Att_02.1_Item_13_Security_Guidance.pdf

DD Form 254 – Item 13 Continuation Sheet Contract Number: W900KK-19-R-0021

ITEM 13 SECURITY GUIDANCE:

The following items apply to this contract.

GENERAL GUIDANCE:

1. The contractor and subcontractor(s) shall comply with the Security Agreement (DD Form 441) and following Security Regulations (DoDM 5200.01 Volumes 1 thru 4), DoD Information Security Program, (DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM), AR 25-2 Information Assurance, AR 380-5 Information Security, AR 380-49 Industrial Security, AR 380-10 current versions and affiliated regulations.

2. The contractor and subcontractor employees requiring access to DoD government or DoD contractor's facilities where proof of a security clearance is required, shall meet the security access requirements specified by the host and/or owner of those facilities.

3. The Prime contractor and subcontractor companies that are Foreign company and or USA Foreign Owned, Controlled or Influenced (FOCI) will not be allowed access to Classified or Controlled Unclassified Information (CUI) which includes International Trafficking in Arms Regulations (ITAR) or the Export Administration Regulations (EAR) defense articles unless the Foreign company and or USA FOCI company meets the mitigation requirements of DoD 5220.22M w/change 2 National Industrial Security Program Operating Manual (NISPOM) and AR 380-49 Chapter 2 Section I and II, see reference Item 11M below.

4. The contractor is not authorized to disclose or release collateral Classified Military Information (CMI) information to the public. Disclosure or release is not authorized to other DoD organizations or agencies without review and written approval from the Requiring Activity KO, COR, or Agreement Officer (AO), Agreement Officer Representative (AOR) Cognizant Security Office.

a. The contractor is not authorized to disclose or release Controlled Unclassified Information (CUI) Technical Data and Critical Program Information (CPI) pertaining to this contract to the public without prior review and approval from the government Public Affairs Officer, Contracting Officer Representative (COR), or Agreement Officer Representative (AOR) and Requiring Activity Cognizant Security Office. Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 12.

b. The contractor is not authorized to disclose or release any program Classified Military Information (CMI) Controlled Unclassified Information (CUI) Technical Data or Critical Program Information (CPI) Export Controlled Information pertaining to this contract to any Foreign Nationals or Foreign Representatives without prior review and approval from the government Contracting Officer (KO), Contracting Officers

DD Form 254 – Item 13 Continuation Sheet Contract Number: W900KK-19-R-0021

Representative (COR) or Agreement Officer (AO) Agreement Officer Representative (AOR) and Requiring Activity Cognizant Security Office, Foreign Disclosure Officer (FDO). Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 17a of the DD254.

5. The Contractor shall only issue security clearances to employees requiring access to classified information with a Need-to-Know.

a. For collateral security clearances and access the contractor shall follow the Security guidelines established in DoD 5220.22M and the Defense Security Services (DSS) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php

b. Contractors who do not require a security clearance but require a government Common Access Card (CAC) must have a Tier 2S security investigation and follow the credentialing requirements of this contract!

6. The contractor and subcontractors shall ensure that all Classified information, Controlled Unclassified Information (CUI), Controlled Technical Information (CTI) documents, data and or export controlled information; is marked, handled and safeguarded with the appropriate security classification, distribution statement(s) and export control warning statement in accordance with DoDD 5230.24, DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM and DoDM 5200.01 Vol 1, 2, 3 and 4.

7. The Prime contractor is responsible for issuing all subcontractor DD Form 254 for any classified work or material that the subcontractor will have access to during this contract per chapter 7 of current version of DoD 5220.22M and AR 380-49.

a. The prime contractor FSO will sign DD Form 254, block 17h and ensure that program, and/or Army activity points of contact information are included on DD Form 254, block 13.

b. The prime contractor FSO will provide the KO and/or COR or the Agreement Officer (AO) and/or Agreement Officer Representative (AOR) with a copy of all subcontract DD Form 254s to be attached to the prime contract. The KO and/or COR or AO and/or AOR will provide a copy of all subcontract DD Form 254’s to the ISS and

DSS.

