W911S0-17-R-0002_ATTACHMENT_2_DD254.pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

a. FACILITY CLEARANCE REQUIRED

TOP SECRET

(The requirements of the National Industrial Security Program Operating Manual (NISPOM) apply to all security aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

SECRET

2. THIS SPECIFICATION IS FOR (x and complete as applicable) 3. THIS SPECIFICATION IS: (x and complete as applicable)

X

a. PRIME CONTRACT NUMBER

TBD

a. ORIGINAL (Complete date in all cases) Date (YYMMDD)

b. SUBCONTRACT NUMBER b. REVISED (Supersedes all previous specs)

Revision No. Date (YYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? YES X NO. If Yes, complete the following:

Classified material received or generated under ______________________ (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES X NO. If Yes, complete the following:

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

TBD

b. CAGE CODE

TBD

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

TBD

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION l . Collateral Access: Multiple Locations, See Item 13 W6GCAA3

&DD254 Continuation Page

2. SCI ACCESS: See Enclosed SCI Addendum

3. SAP Access: See Enclosed SAP Supplement

b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

Defense Security Service (IOFCL l)

7556 Teague Road, Ste. 580

Hanover, MD 21076

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Asymmetric Warfare Group (AWG)

Operations Support Contract

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION X a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

X

b. RESTRICTED DATA X b. RECEIVE CLASSIFIED DOCUMENTS ONLY X

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION X c. RECEIVE AND GENERATE CLASSIFIED MATERIAL X

d. FORMERLY RESTRICTED DATA X d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE X

e. INTELLIGENCE INFORMATION: e. PERFORM, SERVICES ONLY X

(1) Sensitive Compartmented Information (SCI) X f. HAVE ACCESS TO US CLASSIFIED INFORMATION OUTSIDE THE US, PUERTO RICO, US POSSESSIONS AND TRUST TERRITORIES

X

(2) Non-SCI X g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY

DISTRIBUTION CENTER

X

f. SPECIAL ACCESS INFORMATION X h. REQUIRE A COMSEC ACCOUNT X

g. NATO INFORMATION X i. HAVE TEMPEST REQUIREMENTS (SEE ITEM 13) X

h. FOREIGN GOVERNMENT INFORMATION X

X

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS X

i. LIMITED DISSEMINATION INFORMATION X k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE X

j. FOR OFFICIAL USE ONLY INFORMATION X l. OTHER (Specify) X

k. OTHER (Specify)

See DD254 Continuation Page X See DD254 Continuation Page

DD Form 254, December 1999 Previous editions are obsolete. 805/340

FOR OFFICIAL USE ONLY

Attachment 2

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the NISPOM or unless it has been approved for public release by appropriate US Government authority. Proposed public release shall be submitted for approval prior to release

Direct X Through (Specify): Commander, Asymmetric Warfare Group, Attn: Public Affairs Office, 2270 Rock Avenue, Fort Meade, MD 20755

PUBLIC RELEASE OF SCI INFORMATION NOT AUTHORIZED

to the Directorate for Freedom of information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

See Section 13 Continuation Section at the bottom of this form

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to NISPOM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements X Yes No to the cognizant security office. Use item 13 if additional space is needed.) SCI Addendum, FOUO Addendum, SAP Addendum , Personnel must comply with security training listed in the Security Training addendum

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas of elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

X Yes No

See SCI Addendum

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL/APPROVAL OFFICIAL b. TITLE c. TELEPHONE (Include Area Code)

James E. Glenn

James.e.glenn.civ@mail.mil

Special Security Officer 301-833-5364

d. ADDRESS (Include Zip Code)

17. REQUIRED DISTRIBUTION

2270 Rock Ave

X

a. CONTRACTOR

Fort George G. Meade, MD 20755

b. SUBCONTRACTOR

X

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

X e. ADMINISTRATIVE CONTRACTING OFFICER

X f. OTHERS AS NECESSARY

SEE DD FORM 254 CONTINUATION PAGE

DD Form 254 Reverse, December 1999 (Previous editions are obsolete)

TBD

SECURITY GUIDANCE (ITEM 13) CONTINUATION:

Additional Security Guidance:

a. Contractor shall forward a copy of any Defense Security Service (DSS) letter that informs of any serious contractor facility deficiency to the AWG Industrial Security Specialist (ISS) within 48 hours of receipt. See DD

Form 254, Page 2, Item/Blocks 16a, b, c, & d for the ISS’s contact information.

