TE_8_-_Addendum_to_DD_254_for_CBP.pdf

ATTACHMENT ONE

ADDENDUM TO DD 254

ITEM # 13 (CONTINUED), SECURITY GUIDANCE

8a: ACTUAL PERFORMANCE:

U.S. Army Human Resources Command Timothy Maude HR Center of Excellence 1600 Spearhead Division Ave Fort Knox, KY 40122

10j: FOR OFFICIAL USE ONLY (FOUO) INFORMATION: FOUO Information provided under this contract shall be safeguarded as specified in DoD 5400.7-R, “Protecting For Official USE Only (FOUO) Information.”

Also, see attached instructions on “For Official Use Only (FOUO) Information.”

10k: OTHER: Designated Restricted Area. Access will be controlled and only authorized personnel will be allowed to enter. The contractor will not allow access to anyone outside the execution of the defined contract requirements and without the guidance and written permission of the KO.

11a: HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTORS FACILITY OR GOVERNMENT ACTIVITY: This means that the contractor does not require “Safeguarding” capability at its facility and there will be no access to Classified National Security Information (CNSI) at the contractor’s facility.

11e: PERFORM SERVICES ONLY: The contractor will provide the following technical support to the Client:

Technical support for HRC systems.

11j: HAVE OPERATION SECURITY (OPSEC) REQUIREMENTS: OPSEC is a structured process that identifies critical information, analyzes friendly actions, integrates threat analysis and risk assessments, then helps personnel apply protective measures to mitigate unacceptable risk. Organizations and personnel supporting HRC may have OPSEC requirements associated with their activities and support.

The contractor will comply HRC OPSEC Program. The basis for the on-site contractor OPSEC program is the HRC Security Office program. The agency/POC is the Government facility OPSEC point of contact.

OPSEC requirements apply. The contractor must comply with special OPSEC requirements contained in the contract or addendum thereto. The following standard expectations are included in all work.

a. The contractor supporting specific event-oriented activities will develop OPSEC Plans/Annexes when directed by the supported program, or comply with the program's OPSEC Plan/Annex.

b. Personnel assigned will receive OPSEC Awareness Education and Duty-Related Training as deemed necessary by the Government or program supported.

c. OPSEC Awareness Education and Training will be provided or coordinated through government channels.

OTHER:

HSPD-12: The contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directives-12 (HSPD-12), Office of Management and Budget (OMB) Guidance M-05-24, Federal Information Processing Standards Publication (FIPS PUB) number 201) and GSA HSPD-12, Standard Operating Procedure (SOP), Personnel Security Process, dated November 18, 2005.

POSITION SENSITIVITY: In accordance with DOD 5200.2-R, the DoD Personnel Security Program, this contract requires personnel performing work on a sensitive AIS to be: 1) a US Citizen, and 2) assigned to positions which are designated at one of 3 sensitivity levels (IT –I, IT – II, or IT – III). These designations equate to Critical Sensitive and Non-Critical Sensitive positions. The Contractor will ensure individuals assigned to these sensitive positions have completed the appropriate access requests forms.

• IT – Level I – Individuals assigned to positions where damage to DoD networks and development systems can be accomplished and no checks are in place to determine potential destruction of sensitive information. The investigation requirement for these positions is completion of Tier 5 investigation (formerly SSBI) with favorable results.

• IT Level – II – Individuals assigned to positions where daily unsupervised access to DoD networks and information systems containing Sensitive but Unclassified or Sensitive Classified up to and including Collateral Secret information is part of their duties. The Investigation requirement for these positions is completion of a Tier 3 investigation (formerly NACLC) with favorable results.

• IT Level – III – Individuals assigned to non-sensitive positions where daily unsupervised access to DoD networks and information systems containing Sensitive but Unclassified is part of their duties. The Investigation requirement for these positions is completion of a Tier 1 investigation (formerly NACI) with favorable results.

• These positions require that investigations be completed prior to assigning individuals to a position of trust. A US Citizen that has a Tier 3 investigation in process and a successful local records check, can be allowed assignment to the positions before the completion of the investigation, in the best interest of the DoD, at the discretion of the Contracting Officer. In those instances, an interim clearance must be granted for positions requiring access to classified information.

• The government retains the right to request removal of contract personnel, regardless of prior clearance or adjudication status, whose actions clearly conflict with the interest of the Government. The reason for removal will be fully documented in writing by the Contracting Officer. When and if such removal occurs, the Contractor will, within 30 working days, assign qualified personnel to any vacancies thus created.

• Where access to classified information is necessary in the performance of the duties called for under this contract, the guidance contained in the DoD 5200.2-R apply. A determination of eligibility for access to classified information or assignment to sensitive duties is a discretionary security decision based on judgments by appropriately trained adjudicative personnel.

ATTACHMENT TWO

ADDENDUM TO DD 254

FOR OFFICIAL USE ONLY (FOUO)

The DD Form 254, block 10J is marked YES (For Official Use Only Information (FOUO]), therefore, the contractor must comply with the following FOUO handling instructions.

1. GENERAL: The following FOUO instructions comply with guidance provided in NSTISSI 4002;

and the Privacy Act; and the Freedom of Information Act.

a. The FOUO marking is assigned to information at the time of its creation in a DOD Agency.

It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act.

b. Use of the FOUO marking does not mean that the information cannot be released to the public, only that the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it must review it.

2. IDENTIFICATION MARKINGS:

a. An unclassified document containing FOUO Information will be marked “For Official Use Only” at the bottom of the front cover (if any), on the first page, on each page containing FOUO information but no classified information, the portion will be marked, “FOUO.”

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked, “FOUO.”

c. Any “For Official Use Only” information released to a contractor by a DOD User Agency is required to be marked with the following statement prior to transfer:

This document contains information EXEMPT FROM MANDATORY DISCLOSURE under the FOIA. Exemptions 2 – 9 apply.

d. The originator or other competent authority can only accomplish removal of the “For Official Use Only” marking. When the “For Official Use Only” status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: Contractors may disseminate “For Official Use Only” information to their employees and subcontractors who have a need for the information in connection with a classified contract.

4. STORAGE: During working hours, “For Official Use Only” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information.

During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desk is adequate when internal building security is provided during non-working hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: “For Official Use Only” information may be sent via first –class mail or parcel post. Bulky shipments may be sent by fourth-class mail.

6. DISPOSITION: When no longer needed, FOUO information may be disposed of by shredding or tearing each copy into pieces to preclude reconstructing, and placing it in a regular trash container or as directed by the User Agency.

7. UNAUTHORIZED DISCLOSURE: The unauthorized disclosure of “For Official Use Only” information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions.