Attachment 5 - DD-254 BCTE.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

Additional Work Locations (Cont’d)

CBCSE and BCTC-ES products to support the Mission Training Complexes (MTCs) and sites will be procured and deployed to 40+ locations listed below over the life of the contract. The Top Secret sites also have Collateral equipment at those specified locations below. Details of the deployment schedules will be addressed in the appropriate TO(s) (may change based off operational need):

Collateral Sites

1. Fort Bragg, NC

2. Fort Drum, NY

3. Fort Stewart, GA

4. Fort Campbell, KY

5. Fort Polk, LA

6. Fort Hood, TX

7. Fort Riley, KS

8. Fort Carson, CO

9. Fort Bliss, TX

10. Fort Sill, OK

11. Joint Base Lewis-McChord (JBLM), WA

12. United States Army Central (USARCENT), Shaw AFB, SC

13. United States Army Special Operations Command (USASOC), Ft Bragg, NC

14. Fort Lee, VA

15. Joint Base San Antonio (JBSA) (Ft Sam Houston), TX

16. Schofield Barracks, HI

17. Joint Base Elmendorf-Richardson (JBER), AK

18. Fort Wainwright, AK

19. Sagami General Depot, Japan

20. Camp Humphreys, Korea

21. United States Army Garrison (USAG) Bavaria (Grafenwoehr), Germany

22. USAG Italy (Vicenza), Italy

23. USAG Rheinland-Pfalz, Kaiserslautern), and Germany Satellite Site USAG Rheinland-Pfalz (Baumholder), Germany

24. Army National Guard (ARNG) Leavenworth, KS

Army National Guard (ARNG) Fort Indiantown Gap, PA

25. Army National Guard (ARNG) Camp Dodge, IA

26. Army National Guard (ARNG) Gowen Field, ID

27. Army National Guard (ARNG) Camp Atterbury, IN

28. Army National Guard (ARNG) Fort Chaffee, AR

29. United States Army Reserve (USAR) Southern Training Division (TD) Ellington Field, TX – (1 BDE/75TCHouston)

30. United States Army Reserve (USAR) Atlantic TD Joint Base McGuire–Dix–Lakehurst (JBMDL), NJ – (2 BDE/75TCDix)

31. United States Army Reserve (USAR) Great Lakes TD Arlington Heights, IL – (3 BDE/75TC)

32. United States Army Reserve (USAR) Gulf TD Fort Knox, KY – (4 BDE/75TC)

33. United States Army Reserve (USAR) Pacific TD Camp Parks, CA – (5 BDE/75TC)

Top Secret Sites

1. Fort Bragg, NC

2. Fort Hood, TX

3. Camp Humphreys, Korea

4. Joint Base Lewis-McChord (JBLM), WA

5. Schofield Barracks, HI

6. United States Army Garrison (USAG) Bavaria (Grafenwoehr), Germany

7. Fort Leavenworth, KS (TPO-C, GSC, and MCTP)

8. Orlando, FL (PEO STRI, and General Dynamics Mission Systems)

9. Fort Huachuca, AZ

US ARMY SCI ADDENDUM

XXX 1. This agreement/contract requires access to Sensitive Compartmented Information (SCI). The Commander, US Army Intelligence and Security Command (INSCOM), acting on behalf of the DA Deputy Chief of Staff (DCS), G-2 as the Cognizant Security Authority (CSA) for the US Army, has exclusive security responsibility for all SCI released to the vendor/contractor or developed under the agreement/contract and held within the vendor’s/Contractor's SCI Facility (SCIF) or Co-utilization Agreement (CUA).

XXX 2. The Defense Intelligence Agency (DIA) has security inspection responsibility for SCI and the Defense Counterintelligence Security Agency (DCSA) retains responsibility for all collateral information released or developed under the agreement/contract and held within the DoD Vendor’s/Contractor's SCIF. All prime and sub-vendor/contractor DD Form 254’s prepared for agreements/contracts involving access to SCI under this agreement/contract must be processed through ACCS to the CM and Industrial Security Specialist for approval.

