Attachment21.pdf

CONTINUATION OF BLOCK 13 OF THE DD FORM 254

Solicitation # W911SA-12-R-0017

Ref 10j.

PROTECTING "FOR OFFICIAL USE ONLY" (FOUO) CONTROLLED UNCLASSIFIED INFORMATION

(CUI)

1. GENERAL:

In addition to classified information, certain types of unclassified information require application of access and distribution controls and protective measures for a variety of reasons. Such information is referred to collectively in Department of Defense (DoD) as CUI.

a. Description. FOUO is a dissemination control applied by the DoD to unclassified information when disclosure to the public of that particular record, or portion thereof, would reasonably be expected to cause a foreseeable harm to an interest protected by one or more of FOIA Exemptions 2 through 9. This includes information that qualifies for protection pursuant to the provisions of the Privacy Act of 1974, as amended.

b. Application

(1) It is the responsibility of the document’s originator to determine at origination whether the information may qualify for FOUO status and to ensure markings are applied as required.

(2) Information that is currently and properly classified shall be withheld from mandatory release in accordance with FOIA Exemption 1. The marking “FOR OFFICIAL USE ONLY” is applied to information that can reasonably be expected to qualify for exemption under one or more of FOIA Exemptions 2 through 9. By definition, information must be unclassified in order to be designated FOUO. This means that:

(a) Information cannot be marked as classified and FOUO at the same time, because no individual element of information can be simultaneously classified and FOUO. Therefore, classified documents containing FOUO information cannot bear an overall document marking of FOUO. However, portions or pages of a classified document that contain only FOUO information will be marked in a manner that identifies the FOUO content.

(b) Information that is declassified may be designated and marked as FOUO only when disclosure to the public of that particular record, or portion thereof, would reasonably be expected to cause a foreseeable harm to an interest protected by one or more of FOIA Exemptions 2 through 9.

(c) FOUO is not authorized as a means of protecting information that otherwise does not merit protection as classified for national security reasons.

2. MARKINGS:

a. Information that has been determined to qualify for FOUO status shall be indicated by markings. Markings are to be applied at the time documents are created to properly protect the information. When a classified document or portion thereof is declassified, FOUO markings may be applied, if applicable, to protect the information.

b. Marking information FOUO does not automatically qualify it for exemption from public release pursuant to the FOIA. Similarly, the absence of the FOUO marking does not automatically mean the information shall be released. Some types of records (e.g., personnel records) are not normally marked FOUO, but may still qualify for withholding in accordance with the FOIA. Information marked FOUO shall not specify, or have annotated, a FOIA exemption number.

c. Unclassified documents and material, including information in electronic form, containing FOUO information shall be marked as follows:

(1) Each document determined to contain FOUO information shall identify the originating agency or office.

This information shall be clear and complete enough to allow someone receiving the document to contact the office if questions or problems about the designation or markings arise.

(2) Documents shall be marked “FOR OFFICIAL USE ONLY” at the bottom of the outside of the front cover (if there is one), the title page, the first page, and the outside of the back cover (if there is one). Optionally, for consistency with classified systems, the document may be marked “UNCLASSIFIED//FOR OFFICIAL USE

ONLY.”

(3) Internal pages of the document that contain FOUO information shall be marked “FOR OFFICIAL USE ONLY” at the bottom. Optionally, for consistency with classified systems, internal pages may be marked “UNCLASSIFIED//FOR OFFICIAL USE ONLY” or “UNCLASSIFIED//FOUO”; in such case internal pages shall be marked at both the top and bottom.

(4) Subjects, titles, and each section, part, paragraph, or similar portion of an FOUO document shall be marked to show that they contain information requiring protection. Use the parenthetical notation “(FOUO)” (or optionally “(U//FOUO)”) to identify information as FOUO for this purpose. Place this notation immediately before the text.

(5) Each part of electronically transmitted messages, including e-mail, containing FOUO information shall be marked as required by this paragraph. Unclassified messages containing FOUO information shall be marked “FOR OFFICIAL USE ONLY” (optionally “UNCLASSIFIED//FOR OFFICIAL USE ONLY” or “UNCLASSIFIED//FOUO”) before the beginning of the text and shall contain the parenthetical portion marking “(FOUO)” (optionally “(U//FOUO)”) at the beginning of each portion containing FOUO information.

