A01_SEPM_IDIQ_DD254_CONTINUATION.pdf

DD FORM 254, BLOCK 13, CONTINUATION

CONTRACT # TBD

SOLICITATION #: W15P7T-18-R-0005

1a. The highest level of facility clearance required for the contractor to perform on the Contract is contingent upon the Task Order. Contractors must have a final top secret FCL prior to the award of an SCI contract. A contractor that possesses an interim top secret FCL is prohibited from access to SCI. Contractor employees that will perform work on SCI contracts must meet ICD 704 eligibility requirements and be indoctrinated for SCI.

1b. Contractor will not store any classified materials at the contractor’s facility.

DD Forms 254: Overarching security requirements and Contractor access to classified information shall be as specified in the base DD Form 254, which will be further identified in the DD Form 254 for each TO, as required.

Offerors must have a valid U.S. security clearance of required in block 13 of the Task Order or higher in order to respond to this RFP (Announcement), because the RFP (Announcement) includes an annex (information) classified at the [to be filled in by the contracting officer] level which will be released only to offerors possessing the appropriate clearance. All classified material must be handled in accordance with the National Industrial Security Program Operating Manual (NISPOM) (DoD 5220-22-M) and Industrial Security Regulation (DoD 5220.22-R).

8a/11f.

8. Actual Locations

CONUS Locations Aberdeen Proving Ground, MD Camp Dodge, IA China Lake, CA Fort Hood, TX

Fort Belvoir, VA Fort Benning, GA Fort Bliss, TX Fort Bragg, NC

Fort Campbell, KY Fort Carson, CO Fort Drum, NY Fort Eustis, VA

Fort Gordon, GA Fort Huachuca, AZ Fort Indiantown Gap, PA Fort Irwin, CA

Fort Leavenworth, KS Fort Leonard Wood, MO Fort Meade, MD Fort Monroe, VA

Fort Polk, LA Fort Riley, KS Fort Sill, OK Fort Stewart, GA

Fort Washington, PA Fort Wainwright, AK

Joint Base Elmendorf- Richardson, AK

Joint Base Lewis- McChord, WA

Joint Base McGuire- Dix-Lakehurst, NJ

Pentagon, Washington DC Quantico, VA

Redstone Arsenal, AL

Schofield Barracks, HI Tobyhanna Army Depot, PA White Sands, NM

Yuma Proving Ground, AZ

OCONUS Locations

Afghanistan Africa Australia Cuba

Egypt France Germany Japan

Korea Kuwait Pakistan Qatar

United Arab Emirates United Kingdom

10a. Classified COMSEC material is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. COMSEC access shall be IAW DoD 5220.22-M, Chapter 9, Section 4, AR 380-40 and Additional Security Guidelines for COMSEC, Appendix A. When access is required at Government facilities, contractor personnel will adhere to COMSEC rules and regulations as mandated by Command policy and procedures. Concurrence of the KO is required prior to subcontractors working on the program. Copies of the subcontract DD Form 254 will be forwarded to the KO for the Contract file and to CECOM G2 for DD Form 254 tracker information. Per AR 380-40, Chapter 4: Contractor personnel are subject to the Department of Army Cryptographic Access Program (DACAP).10e(1). SCI Access is required and is only authorized for contractors who require SCI access to perform their duties No public release of information authorized, public disclosure or confirmation of any subject related to the support contract is not authorized without first obtaining approval from the KO. Access to Intelligence information requires a U.S. Government clearance at the appropriate level. See US Army SCI Addendum to DD Form 254, Appendix B. Access to SCI intelligence information required a final U.S. Government clearance to TOP SECRET and indoctrinated for SCI access; which includes indoctrination to SI/TK/G/HCS and indoctrination to NATO Secret, as relayed by the Ground Intelligence Support Activity (GISA). Contractor is not authorized to further disclose or release SCI (including release to a subcontractor) without prior written authorization of the releasing agency. A copy of the written authorization will be sent to the Contracting Officer to be included in the file and a copy sent to CECOM G2 to be included in the tracker contract file under the Prime contract number.

10e(2) Non-SCI Intelligence Materials access required for performance by contractor.

Non-SCI Information is not releasable to contractor employees who have not received a clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting.

10g. Personnel not assigned to a NATO staff position, but requiring access to NATO classified information, NATO Secret or access to the NATO accredited SIPRNET terminals, must possess the equivalent FINAL U.S. Security Clearance based upon the appropriate personnel security investigation required. Personnel with access to NATO ATOMAL information must have the appropriate level FINAL U.S. Security Clearance.

The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees are NATO briefed prior to access being granted. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM Ch. 10, Section 7. Prior approval from the KO is required for subcontracting. All Contractor facilities approved for SCI Networks must send a copy of the Facility Checklist; Co-Use Agreements, MOA/MOUs and Facility and Network Accreditations documents to CECOM G2, Industrial Security.

10h. Foreign Government Information (FGI) is not releasable to contractor employees who have not received a FINAL clearance at the appropriate U.S. Government clearance at the appropriate level. Refer to AR 380-5, Chapter 4, Section VII for additional guidance. Written concurrence of the KO is required prior to subcontracting.

10j. Controlled Unclassified Information (CUI) for example, For Official Use Only (FOUO) information generated and/or provided under this contract shall be safeguarded and marked as specified in AR 25-55 and DoD 5200.1-M (Marking is in Volume 2).

