ELMR_DD254_Cont_Sheets_v3.pdf

Contract Number: TBD Task Order Number: ___________________ 2nd Signal Brigade ELMR Support DD Form 254, 20190226, Block 13 Continuation Sheets Page 1 of 10

1. Ref 1.a: Contractor requires at least a final SECRET facility clearance at time of contract award.

2. Ref 1.b: There is no requirement for the contractor to establish safeguarding capability at any company location.

3. Ref 8.a. Location(s) (For actual performance are listed below)

USAG Wiesbaden Locations:

McCully Barracks, Building 6208, New Equipment Shelter

Amelia Earhart Center, New Equipment Cabinets Clay Kaserne, Building 1012, New Equipment Shelter Clay Kaserne, Building 1001, Fire Control Center.

Clay Kaserne, Building 1001, PMO Dispatch Room 110B

USAG Stuttgart Locations:

Kelley Barracks, Kelley Hotel, Bldg 3301

Patch Barracks, Building 2307, Dispatch Room 125 Panzer Barracks, Building 2989 Dispatch Panzer Barracks, Building 2987 RF Site Robinson Barracks, Bldg 139

USAG Rheinland Pfalz Locations:

Rhine Ordnance Barracks, Bldg 164

Gruendstadt Germersheim Coleman Barracks, Radio Shelter Vogelweh, FACC Baumholder, FACC Bldg 8308 Baumholder PMO Dispatch, Bldg 8720 Baumholder RF Site, Bldg 8490 Miesau RF Site

USAG Ansbach Locations:

Shipton Barracks, Bldg 8016

Oberdachstetten, Bldg 8208 Buettelberg Radio Relay Facility, Bldg 6043 PMO Dispatch Storck Barracks, Bldg 6518 Fire Dispatch Storck Barracks, Bldg 6505 PMO Dispatch Katterbach Kaserne, Bldg Fire Dispatch Katterbach Kaserne, Bldg 5850 EOC, Bismark Kaserne Bldg 5843C Fernmeldeturm Nürnberg

USAG Bavaria Locations:

Grafenwoehr, PMO Dispatch, Bldg 506

Grafenwoehr, Fire Dispatch, Bldg 521 Vilseck, AFN Tower, Bldg 255 Vilseck, PMO Dispatch, Bldg 2099 Vilseck, Fire Dispatch, Bldg 201 Hohenfels, MARS Tower (GIG) Bldg 399 Hohenfels, ASP2 either Bldg 688, 677, or 670 Hohenfels, PMO Dispatch, Bldg 358 Hohenfels, Fire Dispatch, Bldg 48 Hessenreuth, Pressath Telecommuncation Tower Garmisch Artilery Kaserne, Bldg 210 Zugspitze

2nd Signal Brigade ELMR Support DD Form 254, 20190226, Block 13 Continuation Sheets Page 2 of 10

USAG Italy Locations:

Caserme Ederle, PMO Dispatch, Bldg 4B

Caserme Ederle, Fire Dispatch, Bldg 50 Caserme Ederle, AFN Tower, Bldg 10 Caserme Ederle, Caserme Ederle, Bldg 59 Del Din, PMO/Fire Dispatch Bldg 58 Del Din, Parking Garage, Bldg 14 Camp Darby, PMO Dispatch, Bldg 713 Camp Darby, ASA, Bldg 4013 Camp Darby, Bldg 775 Camp Darby, Leghorn, Bldg 5160

USAG Benelux Locations:

Chievres, PMO Dispatch, Bldg 20134

Steerebeek, PMO Dispatch, Bldg TBD Schinnen/NIC PMO Dispatch, Bldg 900014 NATO SHAPE Tower, Bldg 613 Steerebeek, New Tower, Bldg 10/12 NATO Joint Forces HQ Brunssum, GIG Tower Tower Barracks, Dülmen, Bldg 20, Rm 12 Chievres, Bldg 41