(6) Transmittal documents that have FOUO attachments, but no classified material attached, shall be marked with the following statement or a similar one: “FOR OFFICIAL USE ONLY ATTACHMENT.”

(7) When FOUO information is contained in media or material (including hardware and equipment) not commonly thought of as documents (e.g., computer files and other electronic media, audiovisual media, chart, maps, films, sound recordings), the requirement remains to identify, as clearly as possible, the information that requires protection. The main concern is that holders and users of the material are clearly notified of the presence of FOUO information. The markings required by this enclosure shall be applied either on the item or the documentation that accompanies it. Particular requirements and exceptions are noted in the following subparagraphs.

(a) Information Technology and Other Electronic Media. Conspicuously mark removable storage media used with computers, information technology systems, and other electronic devices and any other device on which data is stored and which normally is removable from the system by the user or operator. (Examples of such media include, but are not limited to, compact discs (CDs), digital video discs (DVDs), removable hard disks, flash or “thumb” drives, magnetic tape reels, disk packs, floppy disks and diskettes, disk cartridges, optical discs, paper tape, magnetic cards, memory chips, tape cassettes, and micro-cassettes.) Internal media identification will include FOUO markings in a form suitable for the media. Where size permits, all such devices bearing FOUO information must be conspicuously marked on the device or a label affixed thereto. Where size or technology preclude marking or affixing a label to the removable device itself (e.g., compact disc-read only memory (CD-ROM), memory chips), the label may be affixed to the container in which the device is stored.

(b) Blueprints, Engineering Drawings, Charts, and Maps. Mark blueprints, engineering drawings, charts, maps, and similar items not contained within another document, with the FOUO designation when applicable. The marking shall be unabbreviated, conspicuous, and applied top and bottom, if possible, in such a manner as to ensure reproduction on any copies. The legend or title shall also be marked. The parenthetical marking “(FOUO)” or “(U//FOUO)” following the legend or title may be used. If the blueprints, maps, and other items are large enough that they are likely to be rolled or folded, additional FOUO markings shall be placed to be visible when the item is rolled or folded.

(c) Photographic Media

1. Mark photographs and negatives “FOR OFFICIAL USE ONLY” (optionally “UNCLASSIFIED//FOR OFFICIAL USE ONLY” or “UNCLASSIFIED//FOUO”). Mark photographs on the face, if possible. Where this cannot be done, the marking may be placed on the reverse side. Digital photographs may be edited to place the markings on the face of the photograph.

2. Mark roll negatives and positives, and other film containing FOUO either on the film itself or on the canister, if one is used. If placed on the film itself, the marking shall be placed at the beginning and end of the roll.

3. Mark slides and transparencies on the image area of the item and also on the border, holder, or frame, if any. Information on the image area of each slide or transparency shall be portion marked in accordance with subparagraph 2.c.(3)(d) of this enclosure.

4. Mark DVDs, video tapes, and motion picture films at the beginning and end of the presentation (i.e., the played or projected portion). Discs, reels, and cassettes shall be marked and, when stored in a container, the container shall also be marked.

(d) Sound Recordings. Place an audible statement of the designation of FOUO at the beginning and end of sound recordings. Reels or cassettes shall be marked as required, and when stored in a container, the container shall be marked.

(e) Microfilm, Microfiche, and Similar Microform Media. Mark microfilm, microfiche, and similar microform media “FOR OFFICIAL USE ONLY” (optionally “UNCLASSIFIED//FOR OFFICIAL USE ONLY” or “UNCLASSIFIED//FOUO”) in the image area that can be read or copied. Such media also shall have this marking applied so it is visible to the unaided eye. Any containers shall contain the required markings, except no markings are required if the container is transparent and the marking on the media itself is clearly visible.

d. Classified documents and material, including those in electronic form, that also contain FOUO information shall be marked in accordance with Volume 2 of DoD Maunal 5200.01, with FOUO information identified as follows:

(1) Overall markings on the document shall follow the guidance in Volume 2 of DoD Maunal 5200.01. No additional special markings are required on the face of the document because it contains FOUO information.