b. Additionally, the contractor shall report any incident of possible compromise or security violations to the

AWG ISS identified in Item 16a within 24 hours after discovery. See DD Form 254, Page 2, Item/Blocks 16a, b, c, & d for the ISS’s contact information.

c. The prime contractor shall provide the AWG ISS with a copy of all DD Forms 254 issued to subcontractors, to include all revisions. See DD Form 254, Page 2, Item/Blocks 16a, b, c, & d for the ISS’s contact information.

d. In accordance with the Federal Acquisition Regulation, Part 52.246-5(c), the Government has the right to inspect and test all services called for by the contract, to the extent practicable at all times and places during the term of the contract. The Government shall perform inspections and tests in a manner that will not unduly delay the work.

Additionally, Chapter 1-104b of the National Industrial Security Program Operating Manual (NISPOM) states that the designation of a Cognizant Security Office does not relieve the Government Contracting Activity (GCA) of the responsibility to protect and safeguard the classified information necessary for its classified contracts, or from visiting the contractor to review the security aspects of such contracts. AWG may accompany DSS during its Staff

Assistance Visits (SAV) to ascertain the level of compliance with the stated requirements of this DD-254 and all derivative or subordinate DD-254 forms. These SAVs shall be coordinated with the corresponding company's

Facility Security Officer and cognizant Industrial Security Representative from the Defense Security Service. These

SAVs shall be limited to validation of the Cleared Defense Contractor's (CDC) compliance with AWG stated security requirements officially identified in this DD-254. These SAV's do not in any way encumber, inhibit, or negate DSS' role as the CSO and/or agency responsible for NISPOM compliance and Facility Clearance Level (FCL) inspection/accreditation.

Reference Item 1a; The work to be performed on this contract will require specified contract personnel to have access to TOP SECRET/SCI. Additionally, all contractor management personnel shall have a TOP SECRET clearance and all contractor administrative and financial personnel performing indirect labor relating to this contract shall have a SECRET clearance.

Reference Item 8a; Place of Performance will be:

I. Fort George G. Meade, CONUS and OCONUS Locations as directed by the contract monitor.

2. See enclosed SCI Addendum.

3. See enclosed SAP Addendum.

4. Authorized contractor facilities

Reference Item 10a; Access to COMSEC

a. Contractors will be required to carry and operate government owned and issued COMSEC devices to, from and in

CONUS and OCONUS locations as directed by the contract monitor.

b. Written concurrence from AWG Contracting Officer is required prior to subcontracting COMSEC information. c.

Classified COMSEC material is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. COMSEC access shall be IAW DOD 5220.22-M, National Security Agency (NSA)

Central Security Service NSNCSS Policy Manual No. 3-16, Control of

Communications Security (COMSEC) Material and AR 380-40, Policy for Safeguarding & Controlling

Communications Security (COMSEC) Material. When access is required at Government facilities, contractor personnel will adhere to COMSEC rules and regulations as mandated by AWG policy and procedures.

Reference Item 10d; : Access to Formerly Restricted Data (FRD).

a. Written concurrence from AWG Contracting Officer is required prior to authorizing

FRD access to a subcontractor.

b. The contractor is permitted access to FRD in performance of this contract. Access to

FRD requires a final U.S. Government clearance at the appropriate security level.

Reference Item 10e(1); This contract requires access to Sensitive Compartmented Information (SCI).

a. No public release of information is authorized. Public Disclosure or confirmation of any subject related to the support contract is not authorize without obtaining written approval from AWG Contracting Officer. Requirements for the SCI portion are contained in the enclosed U.S. Army SCI Addendum to DD form 254.

b. Written approval from the AWG SCI Monitor and SSO are required prior to subcontracting SCI.

c. This effort does not require a contractor SCIF. See Enclosure 1 (attached).

Ms. Debra Lewis, SCI Monitor, Telephone Number: (301)833.5035

Reference Item 10e(2); Access to Intelligence Information (non-SCI)

a. Written concurrence from AWG Contracting Officer is required prior to subcontracting

Non-SCI.

b. Non-SCI information is not releasable to contractor employees who have not received a clearance at the appropriate security level.

c. The following guidelines concerning control and dissemination of intelligence information are in effect:

(1) Intelligence information released under this contract or Request for Proposal (RFP) remains the property of the

U.S. Government and may be withdrawn upon notice.

(2) The contractor will maintain a record of all classified intelligence material released to your custody. Unclassified intelligence information will be treated as For Official Use Only (FOUO).

