011.1-USAG Picatinny VGSA-DD 254 Continuation Sheet.docx

DD254, Continuation Sheet for Block 8 Contract Number: [TO BE DETERMINED] USAG Picatinny Visitor Group Security Agreement (VGSA)

DD254, Continuation Sheet for Block 8 Contract Number: W15QKN-XX-C-XXXX USAG Picatinny Visitor Group Security Agreement (VGSA)

Contractor Designation: “Visitor Group”

1. Visitor Group Security Agreement (VGSA) is promulgated by:

a. Homeland Security Presidential Directive 12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors

b. DODM 5200.22, Vol 2, National Industrial Security Program: Industrial Security Procedures for Government Activities, 1 Aug 2018 (Cancels DOD 5220.22-R, dated 4 Dec 1985)

c. DOD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), Feb 2006, Incorporating Change 2, 18 May 2016

d. DODI 5200.48, Controlled Unclassified Information (CUI), 6 Mar 2020

e. Army Regulation 530-1, Operations Security (OPSEC), 26 Sep 2014

f. Army Regulation 380-49 Industrial Security Program, 20 Mar 2013, Paragraph 1-15n

g. Army Regulation 380-5, Department of the Army Information Security Program, 22 Oct 2019

h. Army Regulation 190-13, Army Physical Security Program, 27 Jun 2019

i. Army Regulation 25-1, Army Information Technology, 15 Jul 2019

j. Army Regulation 25-2, Army Cybersecurity, 4 Apr 2019

k. Army Federal Acquisition Regulation Supplement Part 5101

2. Visitor Group Security Agreement: This VGSA is incorporated as part of the DD Form 254 for contract security requirements under contract [TO BE DETERMINED] with (DoD Contractor [TO BE DETERMINED]. (hereafter referred to as contractor). The VGSA prescribes the specific actions to be taken by the contractor’s employees and the Department of the Army (DA), to properly protect Classified Information and Controlled Unclassified Information (CUI) used in contract performance at Picatinny Arsenal, NJ.

3. Operating location: US Army Garrison Picatinny, Picatinny Arsenal, NJ 07806-5000. This VGSA is prescribed in AR 380-49, Paragraph 1-26k.

4. Terminology: As used in this agreement, the terminology visitor group, contractor, company, and Home Office Facility (HOF) are synonymous.

5. Responsibilities:

a. Contractor Security Supervision: The Visitor Group’s Home Office Facility (HOF) will provide the Picatinny Garrison Industrial Security Specialist (ISS) with formal written notice of the names of persons (primary and alternate) at their HOF and on-site operations that are responsible for Visitor Group management and security administration of their operations on Picatinny Arsenal.

b. Security Facility Clearance Requirements: The contractor must possess or obtain an appropriate level facility security clearance (Top Secret, Secret, or Confidential) prior to performing work on a classified government contract. If the contractor does not possess a facility clearance, the Contracting Officer (KO) will assist the contractor in requesting one prior to on-site contract operations commencing.

c. Standard Practice Procedures (SPP): Compliance with this agreement eliminates the DOD 5220.22-M, National Industrial Security Operating Manual (NISPOM) SPP publication requirement for contractor operations on Picatinny Arsenal. The provisions of this agreement are not intended to circumvent the contractor’s compliance with the NISPOM, internal contractor management policies, procedures or requirements unless stated otherwise.

d. Personnel Security Clearance Requirements: The appropriate security clearance is required to perform work on contracts by contractor personnel. The contractor Facility Security Officer (FSO) shall request security clearances through the Defense Counterintelligence and Security Agency (DCSA), Federal Vetting Center (FVC).

e. Suitability Investigations: Contractor personnel shall successfully complete, as a minimum, a Tier 1 personnel security investigation (formerly a National Agency Check with Inquiries [NACI]), before being issued a Common Access Card (CAC). The contractor shall comply with Homeland Security Presidential Directive-12 (HSPD-12), AR 380-67, U.S. Army Personnel Security Program and AR 25-2, Army Cybersecurity prior to accessing any DOD or Army IT systems.

