Attach_0002_-_DD254_(12_Jun_18).pdf

NIPR, SIPR, JWICS

See continuation page.

13. SECURITY GUIDANCE. (CON’T.)

Solicitation or Contract # Page #

DD FORM 254 (13 CON’T.), MAY 2010

Ref 10b: Restricted Data Information is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting.

Ref 10d: The contractor is permitted access to Formerly Restricted Data (FRD) in the performance of this contract. Access to FRD requires a final U.S. Government clearance at the appropriate level. Written concurrence of the KO is required prior to subcontracting.

Ref 10e(1): SCI Access required. No public release of information authorized, public disclosure or confirmation of any subject related to the support contract is not authorized without first obtaining written approval from the KO.

Ref 10e(2): Non-SCI Information is not releasable to contractor employees who have not received a clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting. Access to Intelligence information required for performance.

Ref 10f: Discussion, storage, or processing of SAP information associated with this contract will be conducted in facilities specifically accredited by the Army SAPCO (or designee), or equivalent component-level SAPCO. Contact the appropriate servicing SAPCO for approved SAP facilities locations. SAP activities are governed by Revision 1 Department of Defense Overprint to the National Industrial Security Program Operating Manual Supplement, 1 APR 04, and applicable program security classification and procedures guides. Component-managed SAPFs and SAP Temporary Secure Working Areas (TSWA) are governed by JAFAN 6/9. Access to SAP information requires employees undergo additional personnel security screening and meet the SAP access standards delineated in the applicable DoD directives and policies. SAP inspections and security oversight while in component facilities are under the cognizance of the SAPCO, as appropriate. Additional SAP security requirements may apply at alternate locations/facilities based on service/component Command requirements. The KO for these locations/facilities will provide specific guidance as required.

SAP inspections conducted at contractor facilities are under the security oversight of the Defense Security Service (DSS) unless officially relieved of their oversight responsibilities.

Ref 10g: Personnel not assigned to a NATO staff position, but requiring access to NATO classified information, NATO COSMIC, NATO Secret or access to the NATO accredited SIPRNET terminals, must possess the equivalent FINAL or Interim U.S. Security Clearance based upon the appropriate personnel security investigation required. Personnel with access to NATO ATOMAL information must have the appropriate level FINAL U.S. Security Clearance. The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees are NATO briefed prior to access being granted. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM Ch 10, Section 7.

Prior approval from the KO is required for subcontracting.

Note: If the contractor does not require access to NATO information, requires access to the SIPRNET, mark 10g “No” but mark 10k “Yes” (SIPRNET access) and add the statement below in item 13 that the contractor requires access to the SIPRNET and a NATO awareness brief is required. The SIPRNET contains NATO information and a NATO awareness briefing is required for everyone who needs access to the SIPRNET. The purpose of providing a NATO awareness briefing is to inform personnel how to protect NATO information in the event they come across it while on the SIPRNET. See 10k below for additional information.

Ref 10h: Foreign Government Information (FGI) is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting.

Ref 10j: For Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoD 5200.1-R, Appendix 3 (attached).

Ref 11c: The contractor requires access to classified source data up to and including Top Secret, Secret, Confidential in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, paragraph 4-208a, and the use of a bibliography.

Ref 11j: The COR/CM/KO will ensure the contractors with security clearance comply with threat awareness and requirements specific in AR 381-12, para 1-14. Contractors will report threat-related incidents, behavioral indicators, and other matters of CI interest to their FSO (Facility Security Officer) the nearest military CI office, the Federal Bureau of Investigation (FBI) or the Defense Security Service (DSS)."

Ref 11i: TARP Training is required. The COR/CM/KO will ensure the contractors with security clearance comply with threat awareness and requirements specific in AR 381-12, para 1-14. Contractors will report threat-related incidents, behavioral indicators, and other matters of CI interest to their FSO (Facility Security Officer), the nearest military CI office, the Federal Bureau of Investigation (FBI) or the Defense Security Service.