Future performance locations:

Poland, Lithuania, Romania, Kosovo, and Bulgaria

4. Ref 10.a: The Contractor is not required to establish a Communications Security (COMSEC) account. However, some work performance will/may require access to classified COMSEC information, COMSEC key, and/or Controlled Cryptographic Items (CCI), at Government work locations only. A supporting Government KMI Operating Account Manager (KOAM) may hand-receipt COMSEC material to properly identified/briefed Contractor personnel at specified Government work locations, in order to perform the mission under the terms of the contract. Contractor access to classified COMSEC information requires U.S. citizenship, a final personnel security clearance at the requisite level, established need-to-know in accordance with this contract, and receipt of all required briefings prior to being granted access to such information.

4a. Ref 10.a: The Contractor shall control, protect, safeguard, and account for COMSEC and/or CCI in accordance with AR 380-40, TB 380-41, local Standard Operating Procedures and other Army, DoD and National level policy, as directed by the Government requiring activity. The Contractor shall comply with all applicable regulations and directives, including requiring activity policies and procedures in effect at requiring activity work locations. The Contractor shall remove any Contractor employee who fails to comply with COMSEC directives, policies and procedures from performance on this contract/task order. Additionally, contractor employees who violate COMSEC directives, policies and procedures could be subject to criminal prosecution or other legal action.

4b. Ref 10.a: Contractor personnel shall be familiar with AR 380-40, Chapter 6, on what constitutes a reportable incident and shall report any such incident immediately but no later than 4 hours to the responsible KOAM and Contracting Officer’s Representative (COR). Contractor personnel shall be familiar with the security classification guidelines in AR 380-40, Appendix B and shall ensure any incident information is properly marked/protected and reported via approved secure communications from Government requiring activity work locations.

4c. Ref 10.a: Contractor personnel shall be subject to the Department of the Army Cryptographic Access Program (DACAP) prior to being granted access to any SECRET cryptographic information that meets the criteria established in AR 380-40, Chapter 7. Contractor enrollment in DACAP requires: receipt of a DACAP briefing administered by the supporting Government requiring activity Security Office, G-2/S-2; written acknowledgement that they may be randomly selected to undergo a non-lifestyle, counterintelligence scope polygraph (CSP) examination administered in accordance with applicable directives and law; agreement to report all foreign travel and contacts in accordance with AR 380-67; and execution of Part I, SD 572 (Cryptographic Access Certification and Termination Statement). By executing Part I, SD 572, the Contractor employee acknowledges and agrees to be

2nd Signal Brigade ELMR Support DD Form 254, 20190226, Block 13 Continuation Sheets Page 3 of 10 subject to a CSP examination as a requirement for continuing access to classified cryptographic information. When such access is no longer required, Contractor personnel will be debriefed and shall execute Part II of the SD 572.

The Government will deny access to classified cryptographic information to any Contractor employee who refuses to participate in DACAP. The Government will also immediately terminate access to classified cryptographic information for any Contractor employee who declines to submit to a CSP examination, and that employee shall debriefed by the Government requiring activity Security Office, G-2/S-2. In the event that a Contactor employee is selected for a CSP, the Government will reimburse the Contractor, in accordance with the Joint Travel Regulation (JTR) and FAR part 31.205-46, for approved travel incurred to comply with CSP examination requirements under the DACAP.

4d. Ref 10.a: Contractor access to classified COMSEC information requires a final facility clearance at the requisite level and written approval of the Contracting Officer (KO) prior to sub-contracting any work effort that requires access to COMSEC information.

5. Ref 10.e (2): ICD 703, Protection of Classified National Intelligence, Including SCI, provides policy on control, access, and dissemination of intelligence information. This policy is available from the government requiring activity. Written approval of the Contracting Officer is required prior to subcontracting any work effort that requires access to intelligence information.