6. Visit Requests:

a. Contractors participating in the National Industrial Security Program (NISP) are authorized to use the Defense Information System for Security (DISS) or its predecessor (JPAS if still operational) in lieu of sending Visitor Authorization Letters (VALs) for classified visits to Picatinny Arsenal. VALs are only required if the contractor isn’t using JPAS or if contractor personnel access level and affiliation are not accurately reflected in DISS/JPAS.

b. The contractor shall submit annual online Visit Requests for all on-post contractor employees via DISS to the Picatinny Arsenal listing the respective Contracting Officer’s Representative (COR) as the point of contact (POC) and/or the host agency sponsor. Visit Requests will serve to verify the on-post contractor employees’ official “need-to-know” for access to classified information.

7. Wireless Electronic Devices: No cell phones; any type of camera/video (cell phones, watches, tablets, key fobs, etc.); cordless telephones; Bluetooth, smart watches/Fit bit-watches synced to cellphones; wireless microphones; keyboards; wireless or Infrared Local Area Networks (LANs) devices are [not] allowed in areas where classified information is discussed, briefed, or processed. “Area” refers to a room and/or to any space the size of a 3-meter radius sphere, centering on the classified source. In areas where classified information is discussed, briefed, or processed, wireless pointer/ mice devices are allowed for presentations only. All other Personal Electronic Devices (PEDs) not specifically addressed above, that are used for recording, storing, processing and/or transmitting information shall not be permitted in areas where classified information is electronically stored, processed, or transmitted.

8. Access and Accountability of Classified Material:

a. All access to and/or possession of classified material by contractor employees, including oral and/or visual, at Picatinny Arsenal will be under the sponsoring (host) DOD agency’s supervision, unless otherwise specified in the applicable contract. The DOD agency maintains accountability, control, and ownership of all classified information involved under the terms of this contract at all times per DODM 5200.01 and AR 380-5. Contractor access to classified information will be controlled by the sponsoring (host) DOD agency and limited to "contract-specific, need-to-know" information only. Contractor unfettered access to classified information is not authorized.

b. Contractor personnel discovering unattended/unsecure classified material(s) regardless of medium, or an unsecure/unattended GSA-approved security containers will immediately secure the classified material(s) and notify the host DOD agency, COR and/or Garrison security office (Ext. 4-4055). During non-duty hours, contractor personnel will notify the Picatinny Police Department at 973-724-6666. Recovered classified material(s) will be turned over to the Picatinny Police when the sponsoring DOD agency designated GSA-approved security container custodian(s) and/or supervisors cannot be contacted. The agency Security Manager must be notified.

9. Storage of Classified Material:

a. The contractor is not authorized to store classified information (regardless of medium) in its own security containers/areas on the installation. Classified storage, to include GSA-approved security containers and/or approved open-storage areas (closed areas) will be under the control of the host DOD agency. Contractor access will be limited to "contract-specific; need-to-know" information only.

b. Classified information, regardless of medium, must be stored in a government owned and controlled GSA-approved security container(s). The contractor is prohibited from establishing and/or maintaining a separate classified information system. All classified material will be returned and secured in the designated GSA-approved security container(s) at the end of the duty/work day.

c. Under the terms of this agreement, the host DOD agency will have access to and control all GSA-approved security containers. The responsibility for setting the GSA-approved storage container combination rests with the sponsoring host DOD agency. Each GSA-approved container will have government activity custodians appointed. The Standard Form (SF) 700, Security Container Information, will be used to identify person(s) responsible for the GSA-approved security container. This form will be posted inside the locking drawer of each GSA-approved security container.