8. There is no security classification guides (SCGs) which are directly applicable to this effort. If, during this effort, it becomes necessary to create a security classification Reference (SCR) the contractor shall notify the contract officer representative who will seek the assistance and appropriate guidance from the local government ISSM, PM and Requiring Activity Cognizant Security Office.

DD Form 254 – Item 13 Continuation Sheet Contract Number: W900KK-19-R-0021

9. Contractors who work in a DoD or Contractor cleared facility on DA installations and or government leased facilities and who are embedded or integrated within a DA program or activity, shall report all adverse information, suspicious contacts, and other reportable incidents to the local security office.

10. The contractor and their subcontractors shall immediately report any loss, compromise, suspected compromise of classified information or any security violations which occur on this contract per DoD 5220.22–M with current changes, to their Facility Security Manager (FSO) and local DSS office. The contractor shall also inform the KO, COR, and the ISS.

11. The contractor shall ensure that all contract employees with security clearances meet the prescribed security training required by chapter 3 of DoD 5220.22M, paragraph 1-14 of AR 381-12 and the Defense Security Services (DSS) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php. New contractor personnel assigned duties related to the contractor shall receive training within 30 days on their assignment.

12. The contractor and their subcontractors will designate in writing a U.S. citizen (not a dual citizen) as the Insider Threat program official per paragraph 1-202 of DoD 5220.22M w/change 2. All contractors with security clearances shall comply with Insider Threat Training requirements per paragraph 3-103 of DoD 5220.22M w/change 2.

Additionally the contractor shall report threat-related incidents, behavioral indicators to the Requiring Activity Cognizant Security Office. Insider Threat training information can be found at the following DSS site https://www.cdse.edu/

13. The contractor shall mark and protect all Controlled Unclassified Information (CUI) which includes Official Use Only (FOUO) Information generated and/or provided under this contract per DoD 5200.01-V04.

14. The contractor and subcontractors shall ensure that all contract employees with security clearances meet the annual security training required by DoD 5220.22M, NISPOM AR 380-5 and AR 381-12;

Insider Threat Training Security Refresher Training AT Level 1 Training TARP Training OPSEC Training

New contractor personnel assigned duties related to the contractor shall receive training within 30 days on their assignment.

DD Form 254 – Item 13 Continuation Sheet Contract Number: W900KK-19-R-0021

ITEM 10:

Ref Item 10.a: COMSEC INFORMATION - Classified COMSEC material is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. COMSEC access shall be IAW DoD 5220.22-M and AR 380-

40. When access is required at Government facilities, contractor personnel will adhere to COMSEC rules and regulations as mandated by Command policy and procedures.

Written concurrence of the KO is required prior to subcontracting.

ITEM 11:

Ref Item 11.a: ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTORS FACILITY OR A GOVERNMENT ACTIVITY - Contractor performance is restricted to the name and address of contractor facility or government activities listed below. Government agency or activity will provide security classification guidance for performance of this contract. Submit visit request to the Facility Security Officer (FSO), Security Management Office via JPAS for need-to-know verification and access.

Integrated Development Environment (IDE) 3045 Technology Parkway Orlando, FL 32826

Ref Item 11e: PERFORM SERVICES ONLY - This contract is to support PM TRADE Live Training Transformation Consolidated Product Line Management (LT2 CPM) Plus ID/IQ contract will provide the management, maintenance, and evolution of the LT2 Product Line core assets and will provide total life cycle support to Product Managers within the LT2 Product Line. The contractor will work in contractor and/or DoD cleared facilities. Classification markings and distribution statements on any material to be furnished will be provided by the contract logistics personnel and site security guidance necessary for the performance of the contract.

Ref Item 11.f: ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S - This contract may require your company to have access to classified information in an overseas area. The specific overseas area(s) will be provided by the Contract Monitor or the Contracting Officer. Classified information or materials will remain under the direct control of the US government while in an overseas area unless prior approval is granted by this command. Release of classified information to a foreign entity will be accomplished in accordance with Chapter 10, DoD 5220.22-M w/change 2.

