Combined_DD254_docs_.pdf

UNCLASSIFIED//FOR OFFICIAL USE ONLY

Contract Number: _____________________________

Analytic and Engineering Mission Support Services

UNCLASSIFIED//FOR OFFICIAL USE ONLY

ATTACHMENT 1

(U) SECURITY GUIDANCE (ITEM 13) CONTINUATION:

(U)REFERENCE ITEM 10E (1): INTELLIGENCE INFORMATION: (1) SENSITIVE

COMPARTMENTED INFORMATION (SCI)

Ref 10e1: SCI Access required. No public release of information authorized, public disclosure or confirmation of any subject related to the support contract is not authorized without first obtaining written approval from the CM.

a. (U//FOUO) The TRAC Senior Intelligence Officer has exclusive security responsibility for SCI classified material released or developed under this contract and held within the government activity SCIF. Contractors are not authorized to remove SCI material from any government activity.

b. (U//FOUO) This contract requires access to Sensitive Compartmented Information

(SCI). Requirements for the SCI portion of this contract are contained in the enclosed SCI Addendum to DD Form 254.

c. (U) Contractor will adhere to the TRAC SCG and any applicable study/ program/ system SCG. Contractor is provided the TRAC SCG and will be provided any additional applicable SCGs as required.

REFERENCE ITEM 10E (2): (U//FOUO) ACCESS TO INTELLIGENCE INFORMATION

(NON-SCI)

Ref 10e2: (U) Non-SCI information is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. Written concurrence from TRAC-WSMR’s Industrial Security Specialist, the Contracting Officer’s

Representative (COR), and the Contracting Officer (KO) is required prior to subcontracting Non-SCI.

Additional Notes (10e2):

a. (U) Written concurrence from the TRAC Industrial Security Specialist; the COR, and the KO is required prior to subcontracting Non-SCI.

b. (U//FOUO) Non-SCI information is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level.

c. (U) Contractor will adhere to the TRAC SCG and any applicable study/program/system SCG. Contractor is provided the TRAC SCG and will be provided any additional applicable SCGs as required.

Contract Number: W9115119D0003

Analytic and Engineering Mission Support Services

d. (U//FOUO) The following are guidelines concerning control and dissemination of classified information:

1) (U//FOUO) Information released under this contract or Request for Proposal

(RFP) remains the property of the U.S. Government and may be withdrawn upon notice.

2) (U//FOUO) Unclassified intelligence information will be treated as For Official Use

Only (FOUO).

3) (U//FOUO) The contractor will maintain a record of all classified material released to their custody. All reproductions of classified material will be classified, marked, and controlled in the same manner as original(s).

4) (U//FOUO) Prior to granting an employee access to classified materials, employees will be briefed on their obligation to comply with these procedures and will be debriefed when access to the material is terminated. A permanent list of all employees having had access to the classified materials during this contract will be maintained in the government facility.

5) (U//FOUO) The contractor will not release classified material to any activity, employee, or other person not directly engaged in providing services under this contract unless specific written authorization for such release is received from the

Government Contracting Activity (GCA). This prohibition precludes release without authority to another contractor, Government agency, private individual, or organization unless a contractual relationship exists in support of this contract.

Specific written authorization for such release will be received from THE

RESEARCH & ANALYSIS CENTER-WSMR, 1400 MARTIN LUTHER KING JR

AVE, WHITE SANDS MISSILE RANGE, NM 88002.

6) (U//FOUO) The classified materials will not be released to foreign nations, non-

U.S. citizens or U.S. citizens representing foreign entities except with specific written authorization from the GCA and TRAC Foreign Disclosure Officer (FDO).

7) (U//FOUO) Classified materials released to the contractor will be destroyed upon contract completion unless the GCA requests the return of the materials. A copy of the destruction certificate referencing TRAC control number will be mailed to

TRAC, in order to remove contractor accountability from TRAC records.

However, returned classified information will be sent to the attention of the

Contracting Officer’s Representative (COR), address identified in the contract. In the event the contract is extended or a new similar contract requiring the released data is initiated, it is the responsibility of the COR to affect an extension or document transfer with the GCA.

