I-B-7_Attachment_0005_DD254_and__Attachments_for_Solicitation,_Signed.pdf

Solicitation Number: W9124J-16-R-0044

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED Secret

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYYYMMDD)

20160225

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs) Revision No.

Date (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYYYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYYYMMDD)

W9124J-16-R-0044

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code) To be determined upon contract award.

To be determined upon contract award.

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code) Central Command (CENTCOM) Area of Responsibility (AOR) Multiple locations - see Item 13

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

This DD Form 254 Is Prepared Solely “FOR PLANNING PURPOSES ONLY,” and Shall Not Be Used For Contract Award.

(IAW DoD 5220.22-R, paragraph 7-102.a. and c.; and compliance with the Federal Acquisition Regulation Part 4, 4.403;.)

This is a personal services contract to perform Acquisition Services, Information Technology Services, and Property Administration Support throughout the Central Command (CENTCOM) Area of Responsibility (AOR). The contractor shall provide five (5) different labor categories: Contract Specialist, Procurement Technician, Procurement Analyst, Information Technology Specialist, and Industrial Property Management Specialist. The base period of performance for this contract will be for 12 months and will include a 60-day mobilization period if awarded to a non-incumbent Contractor. The contract also includes two 12-month option periods. The total term of the contract shall not exceed a total of 3 years. The last 12 month option period shall include a 30-day demobilization period.

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify). For OPSEC Requirements, see Item 13.

k. OTHER Specify) IA Computer Requirements: Use of Government-owned Computers only within the CENTCOM AOR.

IA Position Requirements: IT-II / IT-III Positions.

IA Network Requirements: Access to NIPRNet / SIPRNet / CENTRIX Systems only within the CENTCOM AOR.

IA Training & Certification: Contractors having a requirement to be involved with the operation and/or management (i.e., “privileged users, specialty positions, and IA Managers”) of IA capabilities for DoD systems and networks is required to obtain IA Army Training & Certification IAW DoD policy (DoDD 8570.1-M, Change 1).

A NATO Awareness Briefing is required (see Item 13).

DD Form 254, DEC 1999 Previous editions are obsolete

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct

Through (Specify):

The Requiring Activity (RA) Contract Point of Contact (POC) is responsible to forward the contractor’s request for public release of information relating to Army classified contracts or programs through their security office (G-2/S-2/Security Manager/Security Monitor) to their Public Affairs (PA) Office (PAO). The PAO processes the request in accordance with AR 360-1, The Army Public Affairs Program. The contractor is responsible for obtaining the approval of the KO prior to release of any information received or generated under the contract. The KO should complete this item as required by internal agency directives to direct the prime contractor to the appropriate office that has public release authority. Prime contractors should refer their subcontractors to the KO that was referenced in the prime contract DD Form 254. Information requiring Headquarters (HQ) Department of the Army (DA) or Department of Defense (DoD) level review is forwarded by entry-level public affairs office to the HQDA, Office of the Chief of Public Affairs (OCPA), 1500 Army Pentagon, Washington, DC 20310-1500. The OCPA forwards the request, as required, to the Directorate for Freedom of Information and Security Review, Washington Headquarters Service, Department of Defense, Pentagon, Washington DC 20601-1400.

To the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* (Office of Freedom of Information; 1155 Defense Pentagon, Room 2C757; Washington, DC 20301-1155) for review. * In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

ATTACHMENT # 1, (continuation sheet) for “Additional Guidance/Requirements.”

ATTACHMENT # 2 “Protecting "Controlled Unclassified Information" (CUI) Information.

ATTACHMENT # 3 “Contractor Visits To HQ Army Contracting Command (ACC) (ACC Subordinate Organization(s)) (Government) Locations/Facilities.”

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No

ATTACHMENT # 1, (continuation sheet) for “Additional Guidance/Requirements.”

ATTACHMENT # 2 Protecting "FOR OFFICIAL USE ONLY" (FOUO) Information.

ATTACHMENT # 3 “Contractor Visits To HQ ACC (ACC Subordinate Organization(s)) (Government) Locations/Facilities.”

