gov/cui/index.html https://www.dodcui.mil/Home/Training/ https://cusrcac.army.mil/Training/BriefTraining.aspx?T=3

160th Signal Brigade Administration, Information Technology Engineering and Logistics (AITEL) Support DD Form 254 20240422 Block 13 Continuation Sheet 4 of 20 shall provide copies of NATO awareness briefings to the COR, upon request. The Contractor shall comply with 32 CFR Part 117 (NISPOM), Section 117.19(g), regarding exposure to NATO information. Approval of the Government KO is required prior to subcontracting.

11b. Ref Block 10k - The COR will provide sponsorship for all system access.

12. Ref Block 11a - Control and custody of all classified information will remain with the 160th Signal Brigade.

All cleared contractor personnel who have an established need-to-know in accordance with this contract, and who have satisfied prerequisite security training requirements, are authorized access to classified information which supports this work effort. Access to classified information shall be at US Government controlled facilities only, to include facilities visited while in a temporary duty (TDY) travel status in support of this contract. The Contractor shall not remove any classified materials or information from the US Government controlled work site(s) unless specifically authorized by the 160th Signal Brigade S2. The Contractor shall not reproduce, generate, or store any classified materials or information relating to this contract at other than specified US Government controlled work locations. This includes downloading, storing, or transmitting classified information on or to any unauthorized software, hardware, or information technology system. The contractor shall not store classified materials except as approved, and provided for, by the 160th Signal Brigade S2.

12a. Ref Block 11a – Within Army, DISS is the system of record for security clearance information until approved successor system, NBIS, is fully implemented. The Contractor FSO shall ensure all cleared personnel performing on this work effort have security access level, Contractor affiliation, Security Management Office (SMO) affiliation and all other required information accurately reflected/populated in DISS or successor system. The Contractor shall make available to the Government requiring activity, and all work locations under this effort, all information necessary to enable verification of security access level/affiliation via DISS or successor system.

12b. Ref Block 11a - Visit Authorization Requests (VARs) are required at all Government work locations. The Contractor shall submit a Visit Authorization Request (VAR) via DISS or successor system that reflects all cleared contractor personnel who will be performing on this contract. VARs shall include the contract number and COR/Government Requiring Activity (RA) POC name and telephone number if system functionality allows. All VARs shall be maintained current throughout the life of the contract and shall be updated and forwarded to the 160th Signal Brigade or respective Battalion S2 as personnel or other relevant changes occur. All Contractor personnel shall be reflected on a current VAR in order to perform on this contract. Prime contractor shall ensure all subcontractors comply with these requirements. The Contractor shall contact the COR for SMO codes for all work locations.

12c. Ref Block 11a - The Contractor shall provide a monthly Security Clearance Access Roster (SCAR) to the Brigade S-2. The SCAR shall be submitted not later than the 3rd calendar day of each month and shall include the contractor and subcontractor employee’s name/social security number/clearance level/clearance granted date/access level and location where work is being performed. The SCAR shall also identify any personnel who have departed during the reporting period. The SCAR is CUI as it includes PII, and shall be marked, protected, safeguarded, transmitted, and destroyed in accordance with DAG2 (DAMI-CD) memorandum, 27 Aug 2020 subject: Implementing Guidance for Department of Defense Instruction 5200.48, and DoDI 5200.48 (Controlled Unclassified Information).

12d. Ref Block 11a – At work performance start date, all contractor personnel shall in-process through the 160th Signal Brigade or respective Battalion S-2 for initial security briefings and other required actions. All contractor personnel shall attend Brigade/Battalion provided initial and annual security briefings/training. All contractor personnel shall out-process/clear through the 160th Signal Brigade or respective Battalion S2 upon

160th Signal Brigade Administration, Information Technology Engineering and Logistics (AITEL) Support DD Form 254 20240422 Block 13 Continuation Sheet 5 of 20 termination of employment on the contract or upon contract expiration/termination, whichever occurs first.

Above requirements are applicable if there is a change in primary work performance location while employed on the contract. The prime contractor shall ensure above requirements are included in sub-contracts and lower tier contracts.

12e. Ref Block 11a - Army Learning Management System (ALMS) Initial Security Orientation and Annual Refresher Training. Within 30 business days of work start date, contractor personnel shall complete the Department of the Army standardized computer web-based Initial Security Orientation training and annually thereafter, shall complete the Annual Security Refresher Training, both available at https://www.lms.army.mil, under Information Security Program training. The system will automatically direct the user to the appropriate course based on their training history. Certificates of successful completion, of initial and annual refresher training, shall be provided to the COR within three (3) business days of completion of training. This training is in addition to unit or installation specific security training.