8) (U//FOUO) All actions or inquiries concerning classified materials on this contract shall identify any TRAC control numbers, if applicable, and shall be sent to the following address: THE RESEARCH & ANALYSIS CENTER-WSMR, 1400

MARTIN LUTHER KING JR AVE, WHITE SANDS MISSILE RANGE, NM

88002.

REFERENCE ITEM 10G: (U) ACCESS TO NATO INFORMATION.

Ref 10g: (U) Personnel not assigned to a NATO staff position, but requiring access to

NATO classified information, NATO COSMIC, NATO Secret or access to the NATO accredited SIPRNET terminals, must possess the equivalent FINAL or Interim U.S.

Security Clearance based upon the appropriate personnel security investigation required. A designated representative from the TRAC-WSMR Security Office will ensure required employees are NATO briefed prior to access being granted. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM, Chapter 10, Section 7. Written concurrence from TRAC-WSMR FDO, the Contracting Officer’s

Representative (COR), and the Contracting Officer (KO) is required prior to subcontracting NATO.

Additional Notes (10g):

a. (U) Written concurrence from TRAC FDO; the COR, and the KO is required prior to subcontracting NATO.

b. (U//FOUO) NATO material accessed on SIPRNET terminals will not be printed, copied or removed (oral, visual, or documentary) from the SIPRNET terminal in anyway.

b. (U) NATO information will not be transferred (oral, visual, or documentary) to a third party without the written approval of the TRAC-WMSR Foreign Disclosure Officer

(FDO), the Contracting Officer’s Representative (COR), and the Contracting Officer

(KO).

REFERENCE ITEM 10H: (U) FOREIGN GOVERNMENT INFORMATION.

Ref 10h: (U) Foreign Government Information (FGI) is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level.

Written concurrence from TRAC-WMSR FDO, the Contracting Officer’s Representative

(COR), and the Contracting Officer (KO) is required prior to subcontracting Foreign

Government Information.

Additional Notes (10h):

a. (U) Written concurrence from TRAC FDO; the COR, and the KO is required prior to subcontracting Foreign Government Information.

b. (U) Foreign government information is described as information provided to the U.S.

by a foreign government or information produced by the U.S. as a result of a joint arrangement with a foreign government requiring that the information or arrangement be held in confidence.

c. (U) Procedures for access to foreign government information in Chapter 10, Section

3, of the NISPOM apply.

d. (U) Classified foreign government information will be afforded the same degree of protection as U.S. classified. Procedures in Chapter 10 of the NISPOM apply.

e. (U) Foreign government information will not be transferred (oral, visual, or documentary) to a third party without the written approval of the TRAC Contracting

Office (CO) and TRAC Foreign Disclosure Officer (FDO).

f. (U) Receipt of foreign government information does not authorize the contractor to enter into discussions or release any data/information to foreign nationals or foreign representatives without an approved export license.

REFERENCE ITEM 10J: (U) FOR OFFICIAL USE ONLY (FOUO)/CONTROLLED

UNCLASSIFIED INFORMATION (CUI).

Ref 10j: (U) For Official Use Only (FOUO)/Controlled Unclassified Information (CUI) generated and/or provided under this contract shall be safeguarded and marked as specified in DOD

5200.1-R.

Additional Notes (10j):

a. (U) For Official Use Only Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoD 5200.1-R, Appendix 3 (see enclosed DD Form 254 CUI/FOUO Addendum).

b. (U//FOUO) For Official Use Only Information released under this contract or Request for Proposal (RFP) remains the property of the U.S. Government and may be withdrawn upon notice.

REFERENCE ITEM 10K: (U) OTHER.

Ref 10k: Secret Internet Protocol Network (SIPRNET) access required. The contractor shall not access, download or further disseminate any special access data (i.e.

intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the CM. In the event that any special access is required, the CM must modify the requirements for the DD

Form 254.

Ref 10k: Joint Worldwide Intelligence Communications Systems (JWICS) access required. The contractor shall not access, download or further disseminate any special access data (i.e. intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the

CM. In the event that any special access is required, the CM must modify the requirements for the DD Form 254.

Additional Notes (10k):

a. (U//FOUO) Classified Automated Information Systems (AIS) Processing (Collateral).

