A02_DD254_AND_OPSEC_COVER.pdf

W31P4Q-14-R-0187 Attachment 002 4 June 2015

Solicitation # W31P4Q-14-R-0187 DD 254 Continuation Sheet

ITEM 13. SECURITY GUIDANCE (Continuation Sheet)

3. Item 8. Actual Performance:

a. LOCATIONS b. CAGE

CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

Lockheed Martin Corporation - Missiles & Fire Control 5500 County Road 37 Troy, AL 36081-9608

0XYD8

Atlanta Field Office Defense Security Service (IOFSA) 1899 Powers Ferry Road, Suite 330 Atlanta, GA 30339

Raytheon/Lockheed Martin JAVELIN Joint Venture 5600 Sand Lake Road R&D Tower, MP-341 Orlando, FL 32819-8907

0HPN4

Melbourne Field Office Defense Security Service (IOFSM) 7341 Office Park Place, Suite 203 Melbourne, FL 32940

Raytheon Company 1151 E. Hermans Road Tucson, AZ 85756-9367

15090 Phoenix Field Office (IOFWX) 10851 N. Black Canyon Hwy, Suite 860 Phoenix, AZ 85029-4755

Lockheed Martin Corporation - Missiles & Fire Control 5600 Sand Lake Road Orlando, FL 32819-8907

04939 Melbourne Field Office Defense Security Service (IOFSM) 7341 Office Park Place, Suite 203 Melbourne, FL 32940

Javelin Maintenance Support Center 11099 S La Cienega Blvd, Ste 195 Los Angeles, CA 90045

NOTE: Onsite storage of CLASSIFIED info/material is NOT AUTHORIZED for this location. NO classified will be stored or sent to this facility.

A094P2 DSS - Los Angeles Field Office 3452 E Foothill Blvd, Suite 600 Pasadena, CA 91107

4. Item 10a. Communications Security (COMSEC) Information: NSA/CSS Policy Manual 3-16, Control of Communications Security (COMSEC) Material, Aug 05, and National Industrial Security Program Operating Manual (NISPOM) apply to this contract.

5. Item 10j. For Official Use Only (FOUO) Information: The Contractor shall comply with the requirements of DoDM 5200.01 for the processing of FOUO information in this contract.

6. Item 10k. Other (Specify): In accordance with AR 381-12, Threat Awareness and Reporting Program (TARP), 4 Oct 10, contractors will report related incident, behavioral indicators, and other matters of CI interest specified in Chapter 3, to the FSO, the nearest military CI Office, the FBI, or the DSS. Contractor Employees working as an integral part of the Army organization are required to complete annual Threat Awareness training. Contractor FSOs will ensure that all applicable AR 381-12 requirements are implemented for personnel who work at contractor facilities.

7. Item 11c. Receive and Generate Classified Material: The below listed security classification guides apply to this specification. In the event that a security classification guide is superseded or replaced it is the responsibility of the Contract Monitor to provide such guides to the contractor. The marking to identify derivative source on classified documents generated shall cite the appropriate Security Classification Guide or otherwise shall cite the applicable derivative source material when classification is derived from sources other than the security classification guides. All security markings shall be appropriately applied to comply with the NISPOM. All classified material shall be accounted for throughout each contract phase. Copies of the transmittal form, or equivalent, generated by the GCA and the contractor will be maintained by each for accountability purposes. Control Officials shall be designated to receive, transmit, and maintain access and accountability records for all classified information. An inventory shall be conducted annually unless written relief is granted by the GCA.

Javelin Missile System Security Classification Guide, dated 18 March 2013 Anti-Tamper Security Classification Guide, dated 17 March 2010, with Change 1 dated 18 April 2011

NOTE: Security classification guidance and/or security procedures will be provided under separate cover.

8. Item 11d. Fabricate, Modify, or Store Classified Information Hardware: During the performance of this contract it may be necessary for the contractor to store classified hardware.

Due to the nature, size or unique characteristics, it may not fit in an approved security container.

If more than 2 cubic feet of storage is required, contact the CSO to verify storage capacity at the contracting facility. The contractor may have to establish approved restricted or closed area(s) IAW DoD 5220-22- M, National Security Program Operating Manual (NISPOM), January 1995.

The point at which proposed hardware becomes classified shall be provided by the contract monitor.

9. Item 11f. Have Access to U.S. Classified Information outside the U.S., Puerto Rico, U.S.

Possession and Trust Territories. Any classified information obtained, generated, or modified outside the United States will be give the same level of protection as stated within this document.

Countries will include Korea and other FMS customers for sustainment of Javelin hardware.

10. Item 11g. Be Authorized to Use the Services of Defense Technical Information Center (DTIC) or other Secondary Distribution Center: Contractor access to DTIC information is restricted to contractual subject matter and SOW performance requirements. The Contract Officer or Program/Project Manager will verify contractor need-to-know via certification on the DD Forms 1540.

