011-DD Form 254-NEW.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DD254, Continuation Sheet for Block 8 Contract Number: W15QKN-16-C-1006

SUBJECT: Visitor Group Security Agreement (VGSA)

Contractor Designation: “Visitor Group”

1. This Visitor Group Security Agreement (VGSA) is promulgated by:

a. Homeland Security Presidential Directive 12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors

b. Department of Defense (DOD) 5220.22-R, Industrial Security Regulation

c. DOD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), Chapter 1, Section 2, paragraph 1-200 and Chapter 6, Section 1, paragraph 6-105a

d. Army Regulation (AR) 380-49 Industrial Security Program, Paragraph 1-15n

e. Army Regulation 380-5, Department of the Army Information Security Program

f. Army Regulation 190-13, the Army Physical Security Program

g. Army Federal Acquisition Regulation Supplement Part 5101

2. This VGSA, is incorporated as part of the DD Form 254 for contract security requirements under contract W15QKN-16-C-1006 with Chugach Industries, Inc.

(hereafter referred to as contractor). The VGSA prescribes the specific actions to be taken by the contractor’s employees and the Department of the Army (DA), to properly protect classified information used in contract performance at the contractor’s location.

3. Operating location; US Army Garrison Picatinny, Picatinny Arsenal, NJ 07806-5000.

This VGSA is prescribed in AR 380-49, Paragraph 1-26k.

4. As used in this agreement, the terminology visitor group, contractor, company, and Home Office Facility (HOF) are synonymous.

5. Responsibilities are delineated as follows:

a. Contractor Security Supervision: The visitor group’s Home Office Facility (HOF) will provide the Picatinny Garrison Industrial Security Specialist (ISS) with formal written notice of the names of persons (primary and alternate) at their HOF and on-site operations that are responsible for visitor group management and security administration of their operations on Picatinny Arsenal.

b. Security Facility Clearance Requirements: The contractor must possess or obtain an appropriate level facility security clearance (Top Secret, Secret, or Confidential) prior to performing work on a classified government contract. If the contractor does not

SUBJECT: Visitor Group Security Agreement possess a facility clearance, the Contracting Officer (KO) will assist the contractor in requesting one prior to on-site contract operations commencing.

c. Standard Practice Procedures (SPP): Compliance with this agreement eliminates the DOD 5220.22-M, National Industrial Security Operating Manual (NISPOM) SPP publication requirement for contractor operations on Picatinny Arsenal. The provisions of this agreement are not intended to circumvent the contractor’s compliance with the NISPOM, internal contractor management policies, procedures or requirements unless stated otherwise.

d. Personnel Security Clearance Requirements: The appropriate security clearance is required to perform work on contracts by Contractor personnel. The contractor Facility Security Officer (FSO) shall request security clearances through the Personnel Security Management Office-Industry (PSMO-I).

e. Suitability Investigations: Contractor personnel shall successfully complete, as a minimum, a Tier 1 personnel security investigation (formerly a National Agency Check with Inquiries [NACI]), before being issued a Common Access Card (CAC). The contractor shall comply with Homeland Security Presidential Directive-12 (HSPD-12), AR 380-67, U.S. Army Personnel Security Program and AR 25-2, Information Assurance prior to accessing DOD or Army IT systems.

5. Visit Requests:

a. Contractors participating in the National Industrial Security Program (NISP) are authorized to use the Joint Personnel Adjudication System (JPAS) in lieu of sending Visitor Authorization Letters (VALs) for classified visits to Picatinny Arsenal. VALs are only required if the contractor isn’t using JPAS or if contractor personnel access level and affiliation are not accurately reflected in JPAS.

b. The contractor shall submit annual online Visit Requests for all on-post contractor employees via JPAS to the Picatinny Arsenal listing the respective Contracting Officer’s Representative (COR) as the point of contact (POC). Visit Requests will serve to verify the on-post contractor employees’ official “need-to-know” for access to classified information.

6. Wireless Electronic Devices: No cell phones; any type of camera/video (cell phones, watches, tablets, key fobs, etc.); cordless telephones; Bluetooth, smart watches/Fit bit-watches synced to cellphones; wireless microphones; keyboards; wireless or Infrared Local Area Networks (LANs) devices are [not] allowed in areas where classified information is discussed, briefed, or processed. “Area” refers to a room and/or to any space the size of a 3-meter radius sphere, centering on the classified source. In areas where classified information is discussed, briefed, or processed, wireless pointer/ mice devices are allowed for presentations only. All other Personal Electronic Devices

(PEDs) not specifically addressed above, that are used for recording, and storing, processing, and/or transmitting information shall not be permitted in areas where classified information is electronically stored, processed, or transmitted.