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed. Yes No

(Ref Item 8.a. and 13) For Classified Contracts: Defense Security Service (DSS) is relieved of all Industrial Security review/inspection responsibility for all classified materials/contract performance at Government Owned and Government Operated (GOGO) Facilities/Locations identified in the Contract Requirements Document (PWS/SOW) and Items 8.a. & 13.

• The HQ ACC G-2/Command ISS is responsible for the Industrial Security Program (ISP) at all ACC GOGO Location(s)/Facility(ies) identified in the

Contract Requirements Document and DD254 (Items 8 & 13). They shall provide Cognizant Security Oversight (CSO) over all ISP issues, matters, and concerns for this contract, and shall assume responsibility for the:

o Administration of the ISP on behalf of the Cognizant Security Agency IAW HQ ACC ISP; and all applicable Security Directives, Regulations, and Policies.

o Oversight of all CUI, Classified or Classified Military Information (CMI) material released to or developed under the contract.

• The RA Contract POC shall keep the HQ ACC G-2/Command ISS apprised of ALL security issues/problems noted/identified for this contract, to include

ALL Adverse Information, Self-Disclosure items, Security Infractions/Violations, etc.

• (Ref Items 8.c.) When DSS is relieved of security oversight responsibility for cleared facilities performing on Army programs, the ISS is responsible for forwarding a copy of the completed and signed DD Form 254 to the cognizant security agency, as well as any additional offices listed in block 17.

(CONTINUED)

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL Mr. Lynn E. Kirkland Date Signed: 25 February 2016

b. TITLE ACC Command ISS & Industrial Security Certifying Official as delegated by the HQ ACC DCofS, G2 IAW AR 380-49 & AFARS, Paragraph 5104.403 (22 May 07)

c. TELEPHONE (Include Area Code)

(256) 955-8528 (DSN ) 645

lynn.e.kirkland.civ@mail.mil

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

U.S. Army Contracting Command (G-2) ATTN: (AMSCC-IS) Lynn E. Kirkland 4505 Martin Road Redstone Arsenal, AL 35898-5000

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD Form 254 (BACK), DEC 1999 mailto:lynn.e.kirkland.civ@mail.mil

Department of Defense (DD) Form 254 Attachment 1 (continuation sheet)

Solicitation Number (from item 2.b.): W9124J-16-R-0044 General Identification (item 9.): This is a personal services contract to perform Acquisition Services, Information Technology Services, and Property Administration Support throughout the C. The contractor shall provide five (5) different labor categories: Contract Specialist, Procurement Technician, Procurement Analyst, Information Technology Specialist, and Industrial Property Management Specialist. The base period of performance for this contract will be for 12 months and will include a 60-day mobilization period if awarded to a non-incumbent Contractor.

The contract also includes two 12-month option periods. The total term of the contract shall not exceed a total of 3 years. The last 12 month option period shall include a 30-day demobilization period.

This Defense Department (DD) Form 254 Was Prepared Solely “For Planning Purposes Only.”

(e.g., Contract Solicitation)

It Shall NOT Be Used For Contract Award.

An Original DD Form 254 Is Required For Contract Award

(Reference Department of Defense (DoD) 5220.22-R, paragraph 7-102.a. and c;

and compliance with the Federal Acquisition Regulation (FAR) Part 4, 4.403.)

The Proposed Period of Performance For This Contract:

The Base Contract will be for 12 months and will include a 60-day mobilization period if awarded to a non-incumbent Contractor.

The contract also includes Two (2) 12-month option periods.

The total term of the contract shall not exceed a total of Three (3) years.

The last 12 month option period shall include a 30-day demobilization period.

This DD Form 254 (DD254), Contract Security Classification Specification, is based on the Contract "Requirements Document(s)" (i.e., stated in the Performance Work Statement (PWS)/Statement of Work (SOW)) being used for contract award. The information is as identified by the Requiring Activity (RA) Contract Point of Contact (POC) (to include the terms Contracting Officers’ Representative (COR)/Alternate COR (ACOR)/Government Technical Monitor (GTM)/Technical Representative (TRep)/Functional Representative (FRep)/etc.) (Hereafter referred to simply as the "RA Contract POC").