Program Security Manager, Cassius N. Hall________________________________

Contract Number: _______________

US ARMY SCI ADDENDUM TO DD FORM 254

XXX (1) This contract requires access to Sensitive Compartmented Information (SCI). The Commander, US Army Intelligence and Security Command (INSCOM), acting on behalf of the DA Deputy Chief of Staff (DCS), G-2 as the Cognizant Security Authority (CSA) for the US Army, has exclusive security responsibility for all SCI released to the contractor or developed under the contract and held within the Contractor's SCI Facility (SCIF) or Co-utilization Agreement (CUA) SCIF. The Defense Intelligence Agency (DIA) has security inspection responsibility for SCI and the Defense Security Service (DSS) retains responsibility for all collateral information released or developed under the contract and held within the DoD Contractor's SCIF. The manuals, regulations and directives checked below provide the necessary guidance for physical, personnel, and information security for safeguarding SCI, and are part of the security classification specification for this contract:

XXX DoD 5105.21, SCI Security Manual, Administrative Security Signals Intelligence Security Regulations (SISR) (Available from the CM)

Imagery Policy Series (Available from the CM) XXX ICD 703, Protecting Sensitive Compartmented Information Source and Materials.

XXX ICD 705, Sensitive Compartmented Information Facilities _____ICS 705-1, Protecting Physical and Technical Sensitive Compartmented Information within Information Systems

AR 25-2, Information Assurance AR 380-28, DA Special Security System

XXX AR 380-381, Special Access Programs (SAPS).

Army Handbook for SCI Contracts.

XXX Other: ICS 705-1, Physical and Technical Security Standards for Sensitive Compartmented Information Facilities.

XXX (2) Contract estimated completion date: _29 September 2016_ (NOTE: Section “F” of the contract normally provides the Period of Performance. Option years are not to be included, as an option is not valid until exercised by the government.)

XXX (3) The name, telephone number, email address and mailing address of the Contract Monitor (CM) for the SCI portion of this contract is: William T. Connor, 301-677-6661, william.t.connor10.civ@mail.mil, 902nd MI GP 2600 Ernie Pyle, Fort Meade MD 20755. The name, telephone number, email address, and mailing address of the contractor’s Security POC

XXX (4) All DD Forms 254 prepared for subcontracts involving access to SCI under this contract must be forwarded to the CM for approval and then to HQ INSCOM, ACofS, G2, Contractor Support Element (CSE) for review and concurrence prior to award of the subcontract.

XXX (5) The contractor will submit the request for SCI visit certifications through the CM for approval of the visit. The certification request must arrive at the Contractor Support Element at least ten (10) working days prior to the visit.

XXX (6) The contractor will not reproduce any SCI related material without prior written permission of the CM.

mailto:william.t.connor10.civ@mail.mil

(7) Security Classification Guides or extracts are attached or will be provided under separate cover.

(8) Electronic processing of SCI requires accreditation of the equipment in accordance with DCID 6/3, and AR 25-2 (Note: Check only if item 11l indicates that a requirement exists for SCI IS processing.)

(9) This contract requires a contractor SCIF.

XXX (10) This contract requires (SI) (TK) (G) (HCS) (Add others as required)

XXX (11) The contractor will perform SCI work under this contract at the following locations: Fort George G Meade MD 20755

FOUO ADDENDUM

SAFEGUARDING “FOR OFFICIAL USE ONLY” (FOUO)

INFORMATION

1. The “FOR OFFICIAL USE ONLY” marking is assigned to information at the time of its creation in a DOD User Agency. It is not authorized as a substitute for a security classification marking but it is used on official Government Information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act.

2. Other non-security markings such as “Limited Official Use” and “Official Use Only” are used by non-DOD User Agencies for the same type of information and should be safeguarded and handled in accordance with instructions received from such agencies.

3. Use of the above markings does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release, to determine whether a significant and legitimate Government purpose is served by withholding the information or portions of it.

4. IDENTIFICATION MARKINGS:

a. An unclassified document containing FOUO information shall be marked “UNCLASSIFIED//FOR OFFICIAL USE ONLY” in bold letters at least 3/16 of an inch high at the top and bottom of the front cover (if any), on each page, and on the outside of the back cover (if any). No portion marking will be shown.

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked “U//FOUO”.

c. Any “FOR OFFICIAL USE ONLY” information released to a contractor by a DOD User Agency is required to be marked with the following statement prior to transfer:

THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY DISCLOSURE

UNDER THE FOIA. EXEMPTIONS APPLY.

d. Removal of the “FOR OFFICIAL USE ONLY” marking can only be accomplished by the originator or other competent authority. When “FOR OFFICIAL USE ONLY” status is terminated, all known holders will be notified to the extent possible.

5. DISSEMINATION: Contractors may disseminate “FOR OFFICIAL USE ONLY” information to their employees and subcontractors who have a need for the information in connection with a classified contract.

6. STORAGE: During normal working hours “FOR OFFICIAL USE ONLY” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks is adequate when internal building security is provided during non-working hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after hours protection or the material can be stored in locked receptacles such as file cabinets, desks or bookcases.