(2) Pages of the document that contain classified information shall be marked in accordance with Volume 2 of this Manual. Pages that contain FOUO information but no classified information shall be marked “UNCLASSIFIED//FOR OFFICIAL USE ONLY” or “UNCLASSIFIED//FOUO” at the top and bottom if the overall document classification is not used as the page marking.

(3) Portions of the document shall be marked with their classification in accordance with Volume 2 of this Manual. If there are unclassified portions that contain FOUO information, use the parenthetical notation “(U//FOUO)” at the beginning of the portion. If a portion of a classified document contains both classified and FOUO information, the appropriate classification designation is sufficient to protect the information, and no additional marking shall be used to designate the FOUO content.

(4) Each portion of electronically transmitted classified messages, including e-mail, containing FOUO information shall be marked appropriately.

e. FOUO information disseminated outside the Department of Defense shall also bear a marking on the outside of the front cover, first page, or at the beginning of the text that states that the information may be exempt from mandatory disclosure in accordance with the FOIA. A statement similar to “This document contains information that may be exempt from mandatory disclosure under the Freedom of Information Act” is sufficient. A FOIA exemption number shall NOT be applied.

3. ACCESS TO FOUO INFORMATION:

a. No person may have access to information designated as FOUO unless that person has been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose.

b. The final responsibility for determining whether an individual has a valid need for access to information designated as FOUO rests with the individual who has authorized possession, knowledge, or control of the information, not with the prospective recipient.

c. Information designated as FOUO may be disseminated within the DoD Components and between officials of DoD Components and DoD contractors, consultants, and grantees to conduct official business for the Department of Defense, provided that dissemination is consistent with any further controls imposed by a distribution statement.

4. PROTECTION OF FOUO INFORMATION: During working hours, reasonable steps shall be taken to minimize the risk of access by unauthorized personnel (e.g., not reading, discussing, or leaving FOUO information unattended where unauthorized personnel are present). After working hours, FOUO information may be stored in unlocked containers, desks, or cabinets if Government or Government-contract building security is provided. If such building security is not provided or is deemed inadequate, the information shall be stored in locked desks, file cabinets, bookcases, locked rooms, etc.

5. TRANSMISSION: FOUO information and material may be transmitted via first class mail, parcel post, or, for bulk shipments, via fourth class mail. Whenever practical, electronic transmission of FOUO information (e.g., data, website, or e-mail) shall be by approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure (PKI) or transport layer security (e.g., https). Use of wireless telephones should be avoided when other options are available. Transmission of FOUO by facsimile machine (fax) is permitted;

the sender is responsible for determining that appropriate protection will be available at the receiving location prior to transmission (e.g., machine attended by a person authorized to receive FOUO; fax located in a controlled government environment).

6. DISPOSITION: Record copies of FOUO documents shall be disposed of according to provisions of chapter 33 of title 44, U.S.C. and the DoD Component records management directives. Non-record FOUO documents may be destroyed by any of the means approved for the destruction of classified information or by any other means that would make it difficult to recognize or reconstruct the information. The originator or other competent authority (e.g., initial FOIA denial and appellate authorities) shall terminate the FOUO status of specific information when circumstances indicate that the information no longer requires protection from public disclosure. When the FOUO status of information is terminated in this manner, all known holders shall be notified, to the extent practical. Upon notification, holders shall efface or remove the FOUO markings, but records in file or storage need not be retrieved solely for that purpose. Information whose FOUO status has been terminated shall not be released to the public without the review and approval.

7. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of "For Official Use Only" information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions and disciplinary action may be taken against those responsible.

Ref 11l.

OTHER SECURITY REQUIREMENTS

Facility Security Officer In accordance with DoD 5220.22-M, National Industrial Security Program Operating Manual, the contractor shall appoint an individual to serve as the Facility Security Officer who is required to possess a security clearance as part of the Facility (Security) Clearance (FCL). The Facility Security Officer shall supervise and direct security measures for the application of Government-furnished guidance and specifications for classification, downgrading, upgrading, safeguarding of classified information as well as processing security clearance investigation packets and investigations for computer network access for contract personnel. The name of the person proposed to be authorized to perform this task shall be submitted in writing to the Contracting Officer no later than 5 days after the phase-in start date, no later than 1 GBD after appointment, and no less than 30 calendar days prior to any proposed change.