XXX 3. The vendor/contractor must establish a ACCS account with INSCOM G2. The URL to register for the Army ACCS account used to enter TS/SCI DD254's is;

https://accs.army.mil/registration

XXX 4. The manuals, regulations and directives checked below provide the necessary guidance for physical, personnel, and information security for safeguarding SCI, and are part of the security classification specification for this agreement/contract:

ICD 503, Intelligence Community Information Technology Systems Security

Risk Management, Certification and Accreditation.

ICD 704 Personnel Security Standards and Procedures Governing Eligibility

For Access to Sensitive Compartmented Information and Other Controlled

Access Program Information.

N/A ICD 705, Technical Specifications for Construction and Management of

Sensitive Compartmented Information Facilities.

N/A ICD 705-1, Physical and Technical Security Standards for Sensitive

Compartmented Information Facilities.

N/A ICD 705-2, Standards for the Accreditation and Reciprocal Use of Sensitive

Compartmented Information Facilities.

N/A Signals Intelligence Security Regulations (SISR) (Available from the CM)

N/A Imagery Policy Series (Available from the CM)

XXX DoDM 5105.21 Vol 1, SCI Administrative Security Manual: Administration of

Information and Information System Security

N/A DoDM 5105.21 Vol 2, SCI Administrative Security Manual: Administration of

Physical Security, Visitor Control, and Technical Security.

XXX DoD 5105.21 Vol 3, SCI Administrative Security Manual: Administration of

Personnel Security, Industrial Security and Special Activities.

XXX AR 380-28, DA Special Security System.

AR 25-2, Information Assurance.

N/A AR 380-381, Special Access Programs (SAPS).

XXX Army Handbook for SCI Contracts.

N/A Other

XXX 5. Contract estimated completion date: xxxxxxxx (PERIOD OF PERFORMANCE ONLY).

XXX 6. List the name, mailing address, email address and telephone number of the Government Primary and Alternate Contract Monitor (CM) for the SCI portion of this agreement/contract. The Government Program Security Monitor, and the Vendor/Contractor Security Point of Contact’s must be registered in the Army Centralized Contracts Security Portal (ACCS) in order to process SCI actions.

Primary Contract Monitor

Angela Stacy

PEO STRI PM SE

12211 Science Dr

Orlando, FL 32826 angela.s.stacy.civ@army.mil

(407) 384-5573

Alternate Contract Monitor

Bruce VanRemortel

PEO STRI PM SE

12211 Science Dr

Orlando, FL 32826-3276 bruce.j.vanremortel.civ@army.mil

(407) 455-2651

Program Security Monitor

Stanley Slupski

PEO STRI Attn: G2

12211 Science Dr

Orlando, FL 32826-3276

Stanley.m.slupski.civ@army.mil

(407) 384-3540

Contractor Security Point of Contact

TBD

XXX 7. All DD Forms 254 prepared for agreements/contracts involving access to SCI under this agreement/contract must be processed through ACCS to the CM and Industrial Security Specialist for approval and to the Contractor Support Element, USAINSCOM, ACofS Security, G2 for review and concurrence of the contract award.

XXX 8. Visit certification to DoD locations is not required, as need to know and accesses is verified at the visiting facility. Non DoD locations the contractor must process request for SCI visit certification(s) through ACCS to the CM for approval and to Contractor Support Element (CSE) for review and processing. Visit certification request must be submitted at least ten (10) working days prior to the visit.

XXX 9. Debriefings: All CSSO’s/FSO’s must properly debrief all contractors from SCI through ACCS. CSSO’s/FSO’s must submit the debrief request NLT 7 days and NET 10 days before actual departure. CSSO’s/FSO’s will separate all vendors/contractors from JCAVS after completion of debriefing.

XXX 10. The contractor will not reproduce any SCI related material without prior written permission of the CM. If permission is approved by the CM, the vendor/contractor will establish and maintain a log (written or electronic) listing all reproduced materials and the disposition of the reproduced items.

N/A 11. Security Classification Guides or extracts are attached or will be provided under separate cover by the CM.

XXX 12. The contractor will ensure that all Electronic processing of SCI equipment meets the equipment accreditation in accordance with ICD 503 and AR 25-2. (Note:

NATO security awareness briefing is required for access to JWICS indicated in blocks

10k or 11m of DD 254.).

N/A 13. This contract requires a contractor controlled SCIF.

N/A 14. This contract requires a SCIF Co-user Agreement (CUA). The contractor must provide a copy of the CUA to the CM and government Industrial Security Specialist per ICS 705-02!

