Collateral_Item_13_Security_Guidance.docx

DD Form 254 – Item 13 Continuation Sheet Contract Number: W900KK-19-R-0080

ITEM 13 SECURITY GUIDANCE:

The following items apply to this contract.

GENERAL GUIDANCE:

1. The contractor and subcontractor(s) shall comply with the Security Agreement (DD Form 441) and following Security Regulations (DoDM 5200.01 Volumes 1 thru 4), DoD Information Security Program, (DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM), AR 25-2 Information Assurance, AR 380-5 Information Security, AR 380-49 Industrial Security, AR 380-10 current versions and affiliated regulations.

2. The contractor and subcontractor employees requiring access to DoD government or DoD contractor's facilities where proof of a security clearance is required, shall meet the security access requirements specified by the host and/or owner of those facilities.

3. The Prime contractor and subcontractor companies that are Foreign company and or USA Foreign Owned, Controlled or Influenced (FOCI) will not be allowed access to Classified or Controlled Unclassified Information (CUI) which includes International Trafficking in Arms Regulations (ITAR) or the Export Administration Regulations (EAR) defense articles. The Foreign company and or USA FOCI company must meet the mitigation requirements of DoD 5220.22M w/change 2 National Industrial Security Program Operating Manual (NISPOM) and AR 380-49 Chapter 2 Section I and II, see reference Item 11M below.

4. The contractor is not authorized to disclose or release collateral Classified Military Information (CMI) information to the public. Disclosure or release is not authorized to other DoD organizations or agencies without review and written approval from the Requiring Activity KO, COR, Cognizant Security Office.

a. The contractor is not authorized to disclose or release Controlled Unclassified Information (CUI) Technical Data and Critical Program Information (CPI) pertaining to this contract to the public without prior review and approval from the government Public Affairs Officer, Contracting Officer Representative (COR), and Requiring Activity Cognizant Security Office. Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 12.

b. The contractor is not authorized to disclose or release any program Classified Military Information (CMI) Controlled Unclassified Information (CUI) Technical Data or Critical Program Information (CPI) Export Controlled Information pertaining to this contract to any Foreign Nationals or Foreign Representatives without prior review and approval from the government Contracting Officer (KO), Contracting Officers Representative (COR) and Requiring Activity Cognizant Security Office, Foreign Disclosure Officer (FDO). Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 16.

5. The Contractor shall only issue security clearances to employees requiring access to classified information with a Need-to-Know.

a. For collateral security clearances and access the contractor shall follow the Security guidelines established in DoD 5220.22M and the Defense Security Services (DSS) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php

b. Contractors who do not require a security clearance but require a government Common Access Card (CAC) must have a Tier 2S security investigation and follow the credentialing requirements of this contract!

6. The contractor and subcontractors shall ensure that all Classified information, Controlled Unclassified Information (CUI), Controlled Technical Information (CTI) documents, data and or export controlled information; is marked, handled and safeguarded with the appropriate security classification, distribution statement(s) and export control warning statement in accordance with DoDD 5230.24, DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM and DoDM 5200.01 Vol 1, 2, 3 and 4.

7. The Prime contractor is responsible for issuing all subcontractor DD Form 254 for any classified work or material that the subcontractor will have access to during this contract per chapter 7 of current version of DoD 5220.22M and AR 380-49.

a. The prime contractor FSO will sign DD Form 254, block 17h (NEW DD254, 16 OLD DD254) and ensure that program, and/or Army activity points of contact information are included on DD Form 254, block 13.

b. The prime contractor FSO will provide the KO and/or COR with a copy of all subcontract DD Form 254s to be attached to the prime contract. The KO and/or COR will provide a copy of all subcontract DD Form 254s to the ISS and DSS.

8. There is no security classification guides (SCGs) which are directly applicable to this effort. If, during this effort, it becomes necessary to create a security classification Reference (SCR) the contractor shall notify the contract officer representative who will seek the assistance and appropriate guidance from the local government ISSM, PM and Requiring Activity Cognizant Security Office.

9. Contractors who work in a DoD or Contractor cleared facility on DA installations and or government leased facilities and who are embedded or integrated within a DA program or activity, shall report all adverse information, suspicious contacts, and other reportable incidents to the local security office.

