Att 1_Vendor Vetting Process.pdf

Distribution A – Authorized for Public Release

v. 20201216

PEO STRI

Vendor/Contractor Vetting Process for

Release of Government Collateral Classified Military

Information (CMI) and or Controlled Unclassified Information

(CUI) and or Export Controlled Information

Agreements/contracts with PEO STRI may require a selected group of vendor/contractors to receive, produce and protect a wide variety of Classified or

Unclassified sensitive documentation. The different documentation associated with a particular agreement/contract may include material identified as Classified Military

Information (CMI) marked as Secret, Top Secret/Sensitive Compartment Information

(SCI) and or Controlled Unclassified Information (CUI) and or Export Controlled

Information.

In accordance with the 32 CFR part 117 NISPOM Rules, Department of Defense (DoD) and Army Regulations (AR), all potential Government vendors/contractors must be vetted for eligibility, suitability and FOCI status in order to receive, produce and protect the documentation associated with a particular agreement/contract.

Purpose. The purpose of this document is to provide a summary of the different vetting processes that will be used to evaluate each vendor/contractor depending upon the category of documentation associated with the underlying effort. The following information is required from each potential vendor/contractor.

CUI CATEGORY ONLY

STEP 1: Controlled Unclassified Information (CUI) and or Export Controlled

Information

If an agreement/contract is anticipated to require a vendor/contractor to have access to Controlled Unclassified Information (CUI) and or Export Control information, at a minimum, the following will be required:

A. All vendors/contractors must be registered in the System for Award Management

(SAM).

B. All vendors/contractors (Primes and Subcontractors) must have a reputation for integrity and lawful conduct in its business dealings. The vendor/contractor and its Key Management Personnel (KMP) must not be barred from participation in Government contracts. Information related to previous contracts or government work may also be required.

C. All Vendors/contractors requiring access to technical data packages that include information identified as “CUI” and or Export Control information must make the following certifications in writing:

1) Vendor/contractor and/or subcontractor(s) (are or are not) Foreign Owned or USA Foreign Owned, Controlled or Influenced (USA FOCI) status.

2) Vendor/contractor (is or is not) in the process of a merger or other type of transition/ownership discussions with a Foreign Owned company or USA FOCI company.

The certification from each vendor/contractor should be provided on company letterhead and include the following:

a) Full company name;

b) Cage code; and

c) Country of Origin.

If a vendor/contractor is of US FOCI status they must provide the following;

1) Registering with the U.S. State Department and providing a copy of the registration along with the appropriate Department of State Permanent Export License (DSP) or Technical Assistance Agreement (TAA) documents to the Agreements/Contracts Officer. Visit or contact the U.S. State Department at http://www.pmddtc.state.gov/ for more information on satisfying this requirement.

Although timelines will vary, this process takes 45-75 days to complete.

2) Canadian vendors/contractors must provide to the Agreement/Contracts

Officer, a copy of their DD 2345 Military Critical Technical Data Agreement form signed by the United States/Canada Joint Certification Office in order to receive unclassified TDPs.

D. The government customer has the right to state if Foreign or US FOCI contractors shall not be allowed to participate on an agreement/contract.

Failure or inability to satisfy the requirements of Step 1 will make a vendor/contractor ineligible to receive Controlled Unclassified Information and or Export Control data / information.

COLLATERAL CMI CATEGORY

STEP 2: Collateral Classified Information

Agreements/contracts may include both CUI and collateral CMI. If so, both steps 1 and 2 must be followed.

If an agreement/contract is anticipated to require a vendor/contractor to have access to Secret Classified Military Information (CMI), at a minimum, the following will be required:

A. All Vendors/contractors must satisfy the requirements as described in Step 1 above.

B. All Vendors/contractors (Primes and Subcontractors) must be listed in the Defense Counterintelligence Security Agency (DCSA) National Industrial Security System (NISS) database which must reflect:

1. Valid Facility Clearance (FCL), storage may also be required (see security requirements for this effort).

2. If Foreign or USA FOCI Vendor /contractor; a valid FCL with a Special Security Agreement (SSA) approved by DCSA.

C. If a Vendor/contractor does not have an FCL, the Vendor/contractor would need to meet the FCL application process:

1. A government awarded Agreement/Contract and sponsorship by the Requiring Activity (RA);

2. Coordination with the RA and the local DCSA field office to begin the clearance process. For more information, visit: https://www.dcsa.mil/mc/ctp/fc/

3. Foreign or USA FOCI vendors will also be required to coordinate with DCSA to mitigate any FOCI security concerns. For more information on this, visit:

https://www.dcsa.mil/mc/ctp/foci/ https://www.dcsa/ https://www.dcsa.mil/mc/ctp/foci/

Although timelines will vary, the process for obtaining an FCL can take 45-70 days for Non-FOCI vendor/contractors and 17-24 months for a FOCI vendor/contractor to complete. The vendor cannot charge the Government or RA for costs related to vendor/contractor vetting, sponsorship or Foreign or USA FOCI mitigation by DCSA.

Failure or inability to satisfy the requirements of Steps 1 and 2 will make a vendor/contractor ineligible to receive CUI, CMI, and or Export Control data / information.

STEP 3: Sensitive Compartmented Information

If an agreement/contract is anticipated to require a vendor/contractor to have access to TS/SCI Classified Military Information, at a minimum, the following will be required:

A. All Vendors/contractors must satisfy the requirements as described in Step 1 and 2 above.

B. All Vendors/contractors (Primes and Subcontractors) must be listed in the Defense Counterintelligence Security Agency (DCSA) National Industrial Security System (NISS) database which must reflect:

1. Valid Facility Clearance (FCL), storage may also be required (see security requirements for this effort).

2. If Foreign or USA FOCI Vendor /contractor; a completed FCL with a Special Security Agreement (SSA) and National Intelligence Determination (NID) approved by DCSA and NSA.

C. PEO STRI will NOT sponsor a Foreign Vendor/contractor for a TS/SCI FCL.

Failure or inability to satisfy the requirements of Steps 1, 2 and 3 will make a vendor/contractor ineligible to receive CUI, CMI, and or Export Control data / information.

Point of Contact: For questions about the vetting process as it relates to issues associated with PEO STRI, those questions should be directed to PEO STRI Security

Directorate, Industrial Security Specialist at (407) 384-3540 or 321-230-8264 or tam.v.nguyen13.civ@army.mil mailto:tam.v.nguyen13.civ@army.mil