XXX 15. Request for Indoctrination/Debrief Authority.

XXX 16. This agreement/contract requires (SI) (TK) (G) (HCS). The vendor/contractor will NOT create or issue any JWICS accounts for agreement/contract personnel without written permission from the AO/KO and Contract Monitors.

XXX 17. The contractor will perform SCI work under this contract at the following locations (SEE WORK LOCATION ADDENDUM)

N/A 18. The contractor identified in Block 6 is a Multiple Facility Organization (MFO) and is authorized to submit DD254 and SCI Addendum for the following SCI locations (Facility Name and CAGE Code).

N/A 19. This agreement/contract has a SCI Courier Requirement.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, "DoD Contract Security Classification Specification"

The following items apply to this contract.

GENERAL GUIDANCE:

1. The contractor and subcontractor(s) shall comply with the Security Agreement (DD Form 441) and following Security Regulations (DoDM 5200.01 Volumes 1 thru 3), 32 CFR part 117 NISPOM, DoDI 5200.48 Controlled Unclassified Information (CUI), DoDM 5105.21-Vol1-3, AR 25-2 Information Assurance, AR 380-5 Information Security, AR 380-49 Industrial Security, AR 380-10 current versions and affiliated regulations.

2. The contractor and subcontractor employees requiring access to DoD government or DoD contractor's facilities where proof of a security clearance is required, shall meet the security access requirements specified by the host and/or owner of those facilities.

3. Any prime contractors to include subcontractors that are USA Foreign Owned, Controlled and Influenced (FOCI) company who poses a valid FCL issued by the Defense Counterintelligence Security Agency (DCSA) under a Special Security Agreement (SSA) are not allowed to work on this contract

4. The contractor is not authorized to disclose or release TS/SCI or collateral Classified Military Information (CMI) information to the public.

a. The contractor is not authorized to disclose or release any program Classified Military Information (CMI) Controlled Unclassified Information (CUI) Technical Data, Information pertaining to this contract to any Foreign Nationals or Foreign Representatives.

5. The contractor shall only issue security clearances to those employees who meet the personal security requirements stated in the 32 CFR part 117.10 NISPOM and who require access to classified information based on a Need-to-Know.

a. For collateral security clearances and access, the contractor shall follow the Security guidelines established in 32 CFR part 117.10 NISPOM and the Defense Counterintelligence Security Agency (DCSA) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php

b. For TS/SCI security clearances and access, the contractor shall follow the Security guidelines listed in the SCI addendum to this contract.

c. Contractors who do not require a security clearance but require a Government Common Access Card (CAC) must have a Tier 1 security investigation and follow the credentialing requirements of this contract!

6. The contractor and subcontractors shall ensure that all Classified information, Controlled Unclassified Information (CUI), Controlled Technical Information (CTI) documents, data and or export controlled information; is marked, handled and safeguarded with the appropriate security classification, distribution statement(s) and export control warning statement in accordance with DoDD 5230.24, DoDI 5200.48, 32 CFR part 117.15 NISPOM Rule, and DoDM 5200.01 Vol 1, 2 and 3.

a. The contractor and subcontractors shall NOT ACCEPT any documents, data or information from any source including the government requiring activity unless the documents, data or information is marked based on paragraph 6!

7. The prime contractor is responsible for vetting/validating all subcontractors for eligibility, and suitability prior to issuing a subcontractor DD Form 254, 32 CFR part 117.17 NISPOM Rule and AR 380-49. The prime contractor shall issue the PEO STRI vendor vetting/validating process letter to all subcontractors to fill out and respond to.

a. The prime contractor is responsible for issuance of all subcontractor DD254 per 32 CFR Part 117.17 NISPOM. A copy of all subcontractor DD254’s must be provided to the government Industrial Security Specialist.

b. All contractors must be vetted/validated for suitability and eligibility to receive Government contract information and Controlled Unclassified Information prior to being allowed to join a consortium that does business with the Department of Defense or Department of the Army.

c. The prime contractor shall follow DCSA sponsorship procedures (if required) only to those not cleared Subcontractor companies for a FCL who require access to classified data/information for this contract. The government nor the prime contractor shall not incur any cost in this process.

d. The prime contractor FSO will provide the KO, COR and ISS with a copy of all subcontract DD Form 254s to be attached to the prime contract. The KO and/or COR will provide a copy of all subcontract DD Form 254’s to the ISS and DCSA.