7. Access and Accountability of Classified Material:

a. All access to and/or possession of classified material by contractor employees, including oral and/or visual, at Picatinny Arsenal will be under the sponsoring (host) DOD agency’s supervision, unless otherwise specified in the applicable contract. The DOD agency maintains accountability, control, and ownership of all classified information involved under the terms of this contract at all times per DODM 5200.01 and AR 380-5. Contractor access to classified information will be controlled by the sponsoring (host) DOD agency and limited to "contract-specific, need-to-know" information only. Contractor unfettered access to classified information is not authorized.

b. Contractor personnel discovering unattended/unsecure classified material(s) regardless of medium, or an unsecure/unattended GSA-approved security containers will immediately secure the classified material(s) and notify the host DOD agency, COR and/or Garrison security office (Ext. 4-4058/4-4055). During non-duty hours, contractor personnel will notify the Picatinny Police Department at 973-724-6666. Recovered classified material(s) will be turned over to the Picatinny Police when the sponsoring DOD agency designated GSA-approved security container custodian(s) and/or supervisors cannot be contacted.

7. Storage of Classified Material:

a. The contractor is not authorized to store classified information (regardless of medium) in its own security containers/areas on the installation. Classified storage, to include GSA-approved security containers and/or approved open-storage areas (closed areas) will be under the control of the host DOD agency. Contractor access will be limited to "contract-specific; need-to-know" information only.

b. Classified information, regardless of medium, must be stored in a government owned and controlled GSA-approved security container(s). The contractor is prohibited from establishing and/or maintaining a separate classified information system. All classified material will be returned and secured in the designated GSA-approved security container(s) at the end of the duty/work day.

c. Under the terms of this agreement, the host DOD agency will have access to and control all GSA-approved security containers. The responsibility for setting the GSA-approved storage container combination rests with the sponsoring host DOD agency.

Each GSA-approved container will have government activity custodians appointed. The Standard Form (SF) 700, Security Container Information, will be used to identify person(s) responsible for the GSA-approved security container. This form will be posted inside the locking drawer of each GSA-approved security container.

8. Transmission of Classified Material:

a. The contractor’s receipt or dispatch of classified material via U.S. postal channels or authorized commercial carriers on Picatinny Arsenal will be in accordance with the applicable DD Form 254, DOD Contract Security Classification Specification, and Item

11. All classified information, regardless of medium, will be secured in the host DOD agency owned and controlled GSA-approved security containers or approved classified open storage areas.

b. Classified material may not be hand-carried onto or off US Army Garrison Picatinny by a contractor employee, unless said employee is so designated in writing by the Contractor’s FSO, or management official and approved by COR.

c. Home Office Facility or Facility Security Officer (FSO), as a courier and approved by host DOD agency or designee per AR 380-5. The Installation Commander does not require the use of DD Form 2501, Courier Authorization (card) or Courier Designation Letter for on-post hand carry between facilities.

d. All classified information, regardless of medium, will be packaged for shipment by the host DOD agency in accordance with AR 380-5, Chapter 8. The host DOD agency will contact the Picatinny Arsenal Information Security Specialist at X4-4058 for guidance as needed.

9. Disposition of Classified Material: The contractor will return all classified information shared and/or involved, under the terms of this agreement, to the sponsoring host DOD agency, by the end of the work day, to be secured in a GSA-approved security container. Any exceptions to this rule must be approved by the Contracting Officer.

Destruction of classified information, regardless of medium, will be destroyed by the host DOD agency in accordance with the Picatinny Arsenal classified destruction and/or emergency protection plan.

10. Reproduction of Classified Material: Only Army approved/designated and controlled reproduction equipment will be used by the contractor when authorized. The contractor cannot reproduce classified material without the permission of the DOD host agency or contracting officer. Approval will be in writing via email or formal memorandum.

11. Security Education and Briefings; the contractor, COR and/or sponsoring activity shall:

a. Provide Information Security Program training (initial, refresher and annual) and other security awareness support to contractor employees regarding their individual responsibility for safeguarding classified information on Picatinny Arsenal. These briefings shall be tailored to those responsibilities associated with the employees’ Contractual duties and the results of the most recent self-inspections and annual Industrial Security Review (ISR) reports.

b. Contractors will not be appointed as primary or alternate security managers for the host DOD agency, or sign any forms as required by the appointed government Security managers. However, contractor employees can be required to provide other security program support under Army direction, such as conducting end of day security checks, attending security training/briefings, etc.

c. Ensure all contractor personnel completed the Standard Form (SF) 312, Classified Information Nondisclosure Agreement and “Top Secret Attestations,” as applicable.

d. Contractors will be briefed to NATO, COMSEC, CNWDI, etc. by their company Facility Security Officer (FSO) commensurate with their involvement in support of a government classified contract.

e. If debriefed by Picatinny Security Specialists, it will be in accordance with DODM

5200.01 and the debriefing will be recorded on DA Form 2962, Security Termination Statement. The DA Form 2962 will be maintained by the Picatinny Arsenal Garrison Security Office for two years.

f. Ensure contractor employees attend and participate collectively in the DOD host agency Security Education and Awareness Training Program, per AR 380-49 and AR 380-5.

g. The contractor will brief their personnel on the provisions of this agreement and any associated DD Form 254, security guidance.