10. Transmission of Classified Material:

a. The contractor’s receipt or dispatch of classified material via U.S. postal channels or authorized commercial carriers on Picatinny Arsenal will be in accordance with the applicable DD Form 254, DOD Contract Security Classification Specification and Block 11. All classified information, regardless of medium, will be secured in the host DOD agency owned and controlled GSA-approved security containers or approved classified open storage areas.

b. Classified material may not be handcarried onto or off US Army Garrison Picatinny by a contractor employee, unless said employee is so designated in writing by the Contractor’s FSO or management official and approved by the COR. DODM 5200.01, DOD Information Security Program, Vol 3, February 24, 2012, Incorporating Change 2, March 19, 2013, Enclosure 4 (13), requires the use of DD Form 2501, Courier Authorization or Courier Authorization Memorandum (sometimes called courier orders) to handcarry classified information in any form between buildings on the installation.

c. Home Office Facility or Facility Security Officer (FSO), will designate couriers, if required by contractual requirements and be approved by host DOD agency, COR or agency security manager.

d. All classified information, regardless of medium, will be packaged for shipment by the host DOD agency in accordance with AR 380-5, Chapter 8. The host DOD agency will contact the Picatinny Arsenal Security Division at 4-4055 for guidance as needed.

11. Disposition of Classified Material: The contractor will return all classified information shared and/or involved, under the terms of this agreement, to the sponsoring host DOD agency, by the end of the work day, to be secured in a GSA-approved security container. Any exceptions to this rule must be approved by the Contracting Officer. Destruction of classified information, regardless of medium, will be destroyed by the host DOD agency in accordance with the Picatinny Arsenal classified destruction and/or emergency protection plan.

12. Reproduction of Classified Material: Only Army approved/designated and controlled reproduction equipment will be used by the contractor when authorized. The contractor cannot reproduce classified material without the permission of the DOD host agency or contracting officer. Approval will be in writing via email or formal memorandum. All contractor copiers, scanners, faxes, etc. will be marked to “prohibit” the reproduction of classified information. Questions will be referred to the DOD agency security manager.

13. Security Education and Briefings: The contractor, COR, host agency and/or sponsoring activity shall:

a. Provide Information Security Program training (initial, refresher and annual) and other security awareness support to contractor employees (e.g., OPSEC, CUI, Insider Threat, Antiterrorism Level I, etc.) regarding their individual responsibility for safeguarding classified information and CUI on Picatinny Arsenal. These briefings shall be tailored to those responsibilities associated with the employees’ contractual duties and the results of the most recent self-inspections and annual Industrial Security Review (ISR) reports.

b. On a recurring basis, but not less than annually (calendar year), brief all on-site cleared contractor personnel on their responsibilities for safeguarding classified information per DOD 5220.22-M, Chapter 3, Section 1. Conduct initial and refresher briefings per DOD 5220.22-M, Chapter 3, Section 1. Complete and document training on Controlled Unclassified Information (CUI) in accordance with DODI 5200.48, Controlled Unclassified Information (CUI).

c. Contractors will be briefed to NATO, COMSEC, CNWDI, etc. by their company Facility Security Officer (FSO) commensurate with their involvement in support of a government classified contract.

d. If debriefed by Picatinny Security Specialists, it will be in accordance with DODM 5200.01 and the debriefing will be recorded on SF 312, Classified Nondisclosure Agreement.

e. The contractor will brief their personnel on the provisions of this agreement and any associated DD Form 254, security guidance.

f. If additional security training is directed by Picatinny Arsenal Higher Headquarters, Secretary of the Army, Secretary of Defense, Under Secretary of Defense for Intelligence, etc., those DOD contractors performing under a classified contract will complete the required training in accordance with the guidance provided.