6. Ref 10.j:Controlled Unclassified Information: For Official Use Only (FOUO) Information or Personally Identifiable Information (PII), received or generated under this contract shall be controlled and protected, marked, and safeguarded, as specified in AR 25-55 (DA Freedom of Information Act Program), Chapter 5, AR 380-5 (DA Information Security Program) and DoD 5200.01-M, Volume 4 (DoD Information Security Program: Controlled Unclassified Information (CUI). This includes PII, as defined in DoDD 5400.11 (DoD Privacy Program).

7. Ref 10.k: This work performance will require Contractor access to Army Knowledge Online (AKO), NIPRNET and SIPRNET. All access to SIPRNET or any classified system will only be at Government requiring activity work locations. All system access will be sponsored by the Contracting Officer’s Representative (COR).

7a. Ref 10.k: Accreditation of the SIPRNET to transport NATO Secret and below information resulted in additional security measures across the board. Per DoDM 5200.01-V1, all cleared DoD military, civilian and contractor personnel briefed on their responsibilities for protecting U.S. classified information, shall be briefed simultaneously on the requirements for protecting NATO classified information. The Contractor Facility Security Officer (FSO) shall provide a NATO “awareness briefing” to contractor personnel performing work at Government requiring activity work locations and shall maintain a written acknowledgment of the individual's receipt of the awareness briefing along with statement of understanding of responsibilities for safeguarding NATO classified information.

The NATO awareness briefing does not constitute “need to know or access approval” to NATO classified information and shall not be entered in Joint Personnel Adjudication System (JPAS) or approved successor system, when implemented. The Contractor shall provide copies of NATO awareness briefings to the COR, upon request.

8. Ref 11.a: Properly cleared contractor personnel who have an established need-to-know in accordance with this contract are authorized access to classified information which supports this work effort. Access to classified information shall be at U.S. Government or U.S. Government controlled facilities only, to include Government facilities visited while in a temporary duty (TDY) travel status in support of this contract The Contractor shall not remove any classified materials or information from the Government work site(s), nor shall the Contractor reproduce, generate, or store any classified materials or information relating to this contract at other than specified Government work locations. This includes downloading, storing, or transmitting classified information on or to any unauthorized software, hardware, or information technology system. Classified material shall only be stored at Government requiring activity work locations in Government GSA approved security containers, or as directed by the COR and/or U.S. Government Security Officials.

8a. Ref 11.a: Contractor Responsibility: By memorandum dated 1 April 2005, the Deputy Under Secretary of Defense (Counterintelligence and Security) authorized the use of JPAS to verify security clearance levels for personnel who require access to classified information within DoD. Within Army, use of JPAS is mandated until

2nd Signal Brigade ELMR Support DD Form 254, 20190226, Block 13 Continuation Sheets Page 4 of 10 approved successor system (Defense Information System for Security (DISS) is fully deployed. The Contractor FSO shall ensure all personnel performing on this work effort have security access level, Information Technology (IT) level, Contractor affiliation, Security Management Office (SMO) affiliation and all other required information accurately reflected/populated in JPAS or successor system.

8b. Ref 11.a: The Contractor shall submit a Visit Authorization Request (VAR) via JPAS or approved successor system which reflects all cleared contractor personnel who will be performing on this contract. VARs shall include the contract/task order number in the additional information block and COR/Government Requiring Activity (RA) POC name and telephone number. All VARs shall be maintained current throughout the life of the contract and shall be updated as personnel or other relevant changes occur. All Contractor personnel must be reflected on a current VAR/roster in order to perform on this contract. Prime contractor shall ensure all subcontractors comply with these requirements. Contractor shall contact the COR for Security Management Office (SMO) codes for all work locations:

8c. Ref 11.a: Security In/out-processing. All contractor personnel integrated or embedded with NETCOM organizations shall in-process through the supporting NETCOM organizational G2/S2/Security Office at work performance start date. All contractor personnel integrated or embedded with NETCOM organizations shall out-process and clear through the supporting NETCOM organizational G2/S2/Security Office upon termination of employment on the contract or upon contract expiration/termination, whichever occurs first. Above requirements are applicable if there is a change in primary work performance location while employed on the contract. The prime contractor shall ensure above requirements are included in subcontracts and lower tier contracts when personnel are integrated or embedded with NETCOM organizations. Per AR 380-49, “embedded and/or integrated contractors are those who operate out of government-supplied on-base space.”