The Government Contracting Activity (GCA) has the responsibility to protect and safeguard classified information disclosed to or generated by contractors under the NISP or from visiting the cleared contractor to review the security aspects/ requirements of the contract. The GCA includes the RA, the RA Contract POC, the Contracting Officer (KO)/ contracting specialist, and the Industrial Security Specialist (ISS).

The Department of the Army (DA) Program/Project Manager and RA ISS assists the RA Contract POC with the preparation of the DD254 for each classified contract by inserting all necessary security requirements identified in the security section of the documents which define contract requirements and performance (for example, request for bid, request for proposal, PWS, or SOW) (referred to as the “contract requirements document”). The RA is responsible for the DD254. Key Personnel involved in the preparation of the DD254 are the Program/Project Manager, RA Contract POC, the RA ISS (individual certifying the DD254 for the contract), technical/subject matter expert personnel, and contracting personnel.

a. The program/project manager and ISS recognizes the security requirements that the contractor will need to follow.

b. The technical/subject matter expert personnel understand what information or equipment in the program requires protection, and the technical aspects of the requirements.

c. The KO must ensure the contractor complies with the DD254 and any special clauses into the contract.

The KO is the only person authorized to direct changes in any requirements under this contract and, notwithstanding any provisions contained elsewhere in this contract, said authority remains solely with the KO. The KO is responsible to:

a. Ensure an approved acquisition plan, which includes a security specification section, is developed by the Contracting Officer (KO) and Requiring Activity (RA), in coordination with the supporting Industrial Security Specialist (ISS), defining the security requirements and procedures for the duration of the contract, program, or project.

(AR 380-49, para 1-28.a)

b. Ensure that required security clauses are incorporated into classified contracts and solicitations as mandated in the Federal Acquisition Regulation (FAR) and its applicable supplements. (AR 380-49, para 1-28.b)

c. Ensure the contract requirements document adequately reflect the security requirements for the contracts and the ISS and/or supporting Security Manager (SM), along with the KO and Program Manager (PM), collaborate in the preparation of the DD254 and security requirement statements for the contract. (AR 380-49, para 1-28.d)

The RA Contract POC is responsible for all security issues and technical matters concerning this contract and contract performance; and to interface between the contractor, the KO, and the ACC Command ISS.

The DD254 is required to be reviewed every two years. The program/project manager and the ACC Command ISS should conduct this review in coordination with the RA security manager/monitor and the KO to ensure existing security requirements are consistent with the contract requirements.

a. If the review is performed and no changes are required:

(1) The program/project manager and ACC Command ISS will provide the KO with a copy of the review.

(2) The KO will provide written notification to the contractor that the DD254 remains valid until the next review or a change occurs in the program.

b. If the review is performed and changes are required:

(1) The program/project manager and ACC Command ISS must provide the KO with a revised DD254.

(2) The KO will then prepare a bi-lateral modification to the contract to incorporate the new DD254.

Revisions to the DD254 will be completed whenever:

a. The security guidance or pertinent information changes,

b. When a change in mission occurs impacting the contract,

c. When a contract is modified or an option year is exercised,

d. To ensure security requirements remain current and relevant throughout the contract lifecycle.

e. This includes contractor address changes if they are performing classified work at their facility.

If the RA Contract POC is no longer available (due to PCS, Deployment, retirement, etc.), the RA’s Security Manager is responsible for all security issues and matters concerning this contract and contract performance until a new COR is nominated by the RA and is appointed by the KO. It is the responsibility of the RA to ensure the continued security oversight of their contract/contract performance.

A classified contract is any contract that requires a contractor employee to fill a position that requires a security clearance, to have unescorted access (work) to an area requiring a security clearance, or to access classified information/material. All classified contracts require an original DD254 for solicitation and original DD254 for contract award.

Army Federal Acquisition Regulations Supplements (AFARS), Paragraph 5104.403 (22 May 07) and AR 380-5 (Information Security Program, 29 Sept 00, Paragraph 1-6) requires the Security Manager to certify" (sign) Item 16 of the DD254. The HQ ACC Security Manager (ACC DCofS, Intelligence/G2) delegated this responsibility to the ACC Command ISS. DD254s prepared for any classified contract awarded for HQ ACC or ACC Subordinate Organizations (to include ACC Contracting Centers, Expeditionary Contracting Command [ECC], and the Mission and Installation Contracting Command [MICC]) will require the ACC Command ISS to certify the DD254 (unless this authority has been further delegated in writing by the HQ ACC DCofS, Intelligence/G2).