12f. Ref Block 11a – Certain contractor personnel will be handling accountable mail. Accountable mail is considered Certified, Registered, and/or Overnight Express Mail delivery which are means of transmitting classified material, Secret and below. Handling and safeguarding of mail shall be IAW DoDI 4525.09 (Military Postal Service), AR 600-8-3, (Postal Operations) and AR 380-5 (Army Information Security Program).

Contractors who handle accountable mail, or who work shipping/receiving of accountable mail and/or classified shipments, shall be US citizens and at contract start date, shall have and maintain a U.S. Secret security clearance IAW DoDI 4525.09 Paragraph 3.3(e). Classified shipments shall be handled in accordance with AR 710-1 and AR 710-2. Additional mail handling qualifications will be in accordance with AR 600-8-3 (Postal Operations) Chapter 2-4.

• For outbound shipments, the Contractor shall package and crate material; program and mount remote tracking devices; coordinate pickup by either military transporters or third-party logistics carriers; and perform all related administrative tasks, to include tracking of shipments and obtaining required customs clearance documents.

• For inbound shipments, the Contractor shall use DD Form 361, Transportation Discrepancy

Report, to document the loss, shortage or damage to government material and to support the filing of claims against Transportation Service Providers for Government reimbursement.

13. Ref Block 11e – Contractor shall comply with FAR 52.204-2, Security Requirements. This clause applies to the extent that this contract involves access to information classified “Confidential,” “Secret,” or “Top Secret.” The Contractor shall comply with the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (32 CFR part 117 - NISPOM) and any revisions to that manual, notice of which has been furnished to the Contractor. The 32 CFR part 117 can be viewed at https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117. The NISPOM cross reference tool is available at https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.cdse.edu%2FPortals%2F124%2FD ocuments%2Fjobaids%2Findustrial%2F32CFR_Part117_NISPOM_Rule_Cross_Reference_Tool.xlsx%3Fver %3DNqgEffPBOfDpn_kZcZ83_A%253d%253d&wdOrigin=BROWSELINK

13a. Ref Block 11e - This is a non-personal services contract (See Block 9). Highest-level security clearance requirement for this contract is SECRET. All contractor and sub-contractor personnel performing on this contract shall be U.S. citizens, shall have an active SECRET personnel security clearance at contract performance start date, and shall maintain the required security clearance and access eligibility over the life of the contract. New or replacement personnel shall have the required security clearance and access eligibility at https://www.lms.army.mil/ https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117 https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.cdse.edu%2FPortals%2F124%2FDocuments%2Fjobaids%2Findustrial%2F32CFR_Part117_NISPOM_Rule_Cross_Reference_Tool.xlsx%3Fver%3DNqgEffPBOfDpn_kZcZ83_A%253d%253d&wdOrigin=BROWSELINK https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.cdse.edu%2FPortals%2F124%2FDocuments%2Fjobaids%2Findustrial%2F32CFR_Part117_NISPOM_Rule_Cross_Reference_Tool.xlsx%3Fver%3DNqgEffPBOfDpn_kZcZ83_A%253d%253d&wdOrigin=BROWSELINK https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.cdse.edu%2FPortals%2F124%2FDocuments%2Fjobaids%2Findustrial%2F32CFR_Part117_NISPOM_Rule_Cross_Reference_Tool.xlsx%3Fver%3DNqgEffPBOfDpn_kZcZ83_A%253d%253d&wdOrigin=BROWSELINK

160th Signal Brigade Administration, Information Technology Engineering and Logistics (AITEL) Support DD Form 254 20240422 Block 13 Continuation Sheet 6 of 20 work performance start date. Certain positions, as specified in the footnote to the Network Access and Qualification Requirements Table, below, require a final SECRET security clearance at employee work start date.

13b. Ref Block 11e - Except as specified otherwise in this contract, interim personnel security clearances are acceptable for use on a temporary basis, pending completion of the full investigative requirements and a favorable adjudication. Any associated expenses with obtaining and maintaining contractor security clearances shall be at no cost to the Government.

13c. Ref Block 11e – The Contractor FSO shall monitor all interim security clearances of contractor and/or subcontractor employees performing on this contract and shall immediately notify the COR, the Brigade or respective Battalion S-2, and the KO, of interim declination of security clearance regarding any contractor or subcontractor employee performing on this contract. If the DoD Central Adjudication Facility (CAF) determines a final security clearance cannot be issued, the contractor/subcontractor employee shall be removed from performance on this contract.

13d. Ref Block 11e - HQDA policy limits security clearances and supporting investigations to the level of classified information involved and requires use of the Position Description Tool (PDT), at https://pdt.nbis.mil, to determine/validate these requirements. The Government RA determined security clearance/investigation requirements for this contract via the PDT process and will maintain PDT process results on file. The Contractor should obtain a copy of these results for their file. Security clearance and supporting security investigation requirements for functional categories supporting this contract are included in the Network Access and Qualification Requirements Table, below.