8d. Ref 11.a: Required Security Training: Army Learning Management System (ALMS) Initial Security Orientation and Annual Refresher Training. Within 30 business days of work start date, contractor personnel shall complete the Department of the Army standardized computer web-based Initial Security Orientation training and annually thereafter, shall complete the Annual Security Refresher Training, both available at https://www.lms.army.mil, under Information Security Program training. The system will automatically direct the user to the appropriate course based on their training history. Certificates of successful completion, of initial or annual refresher training, shall be provided to the COR within three (3) business days of completion of training. This training is in addition to unit or installation specific security training.

9. Ref 11.e: Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M) and any revisions to DoD 5220.22-M.

9a. Ref 11.e: This is a non-personal services contract (see Block 9). This contract will require access to classified and controlled or sensitive information and facilities. Highest level security clearance requirement for this work effort is a final U.S. Government issued SECRET security clearance. All contractor personnel working on this contract shall have the required security clearance at contract performance start date and shall maintain the required security clearance over the life of the contract.

9b. Ref 11.e: Classified information generated or received during work performance on this contract shall be controlled, marked, protected, transmitted, and safeguarded in accordance with AR 380-5 and current Army and DoD policy and shall only be at specified Government requiring activity work locations.

9c. Ref 11.e: The process of extracting, summarizing, incorporating, paraphrasing, restating or generating, in new form, information already classified and marking the newly developed material consistent with the classification markings that apply to the source information, is derivative classification. Derivative classification also includes the classification of information based on instructions from a security classification guide/guidance. The duplication or reproduction of existing classified information is not derivative classification. Any derivatively classified information generated during performance under this contract will normally be marked consistent with the

2nd Signal Brigade ELMR Support DD Form 254, 20190226, Block 13 Continuation Sheets Page 5 of 10 classification markings reflected on the source material(s). However, a compilation of information could warrant a change in classification level of the information, or, it could warrant the classification of previously unclassified information. The Contractor shall consult with the COR regarding any potential classification issues when generating information and/or deliverables in support of this contract..

9d. Ref 11.e: The Government requiring activity will identify, or provide, additional instruction or appropriate security classification guides/guidance to the Contractor, as required. The Contractor shall notify the COR, in writing, of any instance where referenced security classification guides/guidance cannot be accessed at links or sites specified in this contract or specified in separate correspondence. The prime contractor shall ensure all applicable security classification guides/guidance are made available to any subcontractor(s), as appropriate.

9e. Ref 11.e: In accordance with Under Secretary of Defense for Intelligence Memorandum, 31 January 2019, subject: Derivative Classification Training, all Department of Defense (DoD) personnel with access to classified information must complete derivative classification training on an annual basis. All Contractor personnel who require access to classified information during work performance on this contract shall successfully complete initial derivative classification training at employee work performance start date and successfully complete derivative classification refresher training on an annual basis, thereafter. Access to classified includes, but is not limited to, access to classified systems and networks. Contractor initial and continued access to classified systems and networks is contingent upon successful completion of this prescribed training requirement. Derivative classification training is available on line at the DSSA/STEPP website http://www.cdse.edu/stepp/index.html, under Information Security. (Derivative Classification Course (IF103.16)/ Derivative Classification Exam (IF109.06)/Derivative Classification Refresher (IF 109.16)/Derivative Classification Exam (IF 109.06), or current versions). Certificates of successful completion of initial and annual refresher training shall be provided to the COR within three (3) business days of completion of training.