The signer of the DD254 (Item 16) certifies that all “Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort” as of the signing of this document. Any changes made to the contract/contract documents (i.e., contract modification, or exercising an OPTION) without the certifier’s knowledge and approval shall invalidate this certification.

Once invalid, the RA Contract POC/KO becomes responsible/culpable for failing to provide adequate Security Guidance/ Requirements for the classified contract.

The RA ISS will initiate/report any security incident/violation for failure to provide adequate/current safeguards for the protection of Personally Identifiable Information (PII)/For Official Use Only (FOUO)/Controlled Unclassified Information (CUI)/classified/Classified Military Information (CMI) entrusted to member of industry. This could result in the loss of an individual’s security clearance.

Department of Defense (DoD) 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), paragraph 4-103 states the Government Contracting Activity (GCA) is an element of an agency designated by the agency head and delegated broad authority regarding acquisition functions.

“The GCA is responsible for incorporating appropriate security requirements clauses in a classified contract, Invitation for Bid (IFB), Request for Proposal (RFP), Request for Quotation (RFQ), or other solicitation, and for providing the contractor with the security classification guidance needed during the performance of the contract. The Contract Security Classification Specification (DD254) provides this guidance to the contractor. The Contract Security Classification Specification must identify the specific elements of classified information involved in the contract that require security protection.”

“The GCA is required to review the existing guidance periodically during the performance stages of the contract and to issue a revised Contract Security Classification Specification when a change occurs to the existing guidance or when additional security classification guidance is needed by the contractor.”

If the RA Contract POC has any questions concerning the “security requirements” certification; ACC’s implementation of DoD 5220.22, National Industrial Security Program (NISP), Industrial Security regulations, policies, and procedures; or Classified Contracts (as defined by DoD 5220.22-R, Industrial Security Regulation (ISR) and the NISPOM)), please contact the HQ ACC Command ISS for assistance and guidance. The RA is the responsible to ensure these required actions are accomplished.

The contractor will report any failure to comply with the Security Guidance/Requirements identified in the DD254 Package to the contractor’s Facility Security Officer (FSO) and the Defense Security Service (DSS).

The RA cannot use this DD254 Package for award of a different contract. This DD254 Package was prepared solely for this contract, based on the specific contractual requirements of this contract's Requirements Document.

Item 13. SECURITY GUIDANCE: (continued)

• DoD 5220.22-M, The National Industrial Security Program Operating Manual (NISPOM), Change 1, 28 Mar 13, applies to this contract.

• In accordance with (IAW) FAR 37.104, this is considered a personal services contract. Contractor personnel may be subject to the relatively continuous supervision and control of a Government Officer or employee.

• All contractor employees performing under this contract shall be U.S. citizens.

• HOMELAND SECURITY PRESIDENTIAL DIRECTIVE (HSPD)-12 CREDENTIAL Requirements:

o HSPD-12 mandates a government-wide standard for secure and reliable forms of identification (ID) issued by the federal government to its employees and employees of federal contractors for physical access to federally-controlled facilities and/or logical access to federally controlled information systems. The clause shall not be used when contractors require only intermittent access to Federally-controlled facilities.

o The Contractor shall comply with agency personal identity verification procedures that implement:

(1) HSPD-12, Policies for a Common Identification Standard for Federal Employees and Contractors;

(2) Office of Management and Budget (OMB) guidance M-05-24, Implementation of Homeland Security Presidential

Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors;

(3) Federal Information Processing Standards Publication (FIPS PUB) Number 201, Personal Identity Verification of Federal Employees and Contractors;

(4) Army Directive (AD) 2011-008, Army Implementation of Homeland Security Presidential Directive (HSPD)-12. AD

2011-08 provides Army guidance and assigns responsibilities for the implementation of HSPD-12;

(5) Federal Acquisition Regulation (FAR) Subpart 4.13, Personal Identity Verification of Contractor Personnel; and

(6) FAR 52.204-9, Personal Identity Verification of Contractor Personnel;

• NON-SENSITIVE POSITION Requirements:

o Contractor employees not having a requirement to fill a position requiring a security clearance but having a contractual requirement for unescorted entry to restricted areas, access to CUI, or access to government information systems and/or sensitive equipment require a favorable Tier 3 (T3) Investigation, using T3 Background Investigation Standards of a SF-86 (Questionnaire for National Security Positions).