Security Program

The contractor’s site-specific Physical Security Plan, Information Security Plan, Information Systems Security Plan, and Key Control Plan shall form the basis of the contractor’s Security Program. The plans shall describe how the contractor will prevent unauthorized access, vandalism, pilferage, larceny, sabotage and fire and to provide internal safeguards for the security of all Government property and for the control of classified information, including personnel security requirements related to handling and accessing classified information. The plans shall be submitted to the Contracting Officer and the COR for approval no later than 60 days after performance start date and no less than 30 calendar days prior to any proposed change.

Physical Security Plan This plan shall address physical security aspects associated with contract performance security and for Government-furnished facilities. The contractor shall maintain an active security checklist for each facility, as required. The plan shall comply with the provisions of AR 190-11, AR 190-13, AR 190-51, DOD 5100.76(D), and the Fort McCoy Installation Physical Security Plan. The contractor shall be subject to unannounced physical security inspections by Government personnel

Information Security Plan The contractor’s information security plan shall provide for control of handling and accessing classified information, computer security and communications security. The plan shall comply with DOD 5220.22-M, ARs 380-5, 380-67, 380-40 and 530-1.

Information Systems Security Plan The contractor’s information systems security plan shall establish security procedures for all computer systems and communications utilized in the performance of this PWS. The plan shall conform to AR 25-2 and AR 380-67.

Key Control Plan The contractor shall establish, implement, and maintain a site-specific Key Control Plan that delineates the processes and procedures the contractor shall use to ensure accountability of keys to ensure the security and safekeeping of Government equipment, materials, supplies, facilities, and vehicles assigned to the contractor. The contractor shall provide to the Contracting Officer and COR appointment letters designating a Key Control Custodian and alternate(s) no later than 3 GBDs prior to the last day of phase-in and no later than 1 GBD after any change.

The Key Control Plan shall provide for Government access, 24 hours a day, 7 days a week, to all Government-furnished facilities. The plan shall comply with AR 190-11, AR 190-13, AR 190-51 and AR 380-5 if classified materials are stored. Key control applies to both physical keys and electronic key access. Security and storage of electronic key codes shall comply with AR 380-5.

Access and General Protection/Security Policy and Procedures The contractor and all associated subcontractors’ employees shall comply with applicable installation access, physical, personnel, and information security policy and procedures. All contractor personnel with long term (over 60 days) access to facilities, IT systems, or sensitive information must undergo an OPM background investigation commensurate with the designated risk level associated with the duties of each position. At a minimum, a National Agency Check with Inquiry (NACI) will be required. The contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA, and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes. The Government will require monthly participation in the Installation Random Antiterrorism Program.

Personnel occupying positions not requiring a security clearance must have, as a minimum, a favorable suitability determination of a National Agency Check with Inquires (NACI) prior to performing work under the contract. The NACI investigation is performed by the Office of Personnel Management (OPM) for the Government. The Contractor will coordinate with the Installation Security Office which will be responsible for: initiating the NACI through the Personnel Security Investigation Portal (PSIP); reviewing NACI upon submission by PSIP to OPM. For an initial suitability determination, providing notification to the contractor POC of the initial suitability determination results; conducting the final suitability determination of the investigation upon return of the NACI from OPM; providing notification to the contractor POC of the final suitability determination results. Personnel with outstanding felony warrants or felony convictions pose a security risk and shall not perform services under this contract for those functional positions related to the conviction. Processing of a NACI, initiation through submission to OPM by PSIP, can take up to two weeks. Contractor personnel shall not perform any work under the contract or be issued contractor or Government identification media until the initial favorable suitability determination of the NACI is completed by the Installation Security Office.

For individuals designated for unaccompanied access to arms vaults, the contractor shall complete the Command Oriented Arms, Ammunition, and Explosives (AA&E) Security Screening and Evaluation Record, DA Form 7281, IAW AR 190-11 and must have the form available upon inspection by the Government.

Restricted Areas The contractor shall comply with security access requirements to restricted areas that include, but are not limited to, the communication center, ammunition storage area, arms vaults, small arms repair facility, and computer centers.