1. (U//FOUO) Classified AIS processing at the SECRET-level and below (collateral level) required at contractor locations identified in DD Form 254, Block 6.a.

Classified processing will be in accordance with Chapter 8, NISPOM.

2. (U) See enclosed SCI Addendum regarding SCI processing.

b. (U) Secret Internet Protocol Network (SIPRNET) Access.

1. (U//FOUO) Contractor access to SIPRNET is restricted to sites directly related to meeting the requirements of this contract as validated by the COR and/or

Performance Work Statement (or equivalent).

2. (U//FOUO) SIPRNET access via government accounts may not be subcontracted without prior written authorization from the TRAC Industrial

Security Specialist, the COR, and the KO.

3. (U//FOUO) Individuals having access to SIPRNET require NATO access and a

NATO Awareness Briefing and Derivative Classification Training.

c. (U//FOUO) Additional SCI networks access.

1. (U//FOUO) Contractor access to SCI networks is restricted to sites directly related to meeting the requirements of this contract as validated by the COR and/or Performance Work Statement (or equivalent).

2. (U//FOUO) SCI network access via government accounts may not be subcontracted without prior written authorization from the TRAC Industrial

Security Specialist, the COR, and the KO.

3. (U) The contractor shall not access, download or further disseminate any special access data (i.e. intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the CM. In the event that any special access is required, the CM must modify the requirements for the DD Form 254.

d. (U) See Reference Item 14, for the applicable security classification guide(s).

REFERENCE ITEM 11A: (U) HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY.

Ref 11a: Contractor performance is restricted. Government agency or activity will provide security classification guidance (Reference Item 14) for performance of this contract. Visit request to the CM and/or Security Management Office for need-to-know verification is done through JCAVS IAW Oct 2005 memo.

Additional Notes (11a):

a. (U) The Facility Security Officer will submit a Visit Authorization Request (VAR) in

JPAS or DISS to the TRAC-WSMR Security Office (SMO Code W4AE045) for

SECRET need-to-know verification and the TRAC SSO (SMO Code W4AEAA3) for

SCI need-to-know verification.

b. (U) All Contractor access to classified information shall be limited to that which is necessary to support this work effort. Contractor performance is restricted to

TRAC-WSMR buildings 1400 and 1401 located at White Sands Missile Range, NM: TRAC-WSMR (Fwd), Fort Bliss TX, JMC headquarters Building 2 or other government CONUS locations as mission dictates.

c. (U) Contractor personnel are authorized access to classified documents or materials, for use and reference, at government facilities only, to include government facilities visited while in temporary duty (TDY) travel status in support of this contract.

d. (U//FOUO) Contractor will be provided work space and access to SCI/Non-SCI material within the above government activities. Contractor is not authorized to remove/ transport classified information from any government activity nor shall the contractor use, reproduce, generate, or store any classified materials or information relating to this contract at sites other than the above specified government work locations.

e. (U) The contractor will comply with the provisions of DOD 5220.22-M, AR 380-5, and all applicable regulations and local policies and procedures governing the control, protection, and safeguarding of classified and sensitive (CUI/FOUO) material.

f. (U) The contract requires access to classified source data up to and including TOP

SECRET/SCI in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, paragraph 4-208a, and the use of a bibliography.

g. (U) See Reference Item 14, for the applicable security classification guide(s).

h. (U) Training Requirements.

1. (U) Contractors located on-site at TRAC, or working at a facility under TRAC cognizance, shall comply with the TRAC Security Program to include all applicable security regulations, policies, & procedures. Also, the on-site contractors shall attend all applicable TRAC mandatory security training and briefings, as required.

2. (U) Information Security Program Training. All contractor employees, including subcontractors, assigned to this contract shall complete the online information

Security Program Training located on the Army Learning Management System

(ALMS) site. Log into AKO, "Self Service", "My Training", "ALMS", "Go to

Mandatory Training". Training must be complete within 20 days of reporting for duty and annually thereafter. The contractor shall submit certificate of completion for each affected contractor employee and subcontractor employee to the COR and unit/activity security manager. (Ref ALA RA CT 207/20 13, DTG 2918482

Aug 13, Subj: Army Wide Roll-out and Requirement for Standardized Computer

Web-based Security Training on the Army Learning Management System

(ALMS)).