8. Contractor shall comply with FAR 52.204-2 “Security Requirements”. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret”. The Contractor shall comply with (1) Security Agreement (DoD Form 441), including the 32 CFR part 117 NISPOM Rule.

9. This contract does not have any security classification guides (SCGs) for this effort. If, during this effort, it becomes necessary to create a security classification Reference (SCR) the contractor shall notify the contract officer representative who will seek the assistance and appropriate guidance from the local government ISSM, PM and Requiring Activity Cognizant Security Office.

10. Contractors who work in a DoD or Contractor cleared facility on DA installations and or government leased facilities and who are embedded or integrated within a DA program or activity, shall report all adverse information, suspicious contacts, and other reportable incidents to the local security office.

11. The contractor and their subcontractors shall immediately report any loss, compromise, suspected compromise/incidents of classified information or any security violations, or incidents involving a contractor employee, which occurs on this contract per 32 CFR part 117.8(d) NISPOM Rule to their Facility Security Manager (FSO) and local DCSA office. The contractor shall also inform the KO, COR, and the ISS.

12. The contractor shall not allow foreign nationals or foreign persons to visits, participate in demonstrations, or have access to this contract without first getting the requiring activities Foreign Disclosure Office (FDO) written approval, 5 days in advance of any visit/access request. The contractor shall adhere to 32 CFR, part 117 as it relates to foreign visits, meetings, and disclosure etc. SCI is NOT authorized to any foreign national’s disclosure or release!

13. The contractor and their subcontractors will designate in writing a U.S. citizen (not a dual citizen) as the Insider Threat program official 32 CFR part 117.12(g). All contractors with security clearances shall comply with Insider Threat Training requirements per 32 CFR part 117.12(g). Additionally, the contractor shall report threat-related incidents, behavioral indicators to the Requiring Activity Cognizant Security Office. Insider Threat training information can be found at the following DCSA site https://www.cdse.edu/

14. The contractor shall ensure that all contract employees with collateral and TS/SCI security clearances meet the prescribed security training required below and by 32 CFR part 117.12, paragraph 1-14 of AR 381-12, DoDM 5105.21-V1 paragraph 9m, DoDM 5105.21-V3 enclosure 6, DoDI 5200.48 and AR 380-5.

REQUIRED ANNUAL SECURITY TRAINING

The contractor shall read and execute the below listed annual security training requirements for only those employees who have security clearances and access to CUI on this contract;

Threat Awareness Reporting Program (TARP) All contractors and subcontractors with security clearances must receive annual Threat Awareness and Reporting Program (TARP) training per AR 381-12. The training should be provided by a CI agent or other trainer as specified in 2-4b and chapter 3 AR 381-12

The Contractor shall ensure its employees report threat-related incidents, behavioral indicators, and other matters of CI interest specified in the AR 381-12, to their FSO and the PEO STRI G2 Office, the nearest military CI office, the Federal Bureau of Investigation, or the Defense Security Service.

OPSEC Awareness Training.

Per AR 530-1 Operations Security, the contractor employees working on this contract must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their start date on this contract and annually thereafter. OPSEC Awareness training information and materials are available at https://securityawareness.usalearning.gov/opsec/index.htm

Insider Threat Training The contractor and their subcontractors will designate in writing a U.S. citizen as the Insider Threat program official per 32 CFR part 117.12(g) NISPOM Rule. All contractors shall comply with Insider Threat Training requirements per 32 CFR part 117.12(g) NISPOM Rule. Insider threat program information and materials are available at https://securityawareness.usalearning.gov/itawareness/index.htm

DoD Annual SCI Security Awareness Refresher Training All contractor employees working on this contract with a security clearance must complete the annual SCI security awareness refresher training. New employees must complete the initial security training and the security awareness refresher training annually thereafter. This training refreshes the employee’s basic understanding of initial security training requirements outlined in DoDM 5100.21 Volume 3 enclosure 6, and 32 CFR part 117.12 and other applicable policies and regulations. This training is available at https://SCI Security Refresher SCI100.16 (cdse.edu)