(3) All reproductions of intelligence material will be classified, marked, and controlled in the same manner as original(s).

(4) You will not release intelligence material to any activity, employee, or other person not directly engaged in providing services under this contract unless specific written authorization for such release is received from the

Government Contacting

Activity (GCA).

(5) The intelligence materials will not be released to foreign nations, non-U.S. citizens or U.S. citizens representing foreign entities except with specific written authorization from the GCA and Government Foreign Disclosure

Officer.

(6) Intelligence materials released to you will be destroyed upon contract completion unless the GCA requests the return of the materials.

Reference Item 10f: This contract requires access to Special Access Information. See Enclosed SAP

Supplement for additional SAP guidance and requirements.

LTC Ray Ceralde, SAPCO, Telephone Number: (301)833-5328

Reference Item 10g: NATO Information

a. NATO Information accessed under this contract shall be will not be released without obtaining written approval from AWG Contracting Officer.

b. Written approval from AWG Contracting Officer is required prior to subcontracting NATO.

c. NATO will be safeguarded IAW the NISPOM, Chapter 10, Section 7. Personnel will not be granted NATO access until a final U.S. SECRET clearance is granted.

d. The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees are NATO briefed prior to access being granted.

e. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM, Chapter 10, Section 7.

Reference Item 10h; This contract requires access to Foreign Government Information.

a. Written approval from AWG Contracting Officer is required prior to subcontracting

Foreign Government Information.

b. Foreign Government Information (FGI) is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level.

c. Foreign government information is described as information provided to the U.S. by a foreign government or information produced by the U.S. as a result of a joint arrangement with a foreign government requiring that the information or arrangement be held in confidence.

d. Procedures for access to foreign government information in Chapter 10, Section 3, of the NISPOM apply.

e. Classified foreign government information will be afforded the same degree of protection as U.S. classified.

Procedures in Chapter 10 of the NISPOM apply.

f. Foreign government information will not be transferred (oral, visual, or documentary) to a third party without the written approval of the AWO Contracting Office (KO) and ·the Foreign Disclosure Officer (FDO).

g. Receipt of foreign government information does not authorize the contractor to enter into discussions or release any data to foreign nationals or foreign representatives without an approved export license.

Reference Item 10j; For Official Use Only (FOUO) Information.

For Official Use Only Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoD 5200.1-R, Appendix 3 (see enclosed DD Form 254 FOUO Addendum).

Reference Item 10k; Other.

a. Classified Automated Information Systems (AIS) Processing (Collateral). Classified AIS processing at the

SECRET-level and below (collateral level) required at contractor locations identified in DD Form 254, Item 8.a.

Classified processing will be in accordance with Chapter 8, NISPOM.

b. Secret Internet Protocol Network (SIPRNET) Access. SIPRNET access authorized in order to fulfill contractual requirements. Individuals having access to SIPRNET require a NATO Awareness Briefing.

c. Access to Alternate or Compensatory Control Measure (ACCM) and Focal Point (FP) Access to Alternate or

Compensatory Control Measure (ACCM) and Focal Point (FP) programs protected information is authorized in performance of this contract. ACCMs information must be handled in accordance with DoDM 5200.01-V3.

Reference Item 11c: Receive and Generate Classified Material.

Using agency will furnish complete classification guidance.

Reference Item 11d: This contract will require contractors to Fabricate, Modify or store classified material.

a. Contractors on this contract will be required to transport and store classified material.

b. Material will be handled IAW with DoD 5200.01 and NISPOM.

Reference Item 11f: Access to U.S. Classified Information outside the U.S., Puerto Rico, U.S. Possessions and

Trust Territories.

This contract requires access to classified information in an overseas area. The specific overseas area(s) will be provided by the Contract Monitor.

Reference Item 11h: Require a COMSEC Account.

a. The contractor will maintain a current listing of all accountable COMSEC equipment and/or material associated with this contract. A copy of this listing will be filed with the contract DD Form 254.

Reference Item 11j: Contractor will follow OPSEC requirement of the Statement of Work or performance Work

Statement and place of performance (AWG I Fort George G. Meade, MD)

a. Refer to enclosed SAP supplement for OPSEC guidance regarding SAP information.

Reference Item 11k: Defense Courier Service (DCS).

a. Written approval from AWG Contracting Officer is required prior to the prime contractor authorizing a subcontracting use of the services of DCS.

b. Contractor is authorized to use the Defense Courier Service. Requests services from the Commander, DCS, ATTN: Operations Division, Fort George G. Meade, MD 20755-5370.