3. (U) Derivative Classification Training. All contractor employees working on classified networks complete Derivative Classification Course IF103.16 on the

DSS CDSE site https://stepp.dss.mil/SelfRegistration/Login.aspx within 20 days of reporting for duty and annually thereafter. Certificates of successful completion, for both initial awareness training and bi-annual refresher training, shall be provided to the COR. All contractor employees will successfully complete all required training as specified in AR 380-5 and as directed by the

Government.

4. (U) Anti-Terrorism (AT) Level I Training. All contractor employees, including subcontractors, assigned to this contractor shall receive an initial anti-terrorism level I brief within 20 days of reporting for duty. Annual refresher anti-terrorism level I training shall be completed on-line at https://jkodirect.jten.mil/ or they may attend the monthly training offered by the Garrison ATO. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR and unit/activity security manager. (Ref

Department of the Army, US Contracting Agency, SFCA-CO, 5 Sep 07, Subject:

Incorporation of Measures into the Contracting Process and AR 252-1 3, Anti-

Terrorism). Note: Contractor personnel shall receive an AOR briefing when traveling OCON US on TDY. Briefing must be provided within 7 working days prior to TDY departure outside the 50 United States, its territories, and possessions. This is separate from the normal annual ant-terrorism level I training requirement (Ref AR 525-13).

5. (U) iWatch: All contractor employees, including subcontractors, assigned to this contractor shall receive a brief on the local iWatch program (provided in https://stepp.dss.mil/SelfRegistration/Login.aspx conjunction with the AT Level I Training). This training will be used to inform employees of the type of behavior to watch for and instruct employees to report suspicious activity to the Security Office or COR. This training shall be completed with 20 days of reporting and annual refresher training with the results reported to the COR.

6. (U) Operations Security (OPSEC) Training: All contractors, including subcontractors, assigned to this contract shall complete Level I OPSEC Training within 20 days of reporting for duty and then annual refresher thereafter. Initial

Level I OPSEC Training will be provided during inprocessing. Annual refresher

OPSEC training shall be completed online at www.lms.army.mil/. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR and unit/activity security manager. (Ref AR

530-1, Operations Security).

7. (U) Threat Awareness and Reporting Program (TARP) Training: All contractors, including subcontractors, assigned to this contract shall complete TARP training within 30 days of reporting for duty and then annually thereafter. TARP training will be conducted by the 902nd MI Group. The COR will ensure contractors are notified of available training. Completion of training shall be reported to the COR and the unit/activity security manager. Contractor personnel shall report threat-related incidents, behavioral indicators, and other matters to counterintelligence interest specified in AR 38 1-12 to the nearest military CI office. (Ref AR 38 1-

12).

8. (U) Threat Awareness and Reporting Program (TARP). In accordance with Army

Regulation 381-12, Threat Awareness and Reporting Program (TARP), persons employed by Army contractors will report threat-related incidents, behavioral indicators, and other matters of CI interest specified in chapter 3, to the TRAC

Security Officer, the nearest Military CI Office, the Federal Bureau of

Investigation, or the Defense Security Service. Contractor employees working as an integral part of an Army organization are required to complete TARP training within 30 days of reporting for duty and then annually thereafter. Contractor

FSOs will ensure that all applicable AR 381-12 requirements are implemented for personnel who work at contractor facilities. The prime contractor will include this requirement in all subcontracts awarded in support of this procurement effort.

9. (U) Information Assurance (IA)/Information Technology (IT) Training: All contractor employees and associated subcontractor employees must complete the DoD Cyber Awareness Challenge Training

(https://ia.signal.army.mil/DoDIAA) before issuance of network access and annually thereafter. Certificates of successful completion, for both initial http://www.lms.army.mil/ awareness training and annual refresher training, shall be provided to the COR.

All contractor employees will successfully complete all required IA training as specified in AR 25-2 and as directed by the Government.

