18-R-0174__Block_13.docx

W56HZV-18-R-0174 Block 13 Continuation Sheet

CONTINUATION OF BLOCK 13

Item 10.a – COMMUNICATIONS SECURITY (COMSEC): Classified COMSEC material is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. COMSEC information/material will be accessed and/or processed IAW DoD 5220.22-M, NSA/CSS Policy Manual 3-16, AR 380-40 (Policy for Safeguarding and Controlling Communications Security), and additional security Guidelines for COMSEC (Attachment B). When access is required at Government facilities, contractor personnel shall adhere to COMSEC rules and regulations as mandated by Command policy and procedures. Contractor personnel requiring COMSEC access must be U.S. Citizens and possess a final clearance at the appropriate level. All contractors shall be briefed before access to COMSEC is granted. The contractor may be subject to the Department of Army Cryptographic Access Program (DACAP) if contractor employees handle unencrypted SECRET crypto or TOP SECRET crypto keying material. Subcontracts requiring classified COMSEC information shall be awarded only upon the written approval of the Government Contracting Officer.

Item 10.e.(2) – NON-SCI: Non-SCI information/material will be accessed and/or processed IAW DoD 5220.22-M, and additional security Guidelines for Intelligence Information: Non-SCI (Attachment C). Written concurrence of the Government Contracting Officer is required prior to subcontracting.

Item 10.g – NORTH ATLANTIC TREATY ORGANIZATION (NATO): Access to NATO information requires a final U.S. Government clearance at the appropriate level and a NATO access briefing/debriefing. Special briefings are required for access to NATO. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM Ch 10, Section 7. Written concurrence from the Government Contracting Officer is required prior to subcontracting.

Item 10.h – FOREIGN GOVERNMENT INFORMATION (FGI): FGI is not releasable to contractor employees who have not received a final clearance at the appropriate security level. Written concurrence of the Government Contracting Officer is required prior to subcontracting.

Item 10.j – FOR OFFICIAL USE ONLY (FOUO): FOUO information generated and/or provided under this contract shall be safeguarded and marked as specified in Additional Guidelines for Controlled Unclassified Information (CUI) (Attachment A).

Item 10.k.(1) – CONTROLLED UNCLASSIFIED INFORMATION (CUI) generated and/or provided under this contract shall be safeguarded and marked as specified in additional Guidelines for Controlled Unclassified Information (CUI) (Attachment A).

Item 10.k (2) – SECURITY CLASSIFICATION GUIDANCE: Security Classification Guidance: Bradley Vehicle Systems Security Classification Guide, dated 20 January 2017.

Item 11.c – RECEIVE AND GENERATE CLASSIFIED INFORMATION: The contractor requires access to classified source data up to and including Secret in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, paragraph 4-208a, and the use of a bibliography.

Item 11.d – CLASSIFIED HARDWARE: Contractor must provide adequate storage at their facility for collateral classified hardware to the level of Secret.

Item 11.h – REQUIRE A COMSEC ACCOUNT: Contractor is authorized the use of secure telephones with fax, encryption equipment and keying material for classified program requirements.

Item 11.i – TEMPEST: Refer to scope of work and the CDRL that addresses the submission of this requirement. This requirement shall be flowed down to all U.S. subcontractors that use Information Systems to process classified material.

Item 11.j – OPERATIONS SECURITY (OPSEC) REQUIREMENTS: New program contractor personnel shall receive OPSEC training within 30 calendar days of program assignment. Annually, contractors shall complete OPSEC training and submit a report, validating 100% completion to the Government Security Office by 30 September. These requirements shall flow down to all approved U.S. subcontractors with access to either or both CUI and classified material.

Item 11.l. (1) – THREAT AWARENESS AND REPORTING REQUIREMENTS: ICW NISPOM 1-301, the contractor shall report threat-related incidents, behavioral indicators, and other matters of counterintelligence (CI) interest specified in AR 381-12, Chapter 3, through the facility security officer to the government security officer, the nearest military CI office, the Federal Bureau of Investigation, and the Defense Security Service. Annually, train personnel who handle classified information IAW AR 381-12, Chapter 2. This requirement shall be flowed down to all U.S. subcontractors that have access to classified information/material.

Item 11.m.(1) – THREAT AWARNESS AND REPORTING (TARP): ICW NISPOM 1-301, the contractor shall report threat-related incidents, behavioral indicators, and other matters of counterintelligence (CI) interest specified in AR 381-12, Chapter 3, through the facility security officer to the government security officer, the nearest military CI office, the Federal Bureau of Investigation, and the Defense Security Service. Annually, train personnel who handle classified information IAW AR 381-12, Chapter 2. This requirement shall be flowed down to all U.S. subcontractors that have access to classified information/material. Contact the individual in Block 17 to obtain local CI office information.

Item 12 – PUBLIC RELEASE: An electronic copy of the request with full text and graphics must be provided through the Government Contracting Officer at least forty-five (45) working days prior to the requested release date. If all or part of the information was generated by another organization, their written release authorization must accompany the request. Notification of loss or compromise of collateral classified information shall be provided to the Government Program Security Office within 72 hours of the incident, in addition to the reporting requirements outlined in the NISPOM.