Attachment_0003_-_DD_Form_254,_Contract_Security_Classification_Guide_(West).pdf

DD254 item 13 Continuation Sheet (Attachment 01) Contractor: TBD Solicitation #: W58RGZ-16-R-0271

11a: Access to classified information, classified processing, and/or storage of classified information is not authorized at the Prime contractor location.

11e: Equipment Maintenance Services, Reset and MWOs of Military Aircraft

Contract is for equipment maintenance services on equipment which processes classified information. Actual knowledge of, generation, or production of classified information is not required for performance of the contract. Cleared personnel are required to perform this service because access to classified information cannot be precluded by escorting personnel. Any classification guidance needed will be provided by the government.

11f: Any classified information obtained or accessed outside the United States will be given the same level of protection as stated within this document. Countries include South Korea and additional Government CONUS and OCONUS locations determined and approved by the COR and KO.

11j: Contractor is required to comply with the GCA OPSEC Plan which will be provided upon award of the contract, and the AT/OPSEC requirements stipulated in the Security Requirements Clause of the PWS, or equivalent, for this contract.

GCA approval is required prior to imposing OPSEC requirements on a subcontractor.

11l: All Government material used or developed in the contract will be returned to the Government at the end of the contract performance.

IAW AR 381-12, Threat Awareness and Reporting Program (TARP), 1 Jun 16, Contractors will report threat-related incidents, behavioral indicators and other matters of Counter Intelligence (CI) interest specified in Chapter 3, to the Facility Security Officer (FSO), the nearest military CI office, the FBI, or the DSS. Contractor employees working as an integral part of the Army organization ARE REQUIRED TO COMPLETE ANNUAL Threat Awareness training. Contractor FSOs will ensure that all applicable AR 381-12 requirements are implemented for personnel who work at contractor facilities.

Concurrence of the Contracting Officer and G-2 (Intelligence and Security), will be obtained prior to issue of a Limited Access Authorization to a non-U.S. citizen in compliance with the NISPOM. Controlled Unclassified information as defined in DoDM 5200.01, VOL 4, may be disclosed to U.S. persons who are employed by the prime contractor or subcontractors or to such employees who are foreign persons when requirements of export control and other laws are met. The contractor is responsible for compliance with all applicable laws and regulations governing access to Classified Information or Controlled Unclassified Information.

The contractor is not authorized to release any data to foreign nationals or foreign representatives without an approved export license.

HSPD-12 requires that contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements of installation Provost Marshal Office, Director of Emergency Services or Security Office.

Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy.

IAW with DOD 5200.01, Volume 3, at a minimum, all on-site support contractors with access to classified information shall receive annual refresher training that reinforces the policies, principles, and procedures covered in their initial and specialized training. A record of completion shall be provided to the CSA.

Questions concerning any aspect of security will be referred to G-2 (Intelligence and Security), USAAMCOM for resolution.

Prior to sub-contracting with a foreign industry the U.S. contractor will consult with the Contracting Officer and G-2 (Intelligence and Security). Foreign sub-contractors must agree that only citizens of their country or the U.S. will be allowed to perform on the contract. The U.S. contractor is responsible for complying with the regulations outlined in the International Traffic In Arms Regulations (ITAR).

AT/OPSEC Requirements

AT Level I training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall retain certificates of completion for each contractor employee, subcontractor employee, and third party employee per paragraph 2.8 of the PWS.

AT level I awareness training is available at the following website: http://jko.jten.mil.

AT Awareness Training for Contractor Personnel Traveling Overseas. This standard language requires US based contractor employees and associated subcontractor employees to make available and to receive government provided area or responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

iWATCH Training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. The contractor and all associated subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the CO. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award. Training website:

http://www.myarmyonesource.com/FamilyProgramsandServices/iWatchProgram/Default.aspx

Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to a government information system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DoD Information Assurance Awareness prior to access to the IS and then annually thereafter.

For information assurance (IA)/information technology (IT) training. All contractor employees and associated subcontractor employees must complete the DoD IA awareness http://jko.jten.mil/ training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within 6 months of appointment to IA/IT functions.

For contracts that require OPSEC training. Per AR 530-1, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained with 30 calendar days of their reporting for duty and annually thereafter.

For Contract Requiring Performance of Delivery in a Foreign Country. DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors Outside the US. The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor's compliance with combatant commander and subordinate task force commander policies and directives.

Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility, or area. Contractor and all associated subcontractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

For contractors requiring a Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) remote access, via logon, to a DoD network using DoD-approved remote access procedures; or, (3) physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

For contractors that do not require a CAC, but require access to a DoD facility or installation. Contractor and all associated subcontractor employees shall comply with adjudication standards and processes using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014- 05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

For contracts that require handling or access to classified information. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified "Confidential," "Secret," or "Top Secret" and requires contractors to comply with: (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M) and, (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor.

Threat Awareness Reporting Program (TARP). For all contractors with security clearances.

Per AR 381-12, Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b.

The estimated date of completion of the contract is December 2026.

Technical POC and COR:

Robert D. Ritchie

AFMD

Bldg 5309, Martin Road Redstone Arsenal, AL 35803

(256) – 842-4538

25 May 2017 Signature Date