12. Reports: The contractor must immediately submit written reports on potential violations that are required under any of the situations outlined in AR 380-49, AR 380-5 and the NISPOM. The Garrison ISS coordinates and/or reports security violations committed by contractor employees to the appropriate Defense Security Service (DSS) Cognizant Security Office (CSO), base contracting office, COR, and the contractor’s home office, as appropriate. The contractor home office and FSO must keep the Picatinny Arsenal Garrison Commander advised of any reports submitted per NISPOM paragraph 1-302 and AR 381-12, Threat Awareness and Reporting Program (TARP) pertaining to suspicious contacts. This includes, contractor employees being terminated (fired) and/or resigning in lieu of termination, where the basis for these action(s) is/are based on one or more of the 13-Adjudicative Guidelines for access to classified information. In these instances, adverse information will be documented in JPAS via an Incident Report. This will provide a historical record of derogatory information for future adjudication, if needed.

a. In accordance with AR 380-49, para 1-31 and NISPOM, para 1-302, adverse information and suspicious contact reporting will be reported to the Garrison Industrial Security Specialist (ISS), Contracting Office Representative (COR), Program Executive Office (PEO) and/or Program Manager (PM).

b. The DOD host agency’s commander/director appoints the inquiry or investigation officials for security incidents involving contractor employees. Inquiry or investigation officials coordinate findings and reports with the appointing official and Garrison ISS.

Security incident inquiries and investigations will be conducted in accordance with AR 380-5, Chapter 10, for Picatinny Arsenal contractor related incidents.

c. The Garrison ISS will review (provide oversight) on contractor adverse reporting incidents via annual security reviews.

13. Security Checks:

a. Contractor employees may be scheduled to perform end-of-day security checks within their assigned work areas by the host DOD agency per AR 380-5, and DOD regulations.

b. Agency’s security program operating instructions. These checks will ensure security precautions are taken to protect classified material. The Standard Form 701, Activity Security Checklist and Standard Form 702, Security Container Check Sheet, will be used to record these checks.

14. Protection of Government Resources: Contractor employees will comply with AR 190-13, The Army Physical Security Program. The host DOD agency will provide guidance and instruction as applicable, for the protection of Government resources on the installation.

15. Clarification of Security Requirements: Contractor employees will address inquiries or questions pertaining to the provisions of AR 380-49 and AR 380-5 to the Garrison

ISS.

16. Security Education and Awareness Training: On a recurring basis, but not less than annually (calendar year), brief all on-site cleared contractor personnel on their responsibilities for safeguarding classified information per DOD 5220.22-M, Chapter 3, Section 1. Conduct initial and refresher briefings per DOD 5220.22-M, Chapter 3, Section 1. Ensure contractor employees attend and participate collectively in the DOD host agency’s Security Education and Awareness Training Program, per AR 380-49 and AR 380-5 for any security topics not covered by the FSO.

17. Security Reviews:

a. The Picatinny Arsenal ISS will conduct security reviews of the on-site visitor group’s operation at periodic intervals to ensure compliance with applicable provisions of the NISPOM, AR 380-49, AR 380-5 and this agreement.

b. The DOD host agency’s Information Security Program Review (AR 380-5) or self-inspection will include the contractor operations. The host activity will use the VGSA criteria to evaluate the contractor’s performance and compliance. The DOD host agency will provide a formal written report, to include findings, observations and recommended corrective actions, if required, to the contractor’s on-site management official and FSO.

The DOD host agency will document and maintain the inspection report as required by the NISPOM, AR 380-49, AR 380-5 and supplements.