10k. SIPRNET ACCESS: All contractors requiring access to the SIPRNET MUST HAVE A FINAL SECRET CLEARANCE OR Interim Top Secret clearance. All contractors with SIPRNET access MUST receive COMSEC and NATO Awareness briefings from their FSO prior to being granted access. COMSEC and NATO Awareness Briefing dates must be recorded on all visit requests. The NATO Awareness Briefing is required to inform personnel how to protect NATO information in the event they come across it while accessing SIPRNET. The contractor shall not access, download or further disseminate any special access date (i.e., intelligence, NATO, COMSEC, etc.)

outside the execution of the defined contract requirements. All contractors will read the NATO Central Registry awareness briefing located at:

https://secureweb.hqda.pentagon.mil/cusr/forms.aspx prior to being issued a SIPRNet account. This briefing does not authorize NATO access, and is solely for the purpose of awareness.

Access to SIPRNet is required at Government facilities only. All contractors granted SIPRNet access must be aware that they are not authorized to download ANY classified material without the guidance and written permission of the Cognizant Security Agency.

The contractor shall adhere to the PEO C3T Security Classification Guide (SCG) for WINT-T Inc 1 dated 15 Feb 2012.

11a. Contractor performance is restricted to Government facility(ies). Government agency or activity will provide security classification guidance for performance of this contract. Submit visit request to the KO and/or Security Management Office for need-to-know verification.

11f. The contractor will have access to classified information at the following OCONUS locations: (list OCONUS locations). See 8a/11f above

11f. Personnel Recovery Program for Contractor Personnel Traveling Overseas.US based contractor employees and associated sub-contractor employees will submit an Isolated Personnel Report (ISOPREP) prior to deployment, in accordance with AR 525- 28, Personnel Recovery. The contractor is required to fill out the survey on NIPRNET at https://medinah.sed.apg.army.mil/PRO-File prior to deployment.

11g. The contractor is authorized the use of the Defense Technical Information Center (DTIC) or other secondary distribution center. The contractor will prepare DD Forms 1540 and 2345 for authorized access to DTIC. Completed forms will be provided to the KO for processing.

11j. Contractor shall adhere to the OPSEC requirements IAW the following Program

OPSEC Plan/SOP: OPSEC Plan for PEO C3T 13 Sep 16 as listed in the PWS. Level I OPSEC training is available at the following website:

http://cdse.edu/catalog/elearning/GS130.html (Duration: 45 minutes).

13a. Contractor personnel performing IT sensitive duties are subject to investigative and assignment requirements IAW AR 25-2, AR 380-67, DoD 8570.0 and affiliated regulations. Army regulation available at www.apd.army.mil

13b. Foreign subcontractors, foreign vendors and/or visitors that are not cleared US Companies, participating in Army foreign disclosure issues will be handled in accordance with AR 380-10, Appendix G, para G-4.

All disclosures (i.e. oral, visual, briefing, documents) to foreign nationals require prior approval by the foreign disclosure officer.

All requests for non-US cleared Foreign subcontractor and/or Foreign own companies to perform on this contract must be requested from the Prime Contract to the KO through Program Office and approved by Foreign Disclosure Officer.

13c. Classified information will be protected IAW the NISPOM, Chapter 5. All security incidents involving classified information will be reported to the KO and forwarded to the PM so a program damage assessment can be conducted.

13d. All subcontractor DD254s and subcontractor tier DD254s will be sent to the KO.

Any Contractors/subcontractors owned by Foreign Companies and that have a clearance issued by the Defense Security Service under a Special Security Agreement need to have a National Interest Determination (NID) approved if access is required to:

Top Secret; COMSEC; Restricted Data; SCI and/or SAP. NID requirements and justification must be sent through CECOM G2 to be forwarded to the approving agencies. Only after a NID approval is received will a FOCI contracting firm be authorized to work on the program.

13e. Security Training and Briefing: IAW AR 380-49 Chapter 3, the FSO will provide Threat Awareness and Reporting Program (TARP) training in addition to initial and refresher security training IAW AR 381-12, paragraph 1-14 and Chapter 2 for contractors working in contractor facilities. Contractors may be exempt from such security training if they can provide documentation they have had similar training from their FSO. The FSO will forward Certificates and/or a signed Letter of Certification for Training to the COR for verification of required training to be included in the contract folder. Integrated/embedded contractors will receive security training from the assigned CECOM Security Manager/Representative. Some Security training provided to integrated/embedded contractors will include:

TARP Training: Live training provided by 902d MI (Annual training requirement) Initial Security Orientation. Online training available on the Army Learning

Management System (ALMS) site, reference ALARACT 207-2103.

Annual Security Orientation: Online training available on the Army Learning Management System (ALMS) site, reference ALARACT 207-2103

Biannual training requirement Derivative Classification Training, reference DoD 5200.01-V3 Operations Security Training, and AR 530-1 (Annual training requirement)

Foreign travel training, AR 525-13 – Required when traveling abroad

Any training requirements that the Government installation or tenant facilities require of the contractors must be added to the DD 254 and the security section of the contract document.

13f. The contractor must submit subcontracts to DD254’s to the KO for the contract file and forward to CECOM G2 approval.

13g. All Facility Clearance sponsorships for subcontractors must have Government approval and certification on the subcontractor’s DD 254. Submit all requests to the CECOM G2 security office.

13h. Records of security related training of contractors and imbedded contractors must be available for review.

13i. Spillage. A spillage occurs whenever classified information or controlled unclassified information (CUI) is transferred onto an information system not authorized for the appropriate security level or not having the required CUI protection or access controls. Contractors responsible for a willful or negligent spillage of classified information shall pay enterprise service providers for the associated cleanup costs across the enterprise to restore the affected network or networks to a normal operating configuration.

Certification and Signature: Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

James M. Mabrey Date Contracting Officer Representative

PEO C3T

Richard E. Greel, Jr. Date SCI Contract Monitor

PEO C3T