Controlled Unclassified Information (CUI).

a. Personnel will comply with DOD 5200.01, Vol 4, with regard to safeguarding and handling CUI.

b. Electronic transmission of CUI, facsimile and data, shall be by approved secure communication systems in accordance with Department of Defense Instruction Number 8582.01, June 6, 2012.

On-Site (Imbedded/Integrated) Contractors.

a. All contractor (prime and subcontractors) personnel with an assigned duty location at a government site shall be

U.S. citizens and have, at a minimum, a SECRET clearance.

b. Contractors (prime and subcontractors) located on-site shall comply with the AWG Government Security Program to include all applicable security regulations, policies, & procedures. Also, the on-site contractors shall attend all applicable mandatory security training and briefings, as identified by the COR.

Questions Regarding Security Requirements: All questions regarding security requirements indicated herein will be referred to the Contracting Officer’s Representative (COR)/Contracting Officer’s Representative (COR), if one is designated in Section H of the contract, or the Contracting Officer.

Enclosure 1 to DD Form 254

US ARMY SCI ADDENDUM TO DD FORM 254, 7 April 2009

XXX (1) This contract requires access to Sensitive Compartmented Information (SCI). The Commander, US Army

Intelligence and Security Command (INSCOM), acting on behalf of the DA Deputy Chief of Staff (DCS), G-2 as the

Cognizant Security Authority (CSA) for the US Army, has exclusive security responsibility for all SCI released to the contractor or developed under the contract and held within the Contractor's SCI Facility (SCIF) or Co-utilization

Agreement (CUA) SCIF. The Defense Intelligence Agency (DIA) has security inspection responsibility for SCI and the Defense Security Service (DSS) retains responsibility for all collateral information released or developed under the contract and held within the DoD Contractor's SCIF. The manuals, regulations and directives checked below provide the necessary guidance for physical, personnel, and information security for safeguarding SCI, and are part of the security classification specification for this contract:

XXX DoD 5105.21-M-1, SCI Security Manual, Administrative Security

XXX Signals Intelligence Security Regulations (SISR) (Available from the CM)

XXX Imagery Policy Series (Available from the CM)

XXX ICD 503, Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation. NOTE: The contractor shall utilize ICD 503, Intelligence

Community Information Technology Systems Security Risk Management, Certification and

Accreditation in lieu of DCID 6/3.

XXX ICS/ICD 705, Physical and Technical Security Standards for Sensitive Compartmented

Information Facilities, 31 October 2011. NOTE: The contractor shall utilize ICS/ICD 705, Physical and Technical Security Standards for Sensitive Compartmented Information

Facilities, 31 October 2011, in lieu of DCID 6/9. Also, refer to SCI Addendum, Page 2, Paragraph 13, “Additional Guidance.”

XXX AR 25-2, Information Assurance, 24 October 2007/RAR 23 March 2009.

XXX AR 380-28, DA Special Security System

XXX AR 380-381, Special Access Programs (SAPs).

XXX Army Handbook for SCI Contracts.

NA Other

XXX (2) Contract estimated completion date: 2018 06 14 .

(NOTE: Section “F” of the contract normally provides the period of performance. Option years are not to be included, as an option is not valid until exercised by the government).

XXX (3) The name, telephone number, email address and mailing address of the Contract Monitor (CM) for the SCI portion of this contract is (Additionally, identify the Security POC & phone number and e-mail address at the contractor’s/subcontractor’s location):

Primary SCI Monitor: Debra Holmes, SCI Monitor, debra.d.holmes3.civ@mail.mil, (301) 833-5035, 2270 Rock

Avenue, Fort George G. Meade, MD 20755.

(NOTE: The Contract/SCI Monitor and the contractor security officer must be registered in the Army

Centralized Contracts and Security (ACCS) in order to process SCI actions).

XXX (4) All DD Forms 254 prepared for subcontracts involving access to SCI under this contract must be forwarded to the CM for approval and then to HQ INSCOM, ACofS Security, G2, Contractor Support Element

(CSE) for review and concurrence prior to award of the subcontract.

XXX (5) The contractor will submit the request for SCI visit certifications through the CM for approval of the visit. The certification request must arrive at the Contractor Support Element at least ten (10) working days prior to the visit. Visit certification requests will be processed through ACCS.

file:///C:/Users/debra.lewis/AppData/Local/Microsoft/Windows/Temporary%20Internet%20Files/Content.Outlook/Q905C9J8/debra.d.holmes3.civ@mail.mil

XXX (6) The contractor will not reproduce any SCI related material without prior written permission of the CM.