• (Ref Item 2.) Pre-Award access is not required.

• (Ref Item 2.) This DD254 reflects the security requirements for the contract when awarded.

o The DD254 "certifier" (signer in Item 16 of the DD254) shall ensure the DD254 Package correctly/accurately reflects the Security Guidance/Requirements of the contract document(s) (as identified by the RA Contract POC) as of the date of preparation. Changes made to the contract/contract documents without the certifier’s knowledge and concurrence shall invalidate this certification.

o Failure of the RA Contract POC to revise the DD254 Package whenever the contract is changed/modified may result in the DD254 Package being unable to protect classified information provided to industry (contractors). This shall result in:

(1) The DD254 Package being considered invalid and unable to protect classified information/materials.

(2) A reportable Security Infraction/Violation.

• (Ref Item 8.a.) Contractual performance will be throughout the Central Command (CENTCOM) Area of

Responsibility (AOR).

o The primary locations to be covered are Afghanistan, Iraq, Jordan, Kuwait, and Qatar; however, the scope of coverage is limited to the CENTCOM AOR.

o The work to be performed under this contract will be performed at deployed office environments at Operating Bases

(OBs) throughout the CENTCOM AOR.

• (Ref Item 10.d.) ACCESS TO FORMERLY RESTRICTED DATA (FRD). The contractor is permitted access to FRD in the performance of this contract.

o Access to FRD requires a FINAL (not interim) eligibility at the appropriate level.

o Written concurrence of the KO and DD254 Certifier (individual who signed Item 16 of the DD254 for the prime contract) is required prior to subcontracting.

• (Ref Item 10.e) ACCESS TO INTELLIGENCE INFORMATION. The contractor is permitted access to Intelligence Information in the performance of this contract.

• (Ref Item 10.g.) ACCESS TO NORTH ATLANTIC TREATY ORGANIZATION (NATO) INFORMA- TION: Personnel are not assigned to a NATO staff position, but requiring access to NATO classified informa-tion, NATO Secret or access to the NATO accredited SIPRNET terminals in performance of this contract. This is information under the control of, belonging to, and circulated by, NATO. (NOTE: This does not automati-cally authorize the contractor access to “non-NATO” “FOREIGN GOVERNMENT INFORMATION” unless specifically authorized by Item 10.h.).

o Access to NATO information requires a FINAL (not interim) eligibility at the appropriate level and special briefings.

o The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees receive a NATO Awareness briefing prior to being granted access to NATO information. (NOTE: This does not automatically authorize the contractor access to “non-NATO” “FOREIGN GOVERNMENT INFORMATION” unless specifically authorized by Item 10.h.).

o The contractor will maintain strict compliance in regards to NATO information IAW the NISPOM, Chapter 10, Section 7.

o Prior approval from the KO is required for subcontracting.

• (Ref Item 10.h.) FOREIGN GOVERNMENT INFORMATION. The contractor is permitted access to Foreign Government Information in the performance of this contract.

o Access to Foreign Government Information requires a FINAL (not interim) eligibility at the appropriate level.

o Contractor employees shall be briefed, and acknowledge in writing, their responsibilities for handling Foreign

Government Information prior to being granted access.

o The contractor shall maintain strict compliance with the NISPOM, Chapter 10, and AR 380-5.

o Written concurrence of the KO and DD254 Certifier (individual who signed Item 16 of the DD254 for the prime contract) is required prior to subcontracting.

• (Ref Item 10.j.) CONTROLLED UNCLASSIFIED INFORMATION (CUI). All Army Activities (ALARACT) Message 340/2012, DTG: P 110553Z DEC 12, Subject: Handling and Protection of Controlled Unclassified Information (CUI), paragraph 4 states: “DoD Contractors. When CUI is to be provided to, or generated by DoD contractors, dissemination controls and protective measures will be included in pertinent contract documents such as the contract clause, statement of work, and DD Form 254 (DoD Contract Security Classification Specification).