11. Item 11i. Have A TEMPEST Requirements: Per AR 380-27, paragraph 2-6, a TEMPEST Countermeasures Review (TCR) will be conducted by an Army Certified TEMPEST Technical Authority (CTTA), (TCR will be requested by the Requiring Element via secure e-mail address 902d310thTEMPEST@ mi.army.smil.mil) upon award of contract. The TCR will be conducted at the contractor's facility where classified information or material is to be received, generated or stored electronically. Results of the TCR will be provided the contractor, who will ensure that all applicable AR 380-27 requirements are implemented. Contractor cannot impose TEMPEST countermeasures upon their subcontractors without GCA or CSA approval.

mailto:902d310thTEMPEST@mi.army.smil.mil

12. Item 11j. Have Operations Security (OPSEC) Requirements: The Contractor will be required to adhere to an existing government (CCWS Project Office) OPSEC plan. GCA approval is required prior to imposing OPSEC requirements on a subcontractor. Plan will be provided with the contract data requirement list (CDRL). See enclosed AT/OPSEC Cover Sheet for additional contract requirements.

13. Item 11l. Other (Specify):

a. Classified information system processing at facility - Contractor will follow Chapter 8 of the NISPOM for guidance on classified computer processing.

b. Concurrence of the Contracting Officer and PEO Missiles and Space Foreign Disclosure Officer will be obtained prior to issue of a Limited Access Authorization to a non-US citizen in compliance with the NISPOM. Controlled Unclassified Information, as defined in DoD 5200.01, may be disclosed to US persons who are employed by the prime contractor or subcontractors or to such employees who are foreign persons when requirements of export control and other laws are met. The contractor is responsible for compliance with all applicable laws and regulations governing access to classified information or controlled unclassified information.

c. The contractor is not authorized to release any data to foreign nationals or foreign representatives without an approved export license.

d. Prior to sub-contracting with a foreign industry, the US contractor will consult with the Contracting Officer and PEO Missiles and Space Foreign Disclosure Officer. Foreign subcontractors must agree that only citizens of their country or the US will be allowed to perform on the contract. The US contractor is responsible for complying with the regulations outlined in the International Traffic Arms and Regulations (ITAR).

e. Information Assurance (IA) Contractor Training and Certification (Reference Federal Register/Vol 73, No 7, Paragraph 252.239–7001:

(1) The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01–M, Information Assurance Workforce Improvement Program. The Contractor shall meet the applicable information assurance certification requirements, including—

- DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and

- Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01–M.

(2) Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

Solicitation # W31P4Q-14-R-0187 DD 254 Continuation Sheet

(3) Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

f. AT/OPSEC Additional Contract Requirements:

(1) AT Level I Training. This provision/contract text is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access to government installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: https://atlevel1.dtic.mil/at

(2) AT Awareness Training for Contractor Personnel Traveling Overseas. This standard language text required US based contractor employees and associated sub-contractor employees to make available and to receive government provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

(3) iWATCH Training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award.

(4) Access and General Protection/Security Policy and Procedures. This standard language text is for contractor employees with an area of performance within an Army controlled installation, facility or area. Contractor and all associated sub-contractors employees shall comply with applicable Installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

Solicitation # W31P4Q-14-R-0187 DD 254 Continuation Sheet

(5) For Contracts That Require Handling or Access to Classified Information.

Contractor shall comply with FAR 52.204-2, Security Requirements and DD 254, Contract Security Classification Specification. This clause involves access to information classified “Confidential,” “Secret,” or "Top Secret", and requires contractors to comply with-(1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); any revisions to DOD 5220.22-M, notice of which has been furnished to the contractor.

(7) For Contracts that require OPSEC Training. Per AR 530-1, Operations Security, new contractor employees must complete Level I OPSEC training within 30 calendar days of their reporting for duty. All contractor employees must complete annual OPSEC awareness training.

(8) Contractor Employees Who Require Access to Government Information Systems. All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the IS and then annually thereafter.

(9) For Information assurance (IA)/information technology (IT) training. All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of employment.

(10) For information assurance (IA)/information technology (IT) certification.

Per DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01- M must be completed upon contract award.

(11) For Contractors Authorized to Accompany the Force. DFARS Clause 252.225-7040, Contractor Personnel Authorized to Accompany U.S. Armed Forces Deployed Outside the United States. The clause shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre-deployment requirements, required training (per combatant command guidance), and personnel data required.

(12) For Contract Requiring Performance or Delivery in a Foreign Country, DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors Outside the US. The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor's compliance with combatant commander and subordinate task force commander policies and directives.

Solicitation # W31P4Q-14-R-0187 DD 254 Continuation Sheet

g. Questions concerning any aspects of security will be referred to CCWS Security Manager for resolution.

14. Estimated Completion Date: 28 February 2018