NA (7) Security Classification Guides or extracts are attached or will be provided under separate cover.

NA (8) Electronic processing of SCI requires accreditation of the equipment in accordance with ICD 503 and AR

25-2 (Note: Check only if item 11l indicates that a requirement exists for SCI AIS processing.)

NA_ (9) This contract requires a contractor SCIF.

XXX (10) This contract requires (SI) (SI/TK) (G) XXX (SI/TK/G/HCS)

(This number is total number of billets authorized for contract, to include subcontractor billets. This number will not exceed the number of billets identified above. Each nominee for SCI access will require a written justification to be submitted for approval to the government SCI Monitor identified in paragraph 3 above).

XXX (11) The contractor will perform SCI work under this contract at the following locations: AWG Facilities at

Fort George G. Meade, MD and Fort AP Hill, VA

NA_ (12) The contract identified in Block 6 or 7 is authorized to submit nominations for SCI access for the following Multiple Facility Organization (MFO) locations:

NA_ (13) Additional Guidance to ICS/ICD 705. SCIFs accredited after implementation of ICD 705 requirements will meet those requirements. SCIFs accredited prior to the implementation of ICD 705 under DCID 6/9 may continue to meet DCID 6/9 requirements, unless one of the following occurs:

(a) Modifications to the SCIF will require the modifications to meet ICD 705 requirements, or

(b) The SCIF was de-accredited and maintained at the SECRET level for more than one year, or

(c) The SCIF was de-accredited for less than one year and NOT maintained at the SECRET level, or

(d) As directed by the SCIF accreditation authority.

Enclosure 2 to DD Form 254, “For Official Use Only Addendum”

Contract Number: TBD

PROTECTING "FOR OFFICIAL USE ONLY" (FOUO) INFORMATION

1. GENERAL:

a. The "For Official Use Only" (FOUO) marking is assigned to information at the time of its creation in a

DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of

Information Act (FOIA).

b. Other non-security markings, such as "Limited Official Use" and "Official Use Only" are used by non-

DoD User Agencies for the same type of information and should be safeguarded and handled in accordance with instruction received from such agencies.

c. Use of the above markings does not mean that the information cannot be released to the public under

FOIA, only that the Government must review the information prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions thereof.

d. The World Wide Web shall be equated with “Public Access.” Information must be reviewed by

USASMDC/ARSTRAT Public Affairs Office and officially approved for public release before placing on publicly-accessible Web pages or electronic bulletin boards.

2. MARKINGS:

a. An unclassified document containing FOUO information will be marked "For Official Use Only" at the bottom of the front cover (if any), on the first page, on each page containing FOUO information, on the back page, and on the outside of the back cover (if any).

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked, "FOUO."

c. Any "'For Official Use Only" information released to a contractor by a DoD User Agency is required to be marked with the following statement prior to transfer.

“This document contains information EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FOIA.

Exemptions apply.”

d. Removal of the "For Official Use Only" marking can only be accomplished by the originator or other competent authority. When the "For Official Use Only" status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: Contractors may disseminate "For Official Use Only" information to their employees and subcontractors who have a need for the information in connection with a classified contract. Contractors must ensure employees and subcontractors are aware of the special handling instructions detailed below.

4. STORAGE: During working hours, "For Official Use Only" information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours.

When such internal security control is not exercised, locked buildings or rooms will provide adequate after- hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: "For Official Use Only" information may be sent via first-class mail or parcel post. Bulky shipments may be sent by fourth-class mail. DoD components, officials of DoD components, and authorized DoD contractors, consultants, and grantees send FOUO information to each other to conduct official DoD business. Tell recipients the status of such information, and send the material in a way that prevents unauthorized public disclosure.

Make sure documents that transmit FOUO material call attention to any FOUO attachments. Normally, you may send

FOUO records over facsimile equipment. To prevent unauthorized disclosure, consider attaching special cover sheets, the location of sending and receiving machines, and whether authorized personnel are around to receive

FOUO information. FOUO information may be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Mark the records "For Official Use Only" and tell the recipient the information is exempt from public disclosure under the FOIA and requires special handling.

6. DISPOSITION: When no longer needed, FOUO information must be shredded.

7. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of "For Official Use Only" information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions and disciplinary action may be taken against those responsible.