Controlled Unclassified Information Training This contract contains CUI, all contractors shall have only those employees who handle CUI take annual CDSE CUI Training required for all DoD and Industrial personnel with access to controlled unclassified information. New employees must complete this training 30 day from start day of the contract. No CAC or password needed the training website also provides a resource tab which lists regulations, policies and more information on the subject. https://securityawareness.usalearning.gov/cui/index.html

Unauthorized Disclosure of Classified Information for DoD and Industry Contractor employees working on this contract with security clearances must complete the annual Unauthorized Disclosure of Classified Information for DoD and Industry training. New employees must complete this training 30 day from start day of the contract. This training provides an overview of what unauthorized disclosure is, including specific types of unauthorized disclosure and some common misconceptions about unauthorized disclosure, the types of damage caused by unauthorized disclosure and the various sanctions one could face if caught engaging in unauthorized disclosure. This training is available at https://securityawareness.usalearning.gov/disclosure/index.html

The AT level 1 awareness training is required for those contractor employees going on military installations and or traveling Oconus in support of this contract.

AT Awareness Training for Contractor Personnel Traveling to Military Installations and Overseas.

The contractor FSOs and associated subcontractor FSOs will brief and make available government area of responsibility (AOR) specific AT awareness training and information to employees traveling to military installations and overseas as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact. AT level I awareness training meets this requirement and is available at the following website: https://atlevel1.dtic.mil/at/

DCSA provides the Facility Security Officer (FSO) Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php

ITEM 10:

Ref Item 10.e(1): INTELLIGENCE INFORMATION (SENSITIVE COMPARTMENTED INFORMATION) SCI - SCI Access required. No public release of information authorized, public disclosure or confirmation of any subject related to the support contract is not authorized without first obtaining written approval from the KO. No Foreign or USA FOCI vendor/contractors are allowed access.

Ref Item 10.e(2): INTELLIGENCE INFORMATION (NON-SCI) - Non-SCI Information is not releasable to vendor/contractor employees who have not received a clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting. No Foreign or USA FOCI contractors are allowed access to Intelligence information required for the performance of this agreement/contract.

Ref Item 10.g: NATO INFORMATION - Personnel not assigned to a NATO staff position, but requiring access to NATO classified information, NATO Secret or access to the NATO accredited SIPRNET terminals, must possess the equivalent FINAL or Interim U.S. Security Clearance based upon the appropriate personnel security investigation required. Personnel with access to NATO information must have the appropriate level FINAL U.S. Security Clearance. The government program/project manager is the designated representative that will ensure the contractor FSO and concerned employees are NATO briefed prior to access being granted. The contractor will maintain strict compliance in regard to NATO information IAW 32 CFR part 117. Prior approval from the KO and COR is required for subcontractors to have access.

Ref Item 10.j: CONTROLLED UNCLASSIFIED INFORMATION (CUI) - For Controlled Unclassified Information (CUI) provided under this contract shall be safeguarded and marked as specified in DoDI 5200.48. CUI information that is export controlled shall not be shared with any foreign nationals unless approved by the Requiring Activity security office along with the approved State Department license. (See the CUI attachment paragraph 8 Dissemination)

a. COMPILATION - The contractor shall be aware of certain information that would otherwise be unclassified or CUI when standing alone may require classification when combined or associated with other unclassified or CUI information. The determination that information requires classification by compilation will be based on specific guidance regarding compilation provided in a Security Classification Guide (SCG) or from the information/data owner. When classification is required to protect a compilation of such information, the overall classification assigned to the compilation shall be conspicuously affixed. The reason for classifying the compilation shall be stated at an appropriate location at or near the beginning of the compilation. Any unclassified or CUI portions will be portion marked (U) or (CUI), while the overall markings will reflect the classification of the compiled information.

Ref Item 10k: OTHER – Access to Secret Internet Protocol Network (SIPRNET) is required. Access will be limited to only those employees who have a SIPRnet requirement during this contract. A list of employees having a SIPRnet account shall be provided to government upon request! The contractor is not authorized to access, download or further disseminate any classified information from SIPRnet which is outside the scope of the defined contract requirements unless specifically authorized in writing by the Government Program Manager (PM), AOR, COR and G6 or network security authority. The contractor must complete and forward to the AOR, COR, a SIPRnet access request for approval by the Requiring Activity SIPRnet Information Assurance Manager (IAM) prior to receiving access.