14. Reports: The contractor must immediately submit written reports on potential violations that are required under any of the situations outlined in AR 380-49, AR 380-5 and the NISPOM (derogatory information. suspicious contacts, mishandling of classified information, unauthorized disclosures, insider threats, etc.).

a. The Garrison ISS coordinates and/or reports security violations committed by contractor employees to the appropriate Defense Counterintelligence and Security Agency (DCSA) Cognizant Security Office (CSO), base contracting office, COR, and the contractor’s home office, as appropriate.

b. The contractor home office and FSO must keep the Picatinny Arsenal Garrison Commander advised of any reports submitted per NISPOM paragraph 1-302 and AR 381-12, Threat Awareness and Reporting Program (TARP) pertaining to suspicious contacts. This includes, contractor employees being terminated (fired) and/or resigning in lieu of termination, where the basis for these action(s) is/are based on one or more of the 13-Adjudicative Guidelines for access to classified information.

c. In these instances, adverse information will be documented in DISS via an Incident Report. This will provide a historical record of derogatory information for future adjudication, if needed.

d. In accordance with AR 380-49, para 1-31 and NISPOM, para 1-302, adverse information and suspicious contact reporting will be reported to the Garrison Industrial Security Specialist (ISS), Contracting Office Representative (COR), Program Executive Office (PEO) and/or Program Manager (PM).

e. The DOD host agency’s commander/director appoints the inquiry or investigation officials for security incidents involving classified information and contractor employees. Inquiry or investigation officials coordinate findings and reports with the appointing official and Garrison ISS. Security incident inquiries and investigations will be conducted in accordance with AR 380-5, Chapter 10, for Picatinny Arsenal contractor related incidents.

f. The Garrison ISS will review (provide oversight) on contractor adverse reporting incidents via annual security reviews.

15. Security Checks:

a. Contractor employees may be scheduled to perform end-of-day security checks within their assigned work areas by the host DOD agency per AR 380-5 and DOD regulations.

b. DOD agency’s security program operating instructions will provide guidance on conducting security checks. These checks will ensure security precautions are taken to protect classified information and Controlled Unclassified Information (CUI). The Standard Form 701, Activity Security Checklist and Standard Form 702, Security Container Check Sheet, will be used to record these checks.

16. Protection of Government Resources: Contractor employees will comply with AR 190-13, The Army Physical Security Program. The host DOD agency will provide guidance and instruction as applicable, for the protection of Government resources on the installation.

a. Contractors will not be appointed as primary or alternate security managers or OPSEC Officers for the host DOD agency, or sign any forms as required by the host government agency. However, contractor employees can be required to provide other security program support under Army direction, such as conducting end of day security checks, attending security training/briefings, etc.

b. Ensure all contractor personnel complete the Standard Form (SF) 312, Classified Information Nondisclosure Agreement and “Top Secret Attestations,” as applicable, for classified information access.

17. Clarification of Security Requirements: Contractor employees will address inquiries or questions pertaining to the provisions of AR 380-49, AR 380-5, etc., to the Garrison ISS at 4-4055.

18. Security Reviews:

a. The Picatinny Arsenal ISS will conduct security reviews of the on-site visitor group’s operation at periodic intervals to ensure compliance with applicable provisions of the NISPOM, DODM 5200.22, Vol 2, National Industrial Security Program: Industrial Security Procedures for Government Activities, AR 380-49, AR 380-5 and this agreement.

b. The DOD host agency’s Information Security Program Review (AR 380-5) or self-inspection will include the contractor operations. The host activity will use the VGSA criteria to evaluate the contractor’s performance and compliance. The DOD host agency will provide a formal written report, to include findings, observations and recommended corrective actions, if required, to the contractor’s on-site management official and FSO. The DOD host agency will document and maintain the inspection report as required by the NISPOM, AR 380-49, AR 380-5 and supplements.