Enclosure 3 to DD Form 254, SECURITY TRAINING REQUIRMENTS

1. Required Security Training:

1.1 AT Level I Training. All contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR (or to the contracting officer, if a COR is not assigned) within 10 calendar days after completion of training by all employees and subcontractor personnel. All personnel will complete AT level I refresher training annually. AT Level I awareness training is available at https://Jkodirect.jten.mil.

1.2 AT Awareness Training for Contractor Personnel Traveling Overseas. Contractor employees and associated subcontractor employees are to receive government-provided AT awareness training specific to the area of responsibility (AOR) as directed by AR 525-13. Specific AOR training content is directed by the combatant commander, with the unit Antiterrorism Officer (ATO) being the local point of contact.

1.3 OPSEC Training. Per AR 530-1, Operations Security, new contractor employees must complete

Level I OPSEC training within 30 calendar days of reporting for duty. All contractor employees must complete OPSEC awareness training annually. OPSEC training is available at https://www.us.army.mil/

1.4 iWATCH Training. The contractor and all associated subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees’ commencing performance, with the results reported to the COR no later than 45 calendar days after contract award.

1.5 Initial Security Training. New contractor employees physically working at AWG facilities must complete Initial Security training within 10 calendar days of reporting for duty. All contractor employees must complete security refresher training annually. Initial Security Training is available at https://www.us.army.mil/

1.6 SCI Familiarization Security Training. New contractor employees physically working at AWG facilities must complete SCI Familiarization Security training within 10 calendar days of reporting for duty.

All contractor employees must complete annual refreshers training annually. SCI Familiarization Training is available at https://www.us.army.mil/

1.7 Threat Awareness and Reporting Program Training. New contractor employees physically working at AWG facilities must complete Threat Awareness and Reporting training within 10 calendar days of reporting for duty. All contractor employees must complete Threat Awareness and Reporting training annually. Initial Security Training is available at https://www.us.army.mil/

1.8 NATO Training. New contractor employees physically working at AWG facilities must complete

NATO training within 10 calendar days of reporting for duty. All contractor employees must complete

NATO training Semi-annually. NATO training is available on the AWG Portal.

1.9 Managing Personnel with Clearances. New contractor employees physically working at AWG facilities who will be performing supervisory duties must Managing Personnel with Clearances training within 10 calendar days of reporting for duty. All contractor employees with supervisory duties must https://jkodirect.jten.mil/ https://www.us.army.mil/ https://www.us.army.mil/ complete Managing Personnel with Clearances training. Managing Personnel with Clearances Training is available at https://www.us.army.mil/

1.10 Controlled Unclassified Information Training. New contractor employees physically working at

AWG facilities must complete Controlled Unclassified Information training within 10 calendar days of reporting for duty. All contractor employees must complete Controlled Unclassified Information training annually. Controlled Unclassified Information training is available on the AWG Portal.

1.11 Marking Classified Documents Training. New contractor employees physically working at

AWG facilities must complete Marking Classified Documents training within 10 calendar days of reporting for duty. Marking Classified Documents Training is Available on Controlled Unclassified Information training is available at https://stepp.dss.mil/SelfRegistration/Login.aspx.

1.12 Derivative Classification Training. New contractor employees physically working at AWG facilities must complete Derivative Classification training within 10 calendar days of reporting for duty. All contractor employees must complete Controlled Unclassified Information training semi-annually.

Derivative Classification training is available at https://stepp.dss.mil/SelfRegistration/Login.aspx.

Enclosure 2 to DD Form 254, Special Access Program (SAP) Supplement to CONTRACT NUMBER: TBD

Reference Item 10f: While the contract vehicle is administered by AWG, Army special access programs

(SAP) to which access may be required are not administered by AWG. AWG does not control the security, operations, or administration of the SAP but have verified that there is a requirement for its inclusion on the DD

Form 254. Any questions regarding this DD Form 254 should be directed to the AWG SAPCO, LTC Ray Ceralde at

256-955-2066.

a. The policy documents identified in Item 13 (below) will be provided to the contractor named in Item 6a if they do not possess a copy. The United States Army Asymmetric Warfare Group (AWG) Program Security Manager will provide detailed, SAP-specific guidance to the contractor under separate cover.

b. Access to SAP information or material shall be at government facilities and other designated contractor locations only as identified and approved by the AWG Program Security Manager (PSM).

c. Access to SAP information requires a final U.S. Government Top Secret clearance based upon a favorable Single