13d(1). Ref Block 11e – Contingent upon PDT results, if a functional category is high risk and requires a higher level investigation than is required for the level of classified information involved (i.e. Secret clearance/T5 investigation), the Contractor shall coordinate with the supporting Government Security Office/G2/S2 for submission of the SF86 for the required T5 fitness/suitability investigation. The Contractor shall provide the contract number and a copy of the Government PDT process results as authority to request the investigation. If a contractor already has a favorable T5 investigation on record in DISS or successor system, the investigative requirement is satisfied. When a fitness/suitability investigation is applicable to a contract, it will be reflected in the “Security Investigation Required” column of the Network Access and Qualification Requirements Table. Contractor interim privileged level access to Army systems prior to completion and favorable fitness determination of the required investigation will be in accordance with current Army and DoD policy.

13e. Ref Block 11e - Classified information generated or received during work performance on this contract shall be controlled, marked, protected, transmitted, safeguarded, and destroyed in accordance with AR 380-5 and current Army and DoD policy and shall only be at specified Government requiring activity work locations.

13f. Ref Block 11e – The process of extracting, summarizing, incorporating, paraphrasing, restating or generating, in new form, information already classified and marking the newly developed material consistent with the classification markings that apply to the source information, is derivative classification. Derivative classification also includes the classification of information based on instructions from a security classification guide/guidance. The duplication or reproduction of existing classified information is not derivative classification. Any derivatively classified information generated during performance under this contract will normally be marked consistent with the classification markings reflected on the source material(s). However, a compilation of information could warrant a change in classification level of the information, or, it could warrant the classification of previously unclassified information. The Contractor shall consult with the COR and the https://pdt.nbis.mil/

160th Signal Brigade Administration, Information Technology Engineering and Logistics (AITEL) Support DD Form 254 20240422 Block 13 Continuation Sheet 7 of 20 supporting Government Security Office/G2/S2 regarding any potential classification issues when generating information and/or deliverables in support of this contract.

13g. Ref Block 11e - The Government requiring activity will identify, or provide, additional instruction or appropriate security classification guides/guidance to the Contractor, as required. The Contractor shall notify the COR, in writing, of any instance where referenced security classification guides/guidance cannot be accessed at links or sites specified in this contract or specified in separate correspondence. The prime contractor shall ensure all applicable security classification guides/guidance are made available to any subcontractor(s), as appropriate.

13h. Ref Block 11e - In accordance with Under Secretary of Defense for Intelligence Memorandum, 31 January 2019, subject: Derivative Classification Training, all Department of Defense (DoD) personnel with access to classified information must complete derivative classification training on an annual basis. All Contractor personnel who require access to classified information during work performance on this contract shall successfully complete initial derivative classification training at employee work performance start date and successfully complete derivative classification refresher training on an annual basis, thereafter. Access to classified includes, but is not limited to, access to classified systems and networks. Contractor initial and continued access to classified systems and networks is contingent upon successful completion of this prescribed training requirement. Derivative classification training is available on line at the Center for Development of Security Excellence (CDSE)/Security Training, Education and Professional Portal (STEPP) website https://www.cdse.edu/stepp/index.html, under Information Security. (Derivative Classification Course (IF103.16)/ Derivative Classification Exam (IF109.06)/Derivative Classification Refresher (IF 109.16)/Derivative Classification Exam (IF 109.06), or current versions). Certificates of successful completion of initial and annual refresher training shall be provided to the COR within three (3) business days of completion of training.

13i. Ref Block 11e - Marking Special Categories of Classified Information. All Contractor personnel who have access to classified information/material, Government information systems, and networks, shall successfully complete initial training for Marking Special Categories of Classified Information and refresher training on an annual basis, thereafter. The website for the training is located at:

https://securityawareness.usalearning.gov/markings/index.htm#. Certificates of successful completion of initial and annual refresher training shall be provided to the COR within three (3) business days of completion of training.

13j. Ref Block 11e - Above training requirements are applicable to subcontractor and lower-tier subcontractor personnel who require access to classified information. The prime Contractor shall require subcontractors to include above requirements in lower tier subcontracts.

14. Ref Block 11f – Contract performance is in Southwest/Central Asia. Contractor personnel will require access to classified information to support this contract. Such access is restricted to US Government controlled compounds/work locations. Storage, custody and control of classified information OCONUS remains the responsibility of the U.S. Government. Hand-carry of classified information to and from CONUS is not authorized. The hand-carry of classified information within the CENTCOM AOR may be authorized ONLY upon receipt of acceptable written justification from the Contractor on reason information/material must be hand-carried and cannot be transported by other approved means. If justification is approved by the Brigade S-2, the Brigade or respective Battalion S-2 will conduct a courier briefing and issue proper courier authorization to designated contractor personnel.