19. Other miscellaneous requirements:

a. Contract and Associated DD Forms 254: The Visitor Group will maintain on file a copy of the applicable contract, Statement of Work (SOW), Statement of Objectives (SOO), Performance Work Statement (PWS), Contract Data Requirements List (CDRL), JPAS Visit Requests/Visit Authorization Letter(s), copy of this VGSA and associated DD Forms 254 (primary and subcontracted). This file will be part of the Picatinny ISS security review process.

b. Contractor employees will be issued Picatinny Arsenal identification credentials in accordance with Homeland Security Presidential Directive (HSPD)-12, AR 380-67, AR 190-13 and applicable Picatinny Arsenal directives and policies. The Contractor shall coordinate requests and issuance of the appropriate credentials with the assigned COR.

c. Contractor employees issued Common Access Cards (CAC) will immediately report the loss or theft of their CAC to the COR and Picatinny Police. The contractor employee will go to Building 173 and file a Police Report on the lost/stolen CAC. Once the report is filed, the contractor employee will contact their COR for guidance on obtaining a replacement CAC.

d. CACs issued to contractor employees are government issued equipment and must be returned when the contractor’s employees complete their work on Picatinny Arsenal, regardless of the reason(s) for termination of employment on the installation.

e. All security forms required in support of the DOD Information Security Program and NISPOM, will be provided by the on-installation sponsoring DOD host agency.

f. While on the installation, all contractor employees and visitors shall comply with New Jersey and Picatinny Arsenal traffic laws and rules. Specific signage is posted throughout the installation for reserved parking, pedestrians, cyclists, military formations, speed limits, etc. Picatinny Arsenal Police issue Federal Magistrate Citations for traffic violations to include applicable monetary fines.

g. Contractor employees shall be denied access to Picatinny, based on criminal history “or” pending adjudication of a crime. In accordance with Contract Clause 52.000-4000, Identification and Access Eligibility Requirements of Contractor Employees; "Criminal History" is defined as adjudicated guilt or pending adjudication of a crime as defined under New Jersey law or equivalent offense under the applicable laws of another jurisdiction. Installation access will be governed and processed in accordance with the Installation Security Plan. The contractor will notify the COR and Garrison Industrial Security Specialist of any adverse information reporting.

20. Visitor Register: The Visitor Group shall maintain a record of all classified and unclassified visits to their on-site operations. Visitor registers will be maintained for two years. The visitor register will reflect as a minimum:

a. The visitor’s last name, first name and middle initial

b. The name of the company or agency the visitor(s) represent

c. The register must distinguish between classified and unclassified visits

d. The date(s) of the visitor(s) arrival and departure from the installation

21. Operations Security (OPSEC): The Visitor Group will:

a. Ensure all contractor employees and subcontractors performing work on Picatinny Arsenal, complete Level 1 OPSEC online training within 30 calendar days of their start date on the arsenal.

b. Protect critical or sensitive unclassified information, a.k.a., Controlled Unclassified Information (CUI).

c. Will not engage in any illegal or unethical conduct or any activity which would constitute a conflict of interest.

d. Will not reveal or release CUI received in official activities without proper authorization and an OPSEC Review, documented on Form 3002.

22. SIPRNET Access: All contractor employees requiring access to the Secret Internet Protocol Network (SIPRNET) must complete the Online NATO Awareness Briefing and Derivative Classification Training and print out the certificates prior to SIPRNET access. Derivative Classification is an “annual” requirement.

23. Expenditure of Funds for Security: This agreement is not an authorization for a commitment of funds. Nothing in this agreement shall be construed to impose any liability on the part of the U.S. government for injury to the agents, employees of the contractor, its subcontractors, consultants, assignees or other individuals acting for or on behalf of the contractor, to the property of the same, nor shall anything in this agreement be construed to modify the provisions of existing contracts.

24. Review of this Agreement: All parties must review this agreement biennially for accuracy. The Army activity is responsible for keeping this agreement current.

In addition, the Army activity will keep on file a copy of the last evaluation, self-inspection or equivalent review. Copies of reports may be made available to the visitor group for their files.

25. Point of Contact: The Garrison point of contact for this agreement is the Directorate of Operations (DoO), Security Division, 973-724-4055.

Rev1: 20210303