9f.Ref 11.e) Above training requirements are applicable to subcontractor and lower-tier subcontractor personnel who require access to classified information. The prime Contractor shall require subcontractors to include above requirements in lower tier subcontracts.

10. Ref 11f: Access to classified information OCONUS shall be restricted to U.S. Government controlled locations/compounds. Primary work performance location is in Federal Republic of Germany. Storage, custody, and control of classified information OCONUS remains the responsibility of the requiring activity and not the Contractor. Hand-carry of classified information is not authorized.

11. Ref 11.j: The Contractor shall comply with DOD Directive 5205.02E, Army Regulation 530-1, and the requiring activity OPSEC program. The Contractor shall ensure all contractor employees and subcontractors performing work under this task order complete Level I OPSEC training within 30 calendar days of start of employee performance on this task order and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the COR upon request. Annual refresher training may be completed on-line at:

http://cdsetrain.dtic.mil/opsec/. A record of completion will be provided to the COR and unit/activity security manager. (Ref AR 530-1.)

11a. Ref 11.j: In accordance with the Performance Work Statement, the Contractor shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within 90 calendar days of contract award. The Contractor shall identify an individual to function as OPSEC Coordinator and shall ensure this individual completes Level II OPSEC training within (INSERT TIMEFRAME). Certification of training shall be provided to the COR within.5 business days of completion of training.

12. Ref 11.l: See paragraph 6. Ref 10.j above.

13. Ref 11.m: Information Assurance (IA) Training. All contractor personnel with access to Government information systems and networks shall successfully complete all required initial and annual IA awareness training as specified in AR 25-2 and as directed by the Government requiring activity. Training is available at https://cs.signal.army.mil.

DD Form 254, 20190226, Block 13 Continuation Sheets Page 6 of 10

13a. Ref 11.m: Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at https://atc.us.army.mil , in the unit container designated by the COR. Certificates of successful completion of IA training, Acceptable Use Policies (AUP), applicable baseline and computing environment certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

13b. Ref 11.m: The Contractor shall ensure that all contractor employees and subcontractor employees requiring IA awareness training complete the training at the start of work performance on this contract and annually thereafter for the duration of this contract.

13c. Ref 11.m: Information Assurance Workforce Certification. DFARS clause 252.239-7001 (Information

Assurance Contractor Training and Certification) applies to this contract. This contract is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management IA skills for personnel performing IA functions within DoD. Functions spanning multiple levels require certification of the highest level functions.

Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty.

13d. Ref 11.m: The Contractor shall ensure its IA workforce members have the baseline certifications corresponding to their IA functions, as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3 of DoD 8570.01-M at work performance start date. Contractors shall have all required Computing Environment (CE) certificates at contract start date. The IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. The Contractor shall ensure that all employee certifications remain active and are renewed prior to expiration.

13e. Ref 11.m: The Contractor shall ensure that all employees IA certifications are released to the

Department of Defense through the Defense Workforce Certification Application at https://dwc.dmdc.osd.mil/appj/dwc.

13f. Ref 11.m: Table 1 reflects the Personnel Security (IT Level) and IA Workforce Specialty requirements, aligning the IA functional responsibilities and access levels to the contract tasks, in accordance with DoD 8570.01-M.

Table 1. Information Technology Access and IA Certification Requirements.