7. TRANSMISSION: “FOR OFFICIAL USE ONLY” information may be sent via first-class mail or parcel post. Bulky shipments may be sent fourth-class mail. Electronic transmission of FOUO information by voice, data, facsimile or similar means, should be by approved secure communications systems when possible.

8. DISPOSITION: When no longer needed, FOUO information may be disposed of by tearing each copy into pieces to preclude reconstructing, and placing it in a trash container or as directed by the User Agency.

9. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of “FOR OFFICIAL USE ONLY” information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions.

INSTRUCTIONS FOR THE US ARMY SCI ADDENDUM TO DD FORM 254

General: This section contains specific instructions for preparation of the “SCI Addendum," used in conjunction with the DD Form 254, for all Army SCI contracts and their related SCI subcontracts.

a. The SCI addendum is designed for use with the DD Form 254 on all Army SCI contractual efforts and their related subcontracts. The User Agency and the appointed CM are responsible for coordinating with HQ INSCOM, ACofS Security, G2, Contractor Support Element (CSE) for developing and incorporating the SCI addendum with an appropriate DD Form 254 for the prime contract.

b. Based on the guidance provided in the DD Form 254 and SCI addendum for the prime contract, the contractor (prime) is responsible for coordinating with the CM and the CSE for developing and incorporating the SCI addendum with an appropriate DD Form 254 for all related subcontracts.

This document must be executed and accompany all DD Forms 254 issued for Request for BID (RFB), Request for Proposal (RFP), Request for Quotation (RFQ), etc., and forwarded with the DD Form 254 to the CSE prior to award of an Army SCI contract. Those items that are pre “X’d ” apply to all Army SCI contracts/subcontracts.

Item 1: Regulations listed that are not marked, are to be marked with an “X “when they apply.

Imagery Policy Series (Available from the CM): Applies when the contract/subcontract requires TK level SCI (i.e. access, documents etc.,)

DCID 6/9, Physical Security Standards for Sensitive Compartmented Information Facilities. Required when the contractor is authorized a Sensitive Compartmented Information Facility (SCIF).

DCID 6/3, Protecting Sensitive Compartmented Information within Information Systems, applies when AIS processing is involved.

DIAM 50-4, Security of Compartmented Computer Operations: Applies when the contract/subcontract requires the contractor to process SCI electronically utilizing computer equipment within an accredited SCIF. (See item 11l of the DD Form 254.)

DIAM 50-24, Security for Using Communication Equipment in a SCIF: Applies when and if a contractor/subcontractor intends the use of a modem connected to an unencrypted black telephone line and/or the use of secure telephone unit data port within an accredited SCIF.

AR 25-2, Information Assurance: Applies when item 11l of the DD Form 254 is marked yes.

AR 380-381, Special Access Programs (SAPS): Applies when item 10f of the DD Form 254 is marked yes.

Item 2: An estimated completion date must be annotated. Do not include proposed option years. An option is not official until it is exercised by the government.

Item 3: The name, official organization address, email address and telephone number of the designated Contract Monitor (CM) by the User Agency (contracting agency/office). NOTE: The CM designated must be either military or a DA civilian, who possess the appropriate SCI access to the levels required by the contract. Further, the CM for the prime contract is always the CM for all related subcontracts. Additionally, in this item, identify the Security POC, with telephone number and email address, at the company to be awarded the contract/subcontract.

Item 4: When a subcontract for a portion of the SCI contract is to be authorized, prior to award of the subcontract, the prime contractor must execute and forward a DD Form 254 for the proposed subcontract through the prime contract CM, for his/her approval, to the CSE for concurrence.

Item 5: Cites requirement for SCI visit certifications.

Item 6: Identifies the requirement for prior written authority to reproduce SCI and all related material.

Item 7: Identifies whether or not classification guide(s) or extract(s) exist for this specific contract and how they are to be obtained by the contractor.

Item 8: Cites the requirement to have an accreditation of all electronic processing equipment prior to the processing SCI by the contractor.

Item 9: Identifies the requirement for the contractor to have their own accredited SCIF or co-utilized SCIF to execute the SCI portion of the contract.

Item 10: Cites the accesses required for execution of the contract, mark what accesses are required for performance on the contract/subcontract. Further, allows the option of citing an estimated number of accesses required

Item 11: Requires identification, in addition to Item 8 of the DD Form 254, of any additional locations where SCI work for this specific contract will be conducted.

14428 Albemarle Point Place Suite-140 Chantilly, VA 20151

2600 Ernie Pyle Ft. Meade, MD20755

Fort George G. Meade, MD 20755