Although the NATO brief is a requirement for SIPRNet it does NOT mean that the contractor has a requirement for access to NATO information. Access to NATO information is a specific requirement that will need additional justification from the government Project Manager (PM) and AOR, COR.

The contractors FSO shall administer a NATO awareness brief to only those contractors who require access to the SIPRNET. The contractor and FSO must sign and retain the NATO briefing/debriefing form for the life of the contract. The FSO is required to update individual contractors DISS account reflecting the indoctrination to NATO Secret.

IF SIPRNET/ JWICS IS REQUIRED

Ref Item 10k: OTHER - Secured Internet Protocol Network (SIPRNet) access is required for the performance of the contract. Requests for access will be through to the project COR to facilitate the local vetting and approval process. Contractor must follow appropriate processes for obtaining login credentials to SIPRNET. The contractor must be cleared at NATO SECRET level. If SIPRNet is required at contractor facility, contractor shall coordinate with appropriate DCSA representatives. The contractor requires access to the Defense Information Systems Network (DISN) Secret Internet Protocol Routing Network (SIPRNet) dated 01 June 2013, or most current.

Item 10k: OTHER - JWICS access is required for the execution of the contract. Requests for access will be submitted to project COR to facilitate the vetting and approval process. Contractor must follow appropriate processes for obtaining login credentials to JWICS. The contractor must be cleared at NATO SECRET level. The Contractor requires access to the JWICS SCG, Defense Intelligence Agency, dated 29 September 2017, or most current.

JWICS access and information is provided in the SCI addendum.

ITEM 11:

Ref Item 11.a: ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTORS FACILITY OR A GOVERNMENT ACTIVITY – Contractor performance is restricted to the names and addresses of contractor facilities or government activities which are provided on the Work Location addendum sheet attached. Government agency or activity will provide security classification guidance for performance of this contract. Submit visit request to the Facility Security Officer (FSO), Security Management Office via DISS for need-to-know verification and access.

Ref Item 11e: PERFORM SERVICES ONLY - This contract provides Program Management (PM), engineering support services, logistics, procurement of Commercial-Off-The-Shelf (COTS) Information Technology (IT) hardware and software, licensing, furniture, audiovisual and video teleconference equipment, installation services, and Electronic Security Systems (ESS) for training complexes worldwide. The contractor will work in contractor and/or DoD cleared facilities. Classification and CUI markings and distribution statements on any material to be furnished will be provided by the contract logistics personnel and site security guidance necessary for the performance of the contract.

Ref Item 11.f: ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S - This contract may require your company to have access to classified information in an overseas area. The specific overseas area(s) will be provided by the Contract Monitor or the Contracting Officer. Classified information or materials will remain under the direct control of the US government while in an overseas area unless prior approval is granted by this command. Release of classified information to a foreign entity will be accomplished in accordance with 32 CFR part 117.19 NISPOM Rule and AR 380-10.

Ref Item 11.j: OPERATIONS SECURITY (OPSEC) REQUIREMENTS - The contractor shall develop, implement, and maintain a facility level OPSEC program to protect classified and/or sensitive unclassified information used at the contractor, government and other contractor facilities during the performance of this contract. The OPSEC requirements may be included in the contractor’s Standard Practice Procedures (SPP).

Ref Item 11.l: RECEIVE, STORE OR GENERATE CONTROLLED UNCLASSIFIED INFORMATION (CUI) – For Controlled Unclassified Information (CUI) provided under this contract shall be safeguarded and marked as specified in DoDI 5200.48. CUI information that is export controlled shall not be shared with any foreign nationals unless approved by the Requiring Activity security office along with the approved State Department license. (See the CUI attachment paragraph 8 Dissemination)

a. COMPILATION - The contractor shall be aware of certain information that would otherwise be unclassified or CUI when standing alone may require classification when combined or associated with other unclassified or CUI information. The determination that information requires classification by compilation will be based on specific guidance regarding compilation provided in a Security Classification Guide (SCG) or from the information/data owner. When classification is required to protect a compilation of such information, the overall classification assigned to the compilation shall be conspicuously affixed. The reason for classifying the compilation shall be stated at an appropriate location at or near the beginning of the compilation. Any unclassified or CUI portions will be portion marked (U) or (CUI), while the overall markings will reflect the classification of the compiled information.