Work in restricted areas shall be cleared by the contractor with the Government’s Security Officer for that area. A list of Government security points of contact will be furnished to the contractor prior to contract start.

Access to Government Information Systems All contractors with access to government information technology systems must registered in the ATCTS (Army Training Certification Tracking System) at commencement of services and must successfully complete the DoD Information Assurance Awareness training prior to access and then annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoD 8570.01, DoD 8570.01M and AR 25-2 within 6 months of employment. All contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01M must be completed upon contract start date. This is an annual requirement. Submit training certificates to the COR, Contracting Officer, and the Network Enterprise Center no later than 1 GBD after completion.

Security Clearances The contractor shall obtain, at the contractor’s expense, and maintain all required contractor personnel security clearances, or interim clearances when authorized, throughout the period of performance as specified in the DD Form 254, Department of Defense (DoD) Contract Security Classification Specification. SECRET level security clearances shall be obtained by completion of SF 86 (Questionnaire for National Security Positions), then forwarding them to the servicing Defense Security Service representative. The security clearance requests shall be submitted IAW DoD 5200.2-R Department of Defense Personnel Security Program, DODI 5220.22 National Industrial Security Program (NISP); and DOD 5220.22-M, DoD National Industrial Security Program Operating Manual (NISPOM). All personnel shall have the required security clearance prior to assignment to a position requiring a clearance.

Handling or Access to Classified Information The contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with (1) the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22- M), and (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor.

AT Level I Training All contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas shall complete AT Level I awareness training no later than 30 calendar days after contract performance start date. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR, Contracting Officer, and Anti-Terrorism Officer (ATO) no later than 60 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at http://www.at-awareness.org/. AT Level 1 Training can also be coordinated with the Directorate of Plans, Training, Security, and Mobilization (DPTMS) ATO. This is an annual requirement.

iWATCH Training The contractor and all associated subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed no later than 30 calendar days of contract performance start date and no later than 30 calendar days of new employees’ commencing performance, with the results reported to the COR no later than 60 calendar http://www.at-awareness.org/ days after contract performance start date or new employee training date. This is an annual requirement. Submit training rosters to the COR, Contracting Officer, and ATO no later than 60 calendar days after contract performance start date or new employee training date.

Operational Security (OPSEC) Training Per AR 530-1 all contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas shall complete OPSEC Level I training no later than 30 calendar days after contract performance start date. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR no later than 60 calendar days after completion of training by all employees and subcontractor personnel. Training is available at http://cdsetrain.dtic.mil/opsec or by contacting the DPTMS Installation OPSEC officer. Submit training rosters to the COR, Contracting Officer, and OPSEC Officer no later than 60 calendar days after completion of training.

Marking Proprietary Information All records, files, reports and data deemed proprietary by the contractor shall be clearly marked accordingly. The Contracting Officer makes final determination of the appropriateness of proprietary claims by the contractor.

Identification of Employees Employees shall be distinctly identifiable as contractor employees rather than Government officials. Contractor personnel shall identify themselves as contractor employees (for example, John Doe, ABC Corp) when using Government telephones. Contractor employees shall include a signature block on all e-mail messages that includes his/her name, title, company name, and contact information (e-mail address and telephone number). When attending Government meetings contractor personnel shall clearly identify themselves as contractor personnel by introducing themselves as contractor personnel and displaying their contractor identification badge.

Communication Services The Government will provide the contractor limited access to the existing Installation Local Area Network (LAN).

The contractor shall comply with established Army and Installation policies regarding system security and access to ensure personnel use available systems and software for official use only. The contractor shall monitor internet access to ensure that usage is not excessive or that contractor personnel are not accessing areas that are not required for performance of the mission. Government-furnished computers are subject to security monitoring at all times.

The contractor shall not install software or connect any hardware to the LAN without approval from the COR and the NEC. The Government shall provide all required automation equipment, to include but not limited to personal computers, printers, and scanners. Official voice, voice mail, and facsimile services will be provided to the contractor IAW AR 25-1 via telephone instruments located in the Government facilities at time of contract commencement and shall be used for OFFICIAL USE ONLY. The contractor shall ensure that classified information is not discussed on unsecured telephones.

http://cdsetrain.dtic.mil/opsec

DD FORM 254 CONTINUATION