Ref Item 11.j: OPERATIONS SECURITY (OPSEC) REQUIREMENTS - The contractor shall develop, implement, and maintain a facility level OPSEC program to protect classified and/or sensitive unclassified information used at the contractor, government and other contractor facilities during the performance of this contract. The OPSEC requirements may be included in the Contractor’s Standard Practice Procedures (SPP) or Technology Control Plan (TCP), whichever is more applicable.

DD Form 254 – Item 13 Continuation Sheet Contract Number: W900KK-19-R-0021

Ref Item 11.l: RECEIVE, STORE OR GENERATE CONTROLLED UNCLASSIFIED INFORMATION (CUI) – The contractor and all subcontractors personnel must protect CUI material and information in accordance with DoDM 5200.01 vol 4.

Ref Item 11.M: The prime and subcontractors who have access to Controlled Unclassified Information, software, technical data and export controlled documents must be aware of their responsibility to protect this information in accordance with DoDM 5200.01 Vol 4. Only those contractors having access to classified networks, software, information and technical data must have a valid security clearance and need-to-know. Both instance must be in accordance with the current version of DoDM 5200.01 Vol 4 and DoD 5220.22-M w/change 2 National Industrial Security Program Operating Manual (NISPOM).

a. In the case of classified material with employees with dual citizenship, Foreign companies and or USA FOCI companies;

No dual citizenship individual, Foreign or USA FOCI companies are allowed on this contract until their Foreign and or USA FOCI status has been verified and mitigated by the CSA ISS and DSS.

No classified information shall be provided to an individual of dual citizenship or, Foreign or USA FOCI company until the CSA, FDO has provide foreign disclosure determination and or DDL based of the Foreign and or USA FOCI country status.

Prime and subcontractor dual citizens and or Foreign and or USA FOCI

Company must provide a copy of the appropriate U.S. State Department documentation Technical Assistance Agreement (TAA) and or DSP-5 license authorizing the Foreign and or USA FOCI Company the ability to receive such materials or other licenses may be required based on the extent of the foreign involvement.

Prime and subcontractor must provide a Technology Control Plan (TCP) to the KO and CSA ISS showing how data, information will be handled and distributed.

A copy of the TCP is available from https://dss.mil go to the search window upper right and type in Technology Control Plan.

If Individuals with dual citizenship only, have a current security investigation and security clearance, they are approved to work on this contract.

If the dual citizenship, Foreign and or USA FOCI has been mitigated, ITAR and EAR licensing validated, TCP provided and foreign disclosure approved, the appropriate and favorable security guidance will be provided. If the above has not met, they will not be allowed access to any classified information on this contract.

DD Form 254 – Item 13 Continuation Sheet Contract Number: W900KK-19-R-0021

b. In the case of Controlled Unclassified Information (CUI), Unclassified Technical Information (CTI) or Export Controlled Information with an individual with dual citizenship, Foreign and or USA FOCI company;

Individuals with dual citizenship, Foreign and or USA FOCI Company will not have access to unclassified Technical information marked distribution B through F, FOUO, ITAR Defense Articles and EAR technology which are controlled by either the ITAR or the Export Administration Regulations (EAR), unless the prime and subcontractors provide a copy of the appropriate U.S. State Department Technical Assistance Agreement (TAA) and or DSP-5 license authorizing Individuals with dual citizenship Foreign and or USA FOCI Company that ability to receive such materials to the KO and CSA. Other licenses may be required based on the extent of the foreign involvement.

Ref Item 11.M: Any contractor personnel who have dual citizenship are only authorized access to collateral classified information and must be aware of and meet the guidelines of the Department of the Army Security Executive Agent Directive 4 (attached) monitored by the company FSO / CSSO . The company FSO / CSSO must maintain a list of all dual citizen employees and provide that list upon inspection from DSS or the cognizant security authority ISS. Individuals who have access to software and technical data must have the appropriate security clearance in accordance with the current version of DoD 5220.22-M w current changes and DoDM 5105.21 Vol1-3.