Attch_0011_DD254_Continuation.docx

8a. Performance will take place at various Continental United States (CONUS) or Outside Continental United States (OCONUS) contractor and Government sites.

9a. Safeguarding "For Official Use Only” (FOUO) information, Appendix D. FOUO Information generated and/or provided under this contract shall be safeguarded and marked as specified in AR 25-55 and DoD 5200.01M (Marking is in Volume 2).

9b. Access to SIPRNET is required. All contractors granted SIPRNET access must be aware that they are not authorized to download ANY classified material without the guidance and written permission of the Cognizant Security Agency. Contractors must also be aware that NATO classified material resides on the SIPRNET and they are not authorized to access, download, or to disseminate any NATO or other special access data (i.e. intelligence, COMSEC, etc.). All contractors will read the NATO Central Registry awareness briefing located at: https://secureweb.hqda.pentagon.mil/cusr/forms.aspx prior to being issued a SIPRNET account.

This briefing does not authorize NATO access, and is solely for the purpose of awareness.

Access to SIPRNet if authorized at contractor facilities requires sponsorship through CECOM G2 for determination of TEMPEST from the Army TPM, 902nd MI Group. IAW AR 380-27, Control of Compromising Emanations (FOUO), 19 May 2010, Chapter 4, TEMPEST Countermeasures Review. Appendix E.

The contractor will also require access to Security/Program Classification Guide(s) (SCG) entitled Security Classification Guide for Warfighter Information Network Tactical Increment 1, dated 15 Feb 2012 or later.

9c. Contractor is authorized to receive and generate classified material at the contractor’s facility documents and/or hardware). The contractor requires access to classified source data up to and including SECRET in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, paragraph 4-208a, and the use of a bibliography. Contractor will also follow guidance set forth within the Security Classification Guide (SCG). SCGs be will identified on the specific task order DD254. Contractor will follow the guidelines of Chapters 4 and 5 for proper handling of classified information.

9d. The contractor will require classified access at Government facility. Other additional locations may be authorized by the Project Office if needed.

9e. The contractor is authorized the use of the Defense Technical Information Center (DTIC) or other secondary distribution center. The contractor will prepare DD Forms 1540 and 2345 for authorized access to DTIC. Completed forms will be provided to the KO for processing.

10. TEMPEST Information is not releasable to contractor employees who have not received a FINAL Clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting. TEMPEST requirement are reviewed and determined IAW AR 380-27, Control of Compromising Emanations (FOUO), 19 May 2010, Chapter 4, TEMPEST Countermeasures Review. Appendix E.

11. OPSEC requirements are IAW AR 530-1, Chapter 6 as listed in the PWS.

12. No classified systems are authorized to be operational at contractor’s facilities.

13a. Contractor personnel performing IT sensitive duties are subject to investigative and assignment requirements IAW AR 25-2, AR 380-67, DoD 8570.01-M and affiliated regulations.

13b. Foreign subcontractors, foreign vendors and/or visitors participating in Army foreign disclosure issues will be handled in accordance with AR 380-10 and go through the Foreign Disclosure Officer.

13c. Classified information will be protected IAW the NISPOM, Chapter 5. All security incidents involving classified information will be reported to the KO and forwarded to the PM so a program damage assessment can be conducted.

13d. All subcontractor DD254s and subcontractor tier DD254s will be sent to the KO. Any Contractors/subcontractors owned by Foreign Companies and that have a clearance issued by the Defense Security Service under a Special Security Agreement need to have a National Interest Determination (NID) approved if access is required to: Top Secret; COMSEC; Restricted Data; SCI and/or SAP. NID requirements and justification must be sent through CECOM G2 to be forwarded to the approving agencies. Only after a NID approval is received will a FOCI contracting firm be authorized to work on the program.

13e. The contractor FSO will include Threat Awareness and Reporting Program (TARP) requirements in their initial and refresher training IAW AR 381-12, paragraph 1-14 and Chapter 2.

13f. Certification and Signature: Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

Contracting Officer Representative DATE

Contract Monitor DATE

Security Manager, PM WIN-T DATE