Functional Category

IT Level

(IAW AR

25-2) Security

Clearance Investigation

Required

IA Certification Category and Level

(IAW DOD

8570.01- M and

BBP 05-PR- M-

Computing Environment Certifications

Senior Service Manager (CM) II SECRET Tier 3 IAM-I No

Intermediate Service Technician (ST) II SECRET Tier 3 IAT-I No

Journeyman Service Technician (ST) II SECRET Tier 3 IATI No

13.g. Ref 11.m: Non-Government-owned computing systems or devices. The Contractor shall comply with AR

25-1 and AR 25-2. The Contractor shall not install or connect non-Government-owned computing systems or devices to Government networks without the COR's coordinating and obtaining proper authorization from the appropriate Information System Security Manager (ISSM), ensuring that all software has a Government Certificate

2nd Signal Brigade ELMR Support DD Form 254, 20190226, Block 13 Continuation Sheets Page 7 of 10 of Networthiness or has been authorized under the Risk Management Framework Assess Only process. The non- Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

13.h. Ref 11.m: Protection of Sensitive Unclassified Data. The Contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and For Official Use Only (FOUO), proprietary, and Law Enforcement Sensitive information residing on Mobile Computing Devices (MCD) or other external media, is protected in accordance with current Data at Rest (DAR) guidelines and requirements.

The Contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to, laptop, Netbook, notebook, or tablet computers, and mobile phones or equivalent devices. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks, and other portable digital storage devices.

14. Access to Protected Information. Protected information means all non-public information, including, but not limited to, trade secrets or proprietary information of other Contractors, Government source selection information, Privacy Act or personally identifiable information (PII), or any other information with distribution limited by the U.S. Government. If, during the performance of this requirement, Contractor personnel obtain access by any means to protected information, they shall not disclose, publish, divulge, release, or make known, in any manner or to any extent, the information except as necessary to carry out duties under this contract. Protected information shall be given only to persons specifically granted access to this sensitive information and may not be further divulged without specific prior written approval from an authorized U.S. Government individual. Further, contractor employees may use any non-public information for official/authorized U.S. Government purposes, and they shall not use the information for their personal gain, the gain of their employer, or the gain of anyone else. The Contractor shall notify the Contracting Officer of any potential organizational conflicts of interest created by any such access;

however, a nondisclosure agreement will not overcome an Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5. Moreover, the Trade Secrets Act prohibits releasing proprietary information without the owner’s consent. Accordingly, all Government Contractors are required to mark their proprietary information, and any time the Contractor is given inadvertent access to such marked information, the Contractor shall inform the Contracting Officer of the access.

15. Common Access Card (CAC). The Government will provide special access badges as necessary. The Prime Contractor Facility Security Officer (FSO) shall ensure that all Contractor personnel acquire and maintain CACs.

The approving Government Trusted Agent (TA) may give access to the FSO using the online Trusted Associate Sponsorship System (TASS), https://tass.dmdc.osd.mil/tass. Contractor eligibility remains in force during employment under the contract for those employees who have a valid and recurring requirement for access to Government facilities or automation systems to perform those duties stipulated in the contract. The Contractor shall use a valid CAC to access the Government domain. The Contractor shall immediately return the CACs to the COR when the Contractor employee’s employment is terminated or upon expiration of the contract. The CACs expire when Contractor employee’s eligibility terminates or three years from the issuance date, whichever occurs first. The Contractor is responsible for all CACs and shall report all lost or stolen CACs to the COR immediately.

16. Contractor Identification Requirements. In accordance with FAR 37.114 (c), all contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious are required to identify themselves as such to avoid being mistaken for Government officials. Contractors performing work at Government workplaces shall provide their employees with an easily readable identification (ID) badge indicating the employee's name, the contractor's name, the functional area of assignment, and a recent color photograph of the employee. Contractors shall require their employees wear the ID badges visibly when performing work at Government workplaces. Contractor personnel shall also ensure that all e-mails, documents or reports they produce are suitably marked as Contractor products and/or that Contractor participation is appropriately disclosed. All signature blocks on e-mails shall indicate that the sender is a Contractor employee and include the Contractor's company name.

DD Form 254, 20190226, Block 13 Continuation Sheets Page 8 of 10

17. Access and General Protection Security Policy and Procedures. Contractor and all associated sub-contractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office.

Contractor workforce shall comply with all personal identity verification requirements of FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes. Contractor personnel shall comply with all security policies/procedures in effect at all work and TDY locations.