Scope Background Investigation (SSBI) investigation completed within the last five years, a SAP nomination, and a special access nondisclosure briefing/Special Access Program Indoctrination Agreement prior to access. Candidates may also be subject to counter-intelligence polygraph exams and random urinalysis testing. Failure of selected individual to submit to the polygraph examination and/or random urinalysis test may result in his or her access to

SAP information being suspended. The Government PSM will contact the contractor Facility Security Officer (FSO) or Contractor Program Security Officer (CPSO) to obtain security information on personnel identified for nomination, to include a current, updated SF-86 or Electronic Questionnaire for Investigations Processing (e-QIP) and other documentation necessary to complete the Program Access Request (PAR) package. ·

Reference Item 11a-c:

a. Any access to SAP information or data in regard to this Contract will be conducted in AWG accredited SAP

Facilities (SAPFs) or other accredited SAPFs as authorized by AWG.

b. Any facility that stores, processes or discusses SAP information or data in regard to this contract will be designated as an AWG-accredited SAPF. SAPFs will be accredited by AWG and/or AWG prior to any discussions or.receipt and/or generation of any classified material. The Defense Security, Service (DSS) will be responsible for https://www.us.army.mil/ https://stepp.dss.mil/SelfRegistration/Login.aspx https://stepp.dss.mil/SelfRegistration/Login.aspx inspection of the contractor's SAPF; however, DSS will inspect to JAFAN 6/9 standards. The CPSO will be designated (by the PSM) as the security point of contact for the SAPF.

d. If the proposed SAPF is already accredited by another sponsor, and/or located within an accredited Sensitive

Compartmented Information Facility (SCIF), the facility will still have to be approved by AWG. The following additional documentation is required prior to introducing any AWO sponsored SAP information.

(1) A Memorandum of Agreement (MOA) must be executed between the AWG PSM and the established SAP

Cognizant Security Authority (CSA) if a requirement or capability is identified to discuss, store, or process SAP information within an existing SAPF.

(2) A Co-Utilization Agreement (CUA) is required between AWG PSM and the SCI CSA prior to introduction of

AWG-sponsored SAP data into an accredited SCIF.

3. Ref llg: Finished documents or other materials pertaining to this contract will not be released to the Defense

Technical Information Center (OTIC) or any other such information service under any circumstances.

4. Ref lli:

a. Automated Information Systems (AIS) processing SAP data must be certified and accredited in accordance with

(IA W) the Joint Air Force - Army - Navy (JAF AN) 6/3 and the 000 Information Assurance Certification and

Accreditation Process (DIACAP). When the need to process SAP data is identified, the CPSO will request a copy of the latest JAFAN 6/3 System Security Plan (SSP) template from the PSM. This template shall be used for accreditation of any AIS processing SAP Data. As an alternative, the contractor may use the Defense Security

Service (OSS) SSP format once it has been reviewed and approved by the PSM. Prior to any modification that affects the posture of accredited AIS, approval must be requested through the PSM.

b. TEMPEST requirements may be necessary in the performance of this contract in accordance with program requirements and/or the JAFAN 6/0.

5. Ref llj: Operations Security (OPSEC) requirements are necessary in the performance of this contract IA W individual program requirements, JAFAN 6/0 and AR 530-1. A program specific OPSEC plan and/or guidance will be provided by the AWG PSM. The contractor is not required to provide their own individual OPSEC plan (with the exception of tests or events the contractor is tasked to oversee or perform).

6. Ref 111:

a. Foreign Nationals are not permitted to work on or have access to any SAP information without a waiver from the

V.S. Army SAPCO. However, if approval is granted, V.S. Export Laws still apply and the contractor must obtain required export licenses. When requesting foreign national access, include the individual's full name, date and place of birth, social security account number and official status within the V.S.

b. The contractor is not authorized to acquire from foreign companies any parts and/or materials by purchase or trade without first obtaining written authorization from the V.S. Army SAPCO.

7. Ref 12:

a. Public release of SAP information is PROHIBITED. Finished documents or other materials pertaining to this effort will not be released to the Defense Technical Information Center (OTIC) nor any other such information service under any circumstances. A pre-publication and/or presentation(s) review is required prior to the use of any classified or unclassified information which is either tangentially or directly related to any SAP. In each case, approval must be obtained from AWG SAPCO. The request must be submitted by the person who desires to make the publication or presentation, via the Contract Program Security Manager (CPSM) to the AWG.

b. The contractor shall not use references to SAP accesses or information, even by unclassified acronyms, in advertising, promotional efforts or recruitment of employees.