Ref Item 11.M: Dual Citizens Contractor employees who are dual citizens shall not have access to SCI! Any employee with passports from other countries must travel on only a US passport only while working on this contract.

“CONTROLLED UNCLASSIFIED INFORMATION (CUI) ” SECTION

1. GENERAL:

The contractor shall adhere to DoDI 5200.48 CUI and Army Controlled Unclassified Information (CUI) guidance as it relates to controlling, marking, safeguarding, storage and disposal of CUI materials on this contract /agreement.

2. IDENTIFYING CUI.

a. The official CUI Registry approved by the CUI Executive Agent identifies all approved CUI categories; provides general descriptions for each; identifies the basis for controls; establishes markings, and includes guidance on handling procedures. The Contractor shall refer to the CUI Registry’s category listing found at https://www.archives.gov/cui/registry/category-list to determine if information can be designated as CUI. The contractor shall also coordinate with the COR/AOR for support and advice.

b. The authorized holder (originator/owner of the information; the original classification authority or other official (government or contractor) that controls the information) is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. If so, the authorized holder is responsible for applying CUI markings and dissemination instructions accordingly.

c. Only categories listed in the CUI Registry (includes DoD related categories) can be used to identify if the information meets CUI designation.

3. LEGACY MATERIAL.

a. Policy for legacy CUI created and marked under Department of Defense Manual (DoDM) 5200.01, Volume 4 is cancelled. For information on Army legacy material: (Ref: DoDI 5200.48, para 3.2)

(1) Will not be required to be re-marked or redacted while it remains under control or is accessed on line and downloaded for use on the contract. However, when legacy CUI is incorporated into, or cited in, another document or material, it must be reviewed for CUI and marked in accordance with DoDI 5200.48.

(2) Marked and stored on an access-controlled website or database does not need to be remarked as CUI, even if other agencies and contractors are granted access to the websites or databases.

(3) Does not automatically become CUI. It must be reviewed by the owner of the information to determine if it meets or falls under one of the new CUI categories. If it meets the new CUI requirements, it will be marked in accordance with DoDI 5200.48.

b. The original classification authorities (OCAs) are required to review all SCGs under their authority to determine if the information (previously marked as “For Official Use Only” or “FOUO” or other legacy markings) meets the CUI designation. The SCGs must be reissued to ensure clear protection guidance is provided. (Ref: DoDI 5200.48, para 3-7e and 3.8)

4. Marking. The contractor shall ensure that all documents containing CUI carry the CUI markings in accordance with DoDI 5200.48. Discontinue all use of legacy or other markings is not permitted or included in either the CUI Registry or DoDI 5200.48. Refer to the OUSD(I&S)/DDI(CL&S) Information Security CUI Marking Guidance dated April 2020.

5. Safeguarding and Storage. The contractor shall protect CUI from unauthorized disclosure or access by unauthorized personnel, by ensuring these measures are implemented: (Ref: DoDI 5200.48, para 4.1e)

a. During working hours. Contractor employees working with CUI will be careful not to expose CUI to unauthorized users or others who do not have a lawful government purpose to see the information. Cover sheets (Stand Form 901) can be placed on top of documents to conceal the contents from casual viewing.

b. The contractor shall keep CUI under control at all times or protect it with at least one physical barrier and reasonably ensure that the information is protected from unauthorized access and observation.

c. CUI will not be stored in personal residence, hotel room safes, and automobiles or viewed while on public transportation if allowed to transfer hard-copy (document form) CUI material outside the organization.

6. Transmission Requirements.

a. CUI information may be transmitted electronically (e.g., data, website, or e-mail), via approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure or transport layer security (e.g., https). Avoid wireless telephone transmission of CUI when other options are available. (Ref: DoDI 5200.48, para 4.1e).

b. CUI transmission via facsimile machine is permitted; however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive CUI; facsimile machine located in a controlled government environment) or an authorized DoD contractor facility.

c. CUI information and material may be transmitted via first class mail, parcel post, FEDEX or, bulk shipments. Do not place CUI markings on the outer envelopes or packaging. Refer to the OUSD(I&S)/DDI(CL&S) Information Security CUI Marking Guidance dated April 2020.

d. The contractor shall not use unofficial or personal (e.g., .net; .com) e-mail accounts, messaging systems, or other non-DoD information systems, except approved or authorized government contractor systems, to conduct official business involving CUI.