18. Antiterrorism Level I Training. The Contractor shall ensure that all contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas complete Antiterrorism (AT) Level I awareness training within 30 calendar days after start of employee performance on this contract. Within 5 calendar days after successful completion of training, the contractor shall certify to the COR or KO that all employees performing work under this contract have completed the AT Level I awareness training. AT Level I awareness training is available at https://jkodirect.jten.mil, course #JS-US007 or current version is required to receive credit for the training. This training is in addition to any required unit or theater specific AT Level I training which may be more stringent based on area of operation or need for heightened awareness.

19. Outside Continental United States (OCONUS) Travel. This contract requires OCONUS performance and travel.

The Contractor employees shall contact the Government requiring activity Antiterrorism Office (ATO) to receive a specific theater AT/threat briefing prior to departing on OCONUS temporary duty travel. Requirements for such briefings will be in accordance with theater policies and procedures.

20. Threat Awareness and Reporting Program. Contractor personnel shall comply with all Threat Awareness and Reporting Program (TARP) reporting requirements in accordance with AR 381-12, and as directed by the Government requiring activity. Contractor personnel shall report threat-related incidents, behavioral indicators, and other matters of Counterintelligence (CI) interest as specified in AR 381-12, Chapter 3, to the nearest military CI office, the Facility Security Officer, the Federal Bureau of Investigation, or the Defense Security Service (DSS).

20a. The Contractor shall ensure all employees, to include subcontractor employees, attend threat awareness training within 30 calendar days of employee work start date and annually thereafter. Training must be conducted by a supporting CI agent. The initial training may be satisfied by taking the authorized on-line training at https://www.lms.army.mil if attendance at a CI training session is not possible within 30 calendar days of employee work start. Certificate of completion shall be maintained on file. The on-line training does not replace the requirement to attend the first available CI conducted threat awareness training session. The Contractor shall maintain training records which include employee names, training dates, training locations, and method of training and shall make such records available to the COR, upon request.

20b. Contractor personnel who require access to information, or who will be performing or participating in any functions, as outlined in AR 381-12, paragraph. 2-6, shall contact their COR who will coordinate with the supporting Government Security Manager for scheduling of special CI threat-awareness briefings/and debriefings, as appropriate. This includes Contractor personnel who require access to Sensitive Compartmented Information (SCI), Special Access Program (SAP) information, cryptographic information, or who are system administrators or key information network personnel with administrator-level privileges on classified or unclassified Army information systems. These contractor personnel shall notify their COR in advance of any foreign travel to determine if special CI threat travel briefings/debriefings are a requirement, as specified in paragraph AR 381-12, paragraph 2-6a. The COR will coordinate with the supporting Government on-site Security Manager for this determination.

21. iWATCH. The Contractor shall ensure that all employees and subcontractor employees performing work under this contract are trained on the local iWATCH program within 30 calendar days of start of employee performance on this contract. The requiring activity ATO will provide the locally developed iWATCH training. The Contractor shall maintain all iWATCH training records and shall provide copies to the COR upon request.

DD Form 254, 20190226, Block 13 Continuation Sheets Page 9 of 10

22. Contractor personnel shall comply with all applicable security regulations, guidance, and procedures, including local, referenced in this contract (DD Form 254, the Performance Work Statement (PWS), and other contract documentation) and in effect at all work locations. Contractor personnel shall attend all Government provided or Government sponsored security and security awareness training as specified by the Government requiring activity.

This includes successful completion of all required on-line security training, as directed by the Government requiring activity.

23. Ref 17f: In accordance with AR 380-49, the Prime contractor shall provide a copy of the DD Form 254 and all revisions, for any classified subcontract supporting this work effort, to the Government requiring activity. Copies shall be provided to the COR, 2d Signal Brigade S2 and NETCOM G2 INDSEC Specialists. In addition, the prime contractor shall require any subcontractors who have lower tier subcontractors to also comply with this requirement.