8. Ref 13: The following Regulations, Guides, and Manuals apply to this contract:

a. DoD 5200.01, Information Security Program Regulation, Chapter VIII.;

b. DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM);

c. AR 380-381, SAPs and Sensitive Activities;

d. AR 25-2, Information Assurance;

e. JAF AN 6/0, Special Access Program Security Manual;

f. JAF AN 6/3, Protecting SAP Information within Information Systems;

g. JAF AN 6/4, Special Access Program Tier Review Process;

h. JAF AN 6/9, Physical Security Standards for Special Access Program Facilities;

1. SAP-specific Program Security Guides(s) (to include all supplements) or Security

Procedure Guide (to include all supplements);

J. SAP-specific Security Classification Guide(s);

k. Appropriate Department of the Army U.S. Army Space and Missile Defense

Command/U.S. Army Forces Strategic Command Security Classification Guides -

PSM will provide as necessary.

i. Department of Defense Information Assurance Certification and Accreditation

Process (DIACAP)

m. Applicable Facility Specific Standard Operating Procedures;

n. Treaty Plans;

o. OPSEC Guides;

p. AR 525-13, Anti-Terrorism; and,

q. AR 530-1, Operations Security (OPSEC).

9. CONTRACT NUMBER. The complete contract number is Unclassified. The contractor may be required to establish non-attributable internal procedures and charge numbers that will be documented in the facility's Standard

Operating Procedures (SOP) as necessary for cost accumulation by uncleared personnel.

10. SUBCONTRACTING. All subcontracts with SAP authorization must have prior approval of A WG PSM.

Contractors will include the provisions of this supplement in all subcontracts requiring SAP access in support of this effort. Any classified program activity that requires the use of a subcontractor facility must meet JAFAN 6/9 criteria and be accredited by the AWG PSM.

11. DOCUMENTATION. Collateral information/material not directly relating to this contract shall not be introduced or authorized within a SAPF without prior written authorization from AWG PSM.

12. COMMUNICATIONS AND TRANSMISSIONS.

a. Any communications with outside activities not involved .with the specific supported SAP are PROHIBITED, unless otherwise authorized by AWG PSM.

b. All programmatic material relating to this contract and its administration shall be classified in accordance with the requirements outlined in AWG and SAP-specific security classification guides and this DD254 or as directed by

AWG.

c. Program related verbal communications will be conducted on secure telephone units approved by AWG PSM.

d. All documentation concerning this contract will be transmitted in accordance with the

JAFAN 6/0. If U.S. Postal mailing is used, AWG PSM will provide additional guidance.

13. VOUCHERS. All invoices/vouchers submitted under this contract shall be UNCLASSIFIED and shall be devoid of any information that would require them to be classified. The invoice/voucher may reveal the contractor's name, customer name or UIC of the contract number. All invoices/vouchers shall be transmitted via means identified in paragraph 10, above, or based on guidance from AWG.

14. LEGAL COUNSEL. Should the contractor require private counsel to represent corporate interests in matters related to or associated with SAP sponsored activities, the Procurement Contracting Officer (PCO), and AWG PSM shall be notified in writing. The private counsel shall be treated as a subcontractor. In those incidents where the issues are not program specific, it is the responsibility of the appropriate indoctrinated contractor personnel to prevent inadvertent dissemination of SAP related information/data, operational procedures and/or administrative details to the private counsel.

15. RETENTION OF PROGRAM RELATED DOCUMENTATION. Upon completion of this contract and acceptance by the Government of final deliverables, the contractor shall:

a. Conduct an inventory/audit of all classified documents received and/or generated under this contract and forward it to AWG PSM.

b. In accordance with A WG direction, the contractor shall destroy classified material utilizing approved destruction procedure/methods and maintain certificates of destruction for final close-out review. Retention of SAP information at the contractor facility is not generally authorized beyond contract close-out unless a follow on contract/task is anticipated. A written request for authorization for document retention must be forwarded through the AWG PSM to the PCO and the AWG SAPCO for approval.

16. ISSUES/CONFLICT REPORTING.

a. Any questions regarding classification, access, or any other security related issue in regard to this contract must be referred, in writing, to AWG PSM.

b. Any suspected or confirmed security incident or violation involving SAP information will be immediately reported to the AWG PSM and followed up in writing.

c. Any conflict between instructions contained in any referenced policy and this DD

Form 254 must be reported to AWG PSM by the most expedient means.