15. Ref Block 11i – There will be no classified work performance (processing or storage) at any Contractor facility in support of this work effort; therefore, Block 11i is NOT checked. However, at the direction of the https://securityawareness.usalearning.gov/markings/index.htm

160th Signal Brigade Administration, Information Technology Engineering and Logistics (AITEL) Support DD Form 254 20240422 Block 13 Continuation Sheet 8 of 20

Government requiring activity, the Contractor may be required to install, or have installed, required TEMPEST countermeasures for information processing equipment at Government work locations only. Installation of such countermeasures will only be accomplished after a technical TEMPEST countermeasure review by a Government (Army) certified TEMPEST technical authority (CTTA), has been completed. TEMPEST countermeasures are designed to reduce or prevent exploitation of compromising emanations by containing them within the inspectable space of the equipment or facility processing classified information. Application of TEMPEST countermeasures will be IAW AR 380-27, CNSSAM TEMPEST 01-13, STIG Vuln ID: V- 30980/30981/30982 and in the case of Protected Distribution Systems (PDS) CNSSI 7003, and/or other applicable directives as situations warrant. Such requirements will be site specific and when required, will be directed by the Government requiring activity.

16. Ref Block 11j –The Contractor is not required to develop an OPSEC Plan. However, the Contractor shall comply with DoD Directive 5205.02E, Army Regulation 530-1, and the requiring activity OPSEC program. Per AR 530-1, the Contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the COR upon request.

17. Ref Block 11l – See Ref 10j, above.

18. Ref Block 11m – Army Cybersecurity

18a. (Ref Block 11m – Army Cybersecurity Mandatory Requirement for all Contractors.

18a(1). (Ref Block 11m) - Army Training and Certification Tracking System (ATCTS) Profile.

Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create an ATCTS user profile at https://atc.us.army.mil, under the unit(s) container designated by the COR. The ATCTS Manager is required to verify the individual’s profile and certification(s), annually for general users and quarterly for privileged users. Contractor employees shall document, update, and retain their training and certification status in ATCTS.

18a(2). (Ref Block 11m) - Cyber Awareness Training. The Contractor shall ensure that all Contractor employees and subcontractor employees as a condition of access to Government information systems and networks shall successfully complete the annual Cyber Awareness training as specified in AR 25-2, DA Pam 25-2-6, and as specified by the Government requiring activity. The Contractor employees and subcontractor employees shall complete the training at the start of work performance on this contract and annually thereafter for the duration of this contract. Cyber Awareness Training is available at https://cs.signal.army.mil or https://jkodirect.jten.mil/.

18a(3). (Ref Block 11m) - Army IT User Agreement. The Contractor shall ensure that all Contractor employees and subcontractor employees sign an Army IT User Agreement (UA) at the same time the Cyber Awareness Training is completed at the start of work performance on this contract and annually thereafter for the duration of this contract. The Army IT UA is available immediately after completing the training at https://cs.signal.army.mil or downloadable from ATCTS under documents.

18b. (Ref Block 11m) - Army Cyberspace Workforce.

18b(1). (Ref Block 11m) - Cyberspace Workforce. Defense Federal Acquisition Regulation Supplement (DFARS) Subpart 239.71 (Security and Privacy for Computer Systems) applies to this contract. This contract is subject to the mandates of DoDD 8140.01, DoDM 8140.03, and supplementary issuance, which establishes the https://jkodirect.jten.mil/

160th Signal Brigade Administration, Information Technology Engineering and Logistics (AITEL) Support DD Form 254 20240422 Block 13 Continuation Sheet 9 of 20 qualification requirement for personnel performing cyber work within these cyber elements: IT, Cyber enablers, cyber effects, cyber (intel), or Cybersecurity.

18b(2). (Ref Block 11m) - Cyberspace Workforce Framework (DCWF). The DCWF framework organizes cybersecurity into categories comprised of several specialty areas. Each specialty area consists of multiple work roles. Contractor employees performing Cyberspace services/functions under this contract as identified in DoDM 8140.03 shall be assigned to the position in writing and coded with a primary DCWF work role code or up to three work role codes, as listed in https://public.cyber.mil/wid/dcwf/work-roles-2/. The Contractor shall document the DCWF code in ATCTS and appointment letter. The 8140 appointment letters are located in ATCTS under Document and at https://atcts.army.mil/iastar/regulations.php. Other services/functions that do not fall under the Cyberspace workforce categories under this contract shall be coded as 011 in ATCTS.

18b(3). (Ref Block 11m) - Qualification Program. The DoD Cyber Workforce Qualification and

Management Program (hereafter referred to…