(U) REFERENCE ITEM 11F; ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES.

a. (U) OCONUS travel in accordance with the Performance Work Statement (PWS), applicable task orders (TOs), and at the stipulation of the TRAC, the COR, and the

KO.

b. (U//FOUO) Classified information or materials will remain under the direct control of the U.S. government while in an overseas area unless prior approval is granted by the TRAC Foreign Disclosure Officer, the COR, and the KO. Release of classified information to a foreign entity will be accomplished in accordance with Chapter 10, NISPOM.

REFERENCE ITEM 11G: (U) AUTHORIZED TO USE THE SERVICES OF THE DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION

CENTER.

a. (U) Contractor access to DTIC information is restricted to contractual subject matter and SOW performance requirements. The GCA will verify contractor Need-To-Know via submission of DD Forms 1540 and 1541 to DTIC.

REFERENCE ITEM 11J: (U) HAVE OPSEC REQUIREMENTS.

a. (U) This contract requires the application of Operations Security (OPSEC).

Contractors will follow the TRADOC and TRAC Operations Security (OPSEC) Plans.

These plans will be provided under separate cover.

b. (U) Contractor shall comply with the Operations Security (OPSEC) requirements

IAW AR 530-1 and approved supplemental OPSEC guidance or any OPSEC Plan, SOP, Regulation or supplemental guidance which supersedes the above mentioned documents. These requirements include, but are not limited to, annual OPSEC

Awareness training, OPSEC review and approval of government information prior to its public release.

(U) REFERENCE ITEM 11L; OTHER. RECEIVE STORE OR GENERATE CONTROLLED

UNCLASSIFIED INFORMATION (CUI)

Ref 11l: Secret Internet Protocol Network (SIPRNET) access required. The contractor shall not access, download or further disseminate any special access data (i.e.

intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the CM. In the event that any special access is required, the CM must modify the requirements for the DD

Form 254.

Ref 11l: Joint Worldwide Intelligence Communications Systems (JWICS) access required. The contractor shall not access, download or further disseminate any special access data (i.e. intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the

CM. In the event that any special access is required, the CM must modify the requirements for the DD Form 254.

Additional Notes (11l):

a. (U) The contract requires access to Controlled Unclassified Information in support of the work effort.

b. (U) Department of Defense (DoD) Components, to include their contractors, shall adhere to DoD Manual 5200.01, Volume 4, DoD Information Security Program:

Controlled Unclassified Information.

c. (U) See Reference Item 14, for the applicable security classification guide(s).The

TRAC SCG includes guidance for CUI.

(U) REFERENCE ITEM 11M; OTHER.

(U) All questions regarding security requirements indicated herein will be referred to the

TRAC Industrial Security Specialist, the COR, and the KO.

REFERENCE ITEM 12: (U) PUBLIC RELEASE

Ref 12: (U) PUBLIC RELEASE OF SCI IS NOT AUTHORIZED

Additional Notes (12):

(U) No public release of information is authorized without first obtaining written approval from TRAC-WSMR’s Public Affairs Officer and OPSEC Officer IAW AR 360-1 and AR

530-1.

REFERENCE ITEM 14: (U) ADDITIONAL SECURITY REQUIREMENTS

Ref 14: See SCI addendum.

Additional Notes (14):

(U) Applicable Security Classification Guides (SCGs). The below listed security classification guides (SCG) apply to this specification. Contact the TRAC-WSMR COR

(as identified in Item 13) for copies of the below identified SCG(s). In the event that a security classification guide is superseded or replaced, it is the responsibility of the COR to provide such guides to the contractor.

1. (U) U.S. Army, Training and Doctrine Command (TRADOC) Analysis Center (TRAC)

Security Classification Guide (SCG), dated 30 September 2016.

2. (U) Additional security classification guides shall be provided by the Contracting

Officer’s Representative (COR), as required.

ATTACHMENT 2

(U) CUI/FOUO ADDENDUM

1. (U) GENERAL:

a. (U) CUI/FOUO marking is assigned to information at the time of its creation in a DOD

User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

b. (U) Other non-security markings, such as "Limited Official Use" and "Official Use

Only" are used by non-DoD User Agencies for the same type of information and should be safeguarded and handled in accordance with instruction received from such agencies.

c. (U) Use of the above markings does not mean that the information cannot be released to the public under FOIA, only that the Government must review the information prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions thereof.