18. Other miscellaneous requirements:

a. Contract and Associated DD Forms 254: The visitor group will maintain on file a copy of the applicable contract, Statement of Work (SOW), Statement of Objectives (SOO), Performance Work Statement (PWS), Contract Data Requirements List (CDRL), JPAS Visit Requests/Visit Authorization Letter(s) and associated DD Forms 254 (primary and subcontracted). This file will be part of the Picatinny ISS security review process.

b. Contractor employees will be issued Picatinny Arsenal identification credentials in accordance with Homeland Security Presidential Directive (HSPD)-12, AR 380-67, AR 190-13, and applicable Picatinny Arsenal directives and policies. The Contractor shall coordinate request and issuance of the appropriate credentials with the assigned COR and Picatinny Garrison Industrial Security.

c. Contractor employees issued Common Access Cards (CAC) will immediately report the loss or theft of their CAC to the COR and Picatinny Police. The contractor employee will go to Building 173 and file a Police Report on the lost/stolen CAC. Once the report is filed, the contractor employee will contact their COR for guidance on obtaining a replacement CAC.

d. CACs issued to contractor employees are government issued equipment and must be returned when the contractor’s employees complete their work on Picatinny Arsenal, regardless of the reason(s) for termination of employment on the installation.

e. All security forms required in support of the DOD Information Security Program and NISPOM, will be provided by the on-installation sponsoring DOD host agency.

f. While on the installation, all contractor employees and visitors shall comply with New Jersey and Picatinny Arsenal traffic laws and rules. Specific signage is posted throughout the installation for reserved parking, pedestrians, cyclists, military formations, speed limits, etc. Picatinny Arsenal Police issue Federal Magistrate Citations for traffic violations to include applicable monetary fines.

g. Contractor employees shall be denied access to Picatinny, based on criminal history OR pending adjudication of a crime. In accordance with Contract clause 52.000-4000, Identification And Access Eligibility Requirements Of Contractor Employees "criminal history" is defined as adjudicated guilt or pending adjudication of a crime as defined under New Jersey law, or equivalent offense under the applicable laws of another jurisdiction. Installation access will be governed and processed in accordance with the installation security plan. The contractor will notify the COR and Garrison Industrial Security Specialist of any adverse information reporting.

19. Visitor Register: The visitor group shall maintain a record of all classified and unclassified visits to their on-site operations. Visitor registers will be maintained for two years. The visitor register will reflect as a minimum:

a. The visitor’s last name, first name and middle initial

b. The name of the company or agency the visitor(s) represent

c. The register must distinguish between classified and unclassified visits

d. The date(s) of the visitor(s) arrival and departure from the installation

20. Operations Security (OPSEC): The visitor group will:

a. Ensure all contractor employees and subcontractors performing work on Picatinny Arsenal, complete Level 1 OPSEC online training within 30 calendar days of their start date on the arsenal.

b. Protect critical or sensitive unclassified information, a.k.a., Controlled Unclassified Information (CUI).

c. Not engage in any illegal or unethical conduct or any activity which would constitute a conflict of interest.

d. Not reveal or release CUI received in official activities without proper authorization and an OPSEC Review, documented on Form 3002.

21. SIPRNET Access: All contractor employees requiring access to the Secret Internet Protocol Network (SIPRNET) must complete the Online NATO Awareness Briefing and Derivative Classification Training and print out the certificates prior to SIPRNET access.

22. Expenditure of Funds for Security: This agreement is not an authorization for a commitment of funds. Nothing in this agreement shall be construed to impose any liability on the part of the U.S. government for injury to the agents, employees of the contractor, its subcontractors, consultants, assignees or other individuals acting for or on behalf of the contractor, to the property of the same, nor shall anything in this agreement be construed to modify the provisions of existing contracts.

23. Review of this Agreement: All parties must review this agreement biennially for accuracy. The Army activity is responsible for keeping this agreement current.

In addition, the Army activity will keep on file a copy of the last evaluation, self-inspection or equivalent review. Copies of reports may be made available to the visitor group for their files.

24. Point of Contact for this agreement is: Joseph Casale, (973)724-4679, joseph.r.casale.civ@mail.mil

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

Directorate of Operations, Security Division 173 Buffington Rd., Bldg. 173 Picatinny Arsenal, New Jersey 07806-5000

Access to SIPRNET.

Contracting Officer's Representative (COR):

Leon Weinglass, leon.weinglass.civ@mail.mil

973-724-6364

Location: Picatinny Arsenal, NJ 07806, Visitor Group Security Agreement (please see continuation sheet).

Classified material must be handled in accordance with DODM 5200.22, Vol 2, National Industrial Security Program: Industrial Security Procedures for Government Activities, 1 Aug 2018 (Cancels DOD 5220.22-R, dated 4 Dec 1985) and National lndustrial Security Program Operating Manual (NISPOM) DoD 5220.202M (February 2006) and local security classification guidance and source documents.

Continuation Sheet: USAG Picatinny VGSA-DD 254.

Phipps Rd., Bldg. 10 Picatinny Arsenal, New Jersey 07806-5000 Address: USAG Picatinny Buffington Rd., Bldg. 173 Picatinny Arsenal, New Jersey 07806-5000