7. CUI within Information Systems. (Ref: DoDI 5200.48, para 3-3, 3-10)

a. DoD information systems (IS) processing, storing, or transmitting CUI will be categorized at the moderate impact level, and follow the guidance in DoDI 8500.01 and 8510.01.

b. Non-DoD information systems processing, storing, or transmitting CUI will provide adequate security, and the appropriate requirements must be incorporated into all contracts, grants, and other legal agreements with non-DoD entities in accordance with DoDI 8582.01. The NIST-SP 800-171 identifies the baseline system requirements for processing CUI for industry.

c. For systems, networks, and programs operating on the various domains, a splash screen warning and notice of consent must be employed to alert users of the presence of CUI.

d. When made available by the DoD Chief Information Officer and OUSD(I&S), Army organizations will modify or install classification marking tools on unclassified, Secret and Top Secret network systems to account for CUI information and readily permit inclusion of CUI markings and designator indicators.

8. Dissemination. (Ref DoDI 5200.48, para 4-2)

a. The contractor shall follow CUI access to the extent the access or dissemination: complies with the Law, Regulation, and Government-wide policy (LRGWP) identifying the information as CUI; furthers a lawful government purpose; is not restricted by an authorized Limited Dissemination Controls (LDC); or is not prohibited by any LRGWP.

b. Authorized holders may place limits on disseminating CUI for a lawful government purpose using the approved LDCs and associated marking or methods authorized by a specific LRGWP.

c. The originator may use the LDCs to limit access to those on an accompanying dissemination list, as shown in Table 2 of DoDI 5200.48. LDCs or distribution statements cannot unnecessarily restrict CUI access.

d. When handling other Executive Branch CUI (non-DoD or Army), DA personnel will follow their regulatory guidance for when the application of dissemination controls and its markings are allowed, and by whom, while ensuring the policy is in accordance with Part 2002 of Title 32, CFR.

e. Government CUI designated information may be disseminated to a foreign or FOCI recipient in order to conduct official business for the Army provided;

(1) CUI is not controlled or marked as NOFORN.

(2) Access to such government contract data/information is within the scope of the foreign or FOCI State Department licenses and export control regulations.

(3) There are no contract restrictions prohibiting access to such data/information.

(4) Access to such data/information would help accomplish the contract and would not be detrimental to the interests of the DoD or the U.S. government.

(5) Access to such data/information is in accordance with this DD254.

9. Legacy Distribution Statements.

a. Legacy CUI technical documents and materials requiring export control have used distribution statements in accordance with DoDI 5230.24 in order to address the shared responsibility between the DoD and its contractors to safeguard this information. This was done for legacy CUI creation, transmission, receipt, storage, distribution, decontrol, and approved disposition authorities, including destruction. (Ref: DoDI 5200.48, para 4.3a)

b. CUI export controlled technical information or other scientific, technical, and engineering information will continue to use distribution statements and must be marked with an export control warning in accordance with DoDI 5230.24, DoDD 5230.25, and Part 250 of Title 32, CFR (Withholding of Unclassified Technical Data from Public Disclosure). However, where other markings are authorized and used in accordance with associated LRGWP (e.g., North Atlantic Treaty Organization markings, REL TO), those markings may be used to further inform distribution decisions. (Ref: DoDI 5200.48, para 4.3b)

c. “REL TO” is authorized for use with foreign nationals once the information distribution is properly coordinated with the requiring activity foreign disclosure office.

10. Destruction. (Ref: DoDI 5200.48, para 4.5)

a. The contractor shall take all CUI documents (Record and Non-record copies) and materials and formally review them in accordance with Chapter 33 of Title 44, United States Code (and AR 25-400-2 before approved disposition authorities are applied, including destruction. Media containing CUI must include decontrolling indicators. (Ref: DoDI 5200.48, para 4.5)

b. The contractor shall ensure that CUI will be destroyed in a manner that makes it unreadable, indecipherable, and irrecoverable. The CUI will be destroyed according to any specific directives regarding the information.