2. (U) MARKINGS:

a. (U) An unclassified document containing CUI/FOUO information will be marked with

“UNCLASSIFIED//FOR OFFICIAL USE ONLY” at the bottom of the front cover (if any), on the first page, on each page containing CUI/FOUO information, on the back page, and on the outside of the back cover (if any).

b. (U) Within a classified document, an individual page that contains both CUI/FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains CUI/FOUO information but no classified information, the portion will be marked, "U//FOUO".

c. (U) Any “UNCLASSIFIED//FOR OFFICIAL USE ONLY” information released to a contractor by a DOD User Agency is required to be marked with the following statement prior to transfer.

d. (U) “This document contains information EXEMPT FROM MANDATORY

DISCLOSURE UNDER THE FOIA. Exemptions apply.”

e. (U) Removal of the "UNCLASSIFIED//FOR OFFICIAL USE ONLY" marking can only be accomplished by the originator or other competent authority. When the

“UNCLASSIFIED//FOR OFFICIAL USE ONLY” status is terminated, all known holders will be notified to the extent practical.

3. (U) DISSEMINATION:

a. (U) Contractors may disseminate CUI/FOUO to their employees and subcontractors who have a need for the information in connection with a classified contract.

b. (U) Contractors must ensure employees and subcontractors are aware of the special handling instructions detailed below.

4. (U) STORAGE:

a. (U) During working hours, CUI/FOUO shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information.

b. (U) During nonworking hours, the information shall be stored to preclude unauthorized access.

c. (U) Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after- hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. (U) TRANSMISSION:

a. (U) CUI/FOUO may be sent via, email, first-class mail or parcel post. To prevent unauthorized disclosure, encrypt CUI/FOUO emails; attach CUI/FOUO cover sheets to printed material.

b. (U) DOD components, officials of DOD components, and authorized DOD contractors, consultants, and grantees send CUI/FOUO to each other to conduct official DOD business. Ensure recipients are kept abreast of the status of such information, and send the material in a way that prevents unauthorized public disclosure.

c. (U) CUI/FOUO may be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Mark the records

“UNCLASSIFIED//FOR OFFICIAL USE ONLY” and tell the recipient the information is exempt from public disclosure under the FOIA and requires special handling.

6. (U) DISPOSITION:

(U) When no longer needed, CUI/FOUO information must be shredded.

7. (U) UNAUTHORIZED DISCLOSURE:

a. (U) Unauthorized disclosure of CUI/FOUO may not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure.

b. (U) The unauthorized disclosure of CUI/FOUO information protected by the Privacy

Act may result in criminal sanctions and disciplinary action may be taken against those responsible.

ATTACHMENT 3

(U) US ARMY SCI ADDENDUM TO DD FORM 254

XXX ADDENDUM (1) This contract requires access to Sensitive Compartmented Information (SCI). The Commander, US Army Intelligence and Security Command (INSCOM), acting on behalf of the DA Deputy Chief of Staff (DCS), G-2 is the Cognizant Security Authority (CSA) for the US Army, has exclusive security responsibility for all SCI released to the contractor or developed under the contract and held within the Contractor's Controlled Area or Co-utilization Agreement (CUA).

XXX ADDENDUM (2) The Defense Intelligence Agency (DIA) has security inspection responsibility for SCI and the Defense Security Service (DSS) retains responsibility for all collateral information released or developed under the contract and held within the DoD Contractor's Controlled Area. All DD Forms 254 prepared for contracts involving access to SCI under this contract must be processed through ACCS to the CM and Industrial Security Specialist for approval.