DD Forms 254 shall be provided to the following:

2d Signal Brigade, S2 Unit 29800 Box 83

APO, AE

09096

NETCOM, RM#2320

2133 Cushing Street ACofS, G2, Box Number #2 Fort Huachuca, AZ 85613 Unclas Fax DSN 879-8787, Cml (520) 538-8787 Email: usarmy.huachuca.netcom.list.G2-ACCS-team@mail.mil

24. Emergencies and Force Protection Conditions. During declared emergencies and/or elevated Force Protection Conditions (FPCONs) Charlie or Delta, contractor performance under this contract shall be determined by the COR or KO. All Contractor employees providing services under this contract are required to report for duty as scheduled and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the KO or COR. The Contractor Project Manager shall keep the COR apprised of all personnel whereabouts when in a temporary duty (TDY) location.

25. Ref 14: Applicable Security Documents: (Reference Army Regulation (AR) are available at:

https://armypubs.army.mil/; DoD documents are available at http://www.dtic.mil/whs/directives/index.html)

AR 25-1 Army Information Technology AR 25-2 Information Assurance AR 25-55 The Department of the Army Freedom of Information Act Program AR 190-13 The Army Physical Security Program (FOUO requires AKO access) AR 190-51 Security of Unclassified Army Property (Sensitive and Non-sensitive) AR 350-1 Army Training and Leader Development AR 380-5 Department of the Army Information Security Program AR 380-27 Control of Compromising Emanations (FOUO requires AKO access) AR 380-40 Safeguarding and Controlling Communications Security Material (FOUO requires AKO access) AR 380-49 Industrial Security Program AR 380-67 Personnel Security Program AR 381-12 Threat Awareness and Reporting Program (TARP) AR 525-13 Antiterrorism (FOUO ) AR 530-1 Operations Security (OPSEC) AR 710-2 Supply Policy Below the National Level DoDD 5205.02E DoD Operations Security (OPSEC) Program DoDD 5400.11 DoD Privacy Program DoDD 8140.01 Cyberspace Workforce Management

DD Form 254, 20190226, Block 13 Continuation Sheets Page 10 of 10

DoDI 8500.01 Cybersecurity DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT)

DoDM 5220.22 National Industrial Security Program Operating Manual (NISPOM) DoDM 8570.01 Information Assurance Workforce Improvement Program DoDM 5200.01-V1 DoD Information Security Program: Overview, Classification, and Declassification DoDM 5200.01-V2 DOD Information Security Program: Marking of Classified Information DoDM 5200.01-V3 DOD Information Security Program: Protection of Classified Information DoDM 5200.01-V4 DoD Information Security Program: Controlled Unclassified Information (CUI) TB 380-41 Security: Procedures for Safeguarding Accounting and Supply Control of COMSEC

Material (FOUO)

NETCOM Regulation 380-5: Information Security NETCOM Regulation 380-67: Personnel Security

Army CIO/G-6 Best Business Practice 05-PR-M-0002, Information Assurance (IA Training and Certification (available at https://www.milsuite.mil/wiki/Portal:Army_Cybersecurity/Best_Business_Practices)

Committee on National Security Systems Instructions (CNSSI) 4009, National Information Assurance Glossary (available at https://www.cnss.gov/CNSS/issuances/Instructions.cfm)

Deputy Under Secretary of Defense memorandum, 1 Apr 2005, Subject: Facilitating Classified Visits within the Department of Defense

Deputy Under Secretary of Defense for Intelligence memorandum, 31 Jan 2019, subject: Derivative Classification Training

Department of the Army G2 memorandum, 29 May 2007, subject: Classified Visit Request Process

US Army Cyber Command and Second Army Security Classification Guide for Cyberspace Operations and Security, 19 May 2016 (all subsequent versions) (FOUO available from the Government requiring activity).