10. The contractor and their subcontractors shall immediately report any loss, compromise, suspected compromise of classified information or any security violations which occur on this contract per DoD 5220.22–M with current changes, to their Facility Security Manager (FSO) and local DSS office. The contractor shall also inform the KO, COR, and the ISS.

11. The contractor shall ensure that all contract employees with security clearances meet the prescribed security training required by chapter 3 of DoD 5220.22M, paragraph 1-14 of AR 381-12 and the Defense Security Services (DSS) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php. New contractor personnel assigned duties related to the contractor shall receive training within 30 days on their assignment.

12. The contractor and their subcontractors will designate in writing a U.S. citizen as the Insider Threat program official per paragraph 1-202 of DoD 5220.22M w/change 2. All contractors with security clearances shall comply with Insider Threat Training requirements per paragraph 3-103 of DoD 5220.22M w/change 2. Additionally the contractor shall report threat-related incidents, behavioral indicators to the Requiring Activity Cognizant Security Office. Insider Threat training information can be found at the following DSS site https://www.cdse.edu/

13. The contractor and subcontractors shall ensure that all contract employees with security clearances meet the prescribed security training required by chapter 3 of DoD 5220.22M, paragraph 1-14. New contractor personnel assigned duties related to the contractor shall receive training within 30 days on their assignment.

ITEM 10:

Ref Item 10.j: CONTROLLED UNCLASSIFIED INFORMATION (CUI) - For Controlled Unclassified Information (CUI) which includes Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoD 5200.01-V04.

ITEM 11:

Ref Item 11.l: RECEIVE, STORE OR GENERATE CONTROLLED UNCLASSIFIED INFORMATION (CUI) – The contractor and all subcontractors personnel must protect CUI material and information in accordance with DoDM 5200.01 vol 4.

Ref Item 11.M: The prime and subcontractors who have access to Controlled Unclassified Information, software, technical data and export controlled documents must be aware of their responsibility to protect this information in accordance with DoDM 5200.01 Vol 4. Only those contractors having access to classified networks, software, information and technical data must have a valid security clearance and need-to-know. Both instance must be in accordance with the current version of DoDM 5200.01 Vol 4 and DoD 5220.22-M w/change 2 National Industrial Security Program Operating Manual (NISPOM).

a. In the case of classified material with employees with dual citizenship, Foreign companies and or USA FOCI companies;

· No dual citizenship individual, Foreign or USA FOCI companies are allowed on this contract until their Foreign and or USA FOCI status has been verified and mitigated by the CSA ISS and DSS.

· No classified information shall be provided to an individual of dual citizenship or, Foreign or USA FOCI company until the CSA, FDO has provide foreign disclosure determination and or DDL based of the Foreign and or USA FOCI country status.

· Prime and subcontractor dual citizens and or Foreign and or USA FOCI Company must provide a copy of the appropriate U.S. State Department documentation Technical Assistance Agreement (TAA) and or DSP-5 license authorizing the Foreign and or USA FOCI Company the ability to receive such materials or other licenses may be required based on the extent of the foreign involvement.

· Prime and subcontractor must provide a Technology Control Plan (TCP) to the KO and CSA ISS showing how data, information will be handled and distributed.

· If Individuals with dual citizenship only, have a current security investigation and security clearance, they are approved to work on this contract.

If the dual citizenship, Foreign and or USA FOCI has been mitigated, ITAR and EAR licensing validated, TCP provided and foreign disclosure approved, the appropriate and favorable security guidance will be provided. If the above has not met, they will not be allowed access to any classified information on this contract.

b. In the case of Controlled Unclassified Information (CUI), Unclassified Technical Information (CTI) or Export Controlled Information with an individual with dual citizenship, Foreign and or USA FOCI company;

Individuals with dual citizenship, Foreign and or USA FOCI Company will not have access to unclassified Technical information marked distribution B through F, FOUO, ITAR Defense Articles and EAR technology which are controlled by either the ITAR or the Export Administration Regulations (EAR), unless the prime and subcontractors provide a copy of the appropriate U.S. State Department Technical Assistance Agreement (TAA) and or DSP-5 license authorizing Individuals with dual citizenship Foreign and or USA FOCI Company that ability to receive such materials to the KO and CSA. Other licenses may be required based on the extent of the foreign involvement.

If Individuals with dual citizenship have a current security investigation and security clearance, they are approved to work on this contract.