XXX ADDENDUM (3) The manuals, regulations, and directives checked below provide the necessary guidance for physical, personnel, and information security for safeguarding SCI, and are part of the security classification specification for this contract:

XXX ADDENDUM (3A) ICD 503, Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation

XXX ADDENDUM (3B) ICD 704 Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information

XXX ADDENDUM (3C) IC Tech Spec-for ICD/ICS 705, Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities

XXX ADDENDUM (3D) Signals Intelligence Security Regulations (SISR) (Available from the CM)

XXX ADDENDUM (3E) Imagery Policy Series (Available from the CM)

XXX ADDENDUM (3F) DODM 5105 Vol 1 - 3 SCI Administrative Security Manual

XXX ADDENDUM (3G) AR 380-28, DA Special Security System

XXX ADDENDUM (3H) AR 25-2, Information Assurance

ADDENDUM (3I) AR 380-381, Special Access Programs

XXX ADDENDUM (3J) Army Handbook for SCI Contracts

ADDENDUM (3K) Other

Analytic and Engineering Mission Support Services

UNCLASSIFIED//FOR OFFICIAL USE ONLY

XXX ADDENDUM (4) Enter contract estimated completion date which is known as Period of Performance (POP) and ensure it matches the attached awarded documentation. (Please attach awarded document for period of performance from KO.)

Contract estimated completion date: 30 Nov 2019

How many option years? 0

XXX ADDENDUM (5) The name, telephone number, and email and mailing address of the Contract Monitor (CM) and alternate for the SCI portion of this contract are: (The CM and the contractor security officer must be registered in the Army Centralized

Contracts and Security Portal (ACCS) at the level of contract, in order to process SCI actions)

CM: Cynthia A. Acord, 575-678-1300, cynthia.a.acord.civ@mail.mil, The Research & Analysis Center-WSMR, 1400 Martin Luther King Jr. Ave, ATTN: ATRC-WOS, White Sands Missile Range, NM 88002.

Alt CMs: Conrad Andry, 575-678-1370, conrad.andry.civ@mail.mil, The Research & Analysis Center, 1400 Martin Luther King Jr. Ave, ATTN: ATRC-WOS, White Sands Missile Range, NM 88002.

Additionally, identify the Security POC, phone number, and email address at the contractor’s/subcontractor’s location:

Contractor Security POC:

XXX ADDENDUM (6) All DD Forms 254 prepared for contracts involving access to SCI under this contract must be processed through ACCS to the CM and Industrial Security Specialist for approval and to Contractor Support Element, USAINSCOM, ACofS Security, and G2 for review and concurrence of the awarded contract.

XXX ADDENDUM (7) Visit certification to DoD locations is not required, as need to know and accesses is verified at the visiting facility. Non DoD locations the contractor must process request for SCI visit certification(s) through ACCS to the CM for approval and to Contractor Support Element (CSE) for review and processing. Visit certification request must be submitted at least ten (10) working days prior to the visit.

XXX ADDENDUM (8) Debriefings: All FSO’s/CSSO’s must properly debrief all contractors from SCI through ACCS. FSO/CSSO’s must submit the debrief request NLT 7 days and NET 10 days before actual departure through ACCS.

FSO’s/CSSO’s will separate all contractors from JCAVS after completion of debriefing.

XXX ADDENDUM (9) The contractor will not reproduce any SCI related material without prior written permission of the CM.

XXX ADDENDUM (10) Security Classification Guides or extracts are attached or will be provided under separate cover

XXX ADDENDUM (11) Electronic processing of SCI requires accreditation of the equipment in accordance with ICD 503 and AR 25-2.

ADDENDUM (12) This contract requires a contractor Controlled Area or CUA.

ADDENDUM (13) Request for Indoctrination/Debrief Authority

XXX ADDENDUM (14) This contract requires (SI) (TK) (G) (HCS) (Add others as required)

XXX ADDENDUM (14A) SI XXX ADDENDUM (14C) G

XXX ADDENDUM (14B) TK XXX ADDENDUM (14D) HCS

ADDENDUM (14E) Other:

XXX ADDENDUM (15) The contractor will perform SCI work under this contract at the following location (s). LIST ALL SCI PERFORMANCE LOCATIONS:

(Name of government or contractor activity, SCI SMO or CAGE Code)

(W4AEAA3) THE RESEARCH & ANALYSIS CENTER, 1400 Martin Luther King Jr. Ave, ATTN: ATRC-WOS, White Sands Missile Range, NM 88002.

ADDENDUM (16) The contractor identified in Block 6 is a Multiple Facility Organization (MFO) and is authorized to submit DD254 and SCI Addendum for the following SCI locations. (Facility Name and CAGE Code) (please attach DD form 441)

ADDENDUM (17) Contract has SCI Courier Requirement