Solicitations and contracts will included a non-disclosure of information clause that prohibits release of unclassified information to the public without approval of the army contracting activity (e.g., Defense FAR Supplement (DFARS) 252.204-7000). The clause will apply to all contractors.”

• (Ref Item 10.j.) FOR OFFICIAL USE ONLY (FOUO) INFORMATION.

o FOUO Information generated and/or provided under this contract shall be safeguarded and marked IAW DoDM

5200.01, Volume 4; DoD 5200.1-R, Appendix 3; AR 380-5; and AR 25-55.

o This item is linked directly to the Freedom of Information Act (FOIA) and the appropriate exemptions are in accordance with (IAW) 5 U.S.C. § 552(b), and should only be marked if the information the contract company will be accessing is protected under the FOIA. The NISPOM does not provide guidance concerning FOUO; the DD254 must provide guidance on protection procedures in Item 13.

(1) Specific guidance in the NISPOM; DoD 5400.7, Department of Defense Freedom of Information Act Program (FOIA).

(2) As specified in Attachment 2, “Protecting Controlled Unclassified Information (CUI).”

• (Ref Item 10.k.) AR 25-2, Information Assurance (IA), establishes IA policy, roles, and responsibilities.

o Information Assurance (IA) refers to the protection of systems and information in storage, processing, or transit from unauthorized access or modification; denial of service to unauthorized users; or the provision of service to authorized users. It, includes:

(1) Measures necessary to detect, document, and counter such threats.

(2) Measures that protect and defend information and ISs by ensuring their availability, integrity, authentica-tion, confidentiality, and non-repudiation.

(3) Providing for the restoration of Information Systems (ISs) by incorporating protection, detection, and reaction capabilities.

(4) This regulation designates IA as the security discipline that encompasses Communications Security (COMSEC), Information Security (INFOSEC), and control of compromising emanations (TEMPEST).

o Information Technology (IT) refers to hardware, firmware, and software used as a part of an information system to perform DOD information functions. It includes:

(1) Computers, telecommunications, automated information systems, and automatic data processing equip-ment.

(2) Any assembly of hardware, software, or firmware configured to collect, create, communicate, compute, disseminate, process, store, or control data or information.

• (Ref Item 10.k.) Use of Government Owned Computers:

o The RA Contract POC will ensure the contractor employee(s) is/are provided with government owned computers at government facility(ies) for processing unclassified/PII/FOUO/CUI/Classified/CMI Government material/information provided, collected, generated and/or developed during the contract’s period of performance.

o The purpose of the government owned computer is to conduct business as required by this contract. The contractor employee is prohibited from any other use of the government owned computer.

o The contractor employee shall not process any government owned information on any contractor or person-ally owned computers, including any government information provided, collected, generated and/or developed during the contract’s period of performance.

o Only contractor employees who meet the requirements of AR 25-2 and AR 380-67 shall be granted access to restricted areas, sensitive information or government equipment and/or unclassified networks (i.e., Enterprise NIPRNet), and classified networks (Enterprise SIPRNet and CENTRIX System).

o Contractors placed in IA/IT Positions shall be in compliance with:

(1) DoD 5200.2-R, DoD Personnel Security Program;

(2) AR 25-2, Information Assurance, paragraph 4-14 Personnel Security Standards;

(3) AR 380-67, The Department of the Army Personnel Security Program; and

(4) Any additional guidance as directed by RA’s G-6/S-6.

• (Ref Item 10.k.) The contractor is only authorized to access the appropriate government network as identified in the

DD254, Item 10.k, as required for performance of this contract:

o The NIPRNet.

o The Enterprise SIPRNet.

o The CENTRIX System.

• (Ref Item 10.k.) Contractor employees performing under this contract shall be in the following IT position(s) (as defined in AR 25-2):

o IT-II Positions. IT -II Positions are defined as personnel in IA positions with limited privileged-level access to control, manage, or configure ISs and devices, with very limited (single device) or no IA device access or management (for example, operating system administration of common network applications or enclaves, back-up operators).

o IT-III Positions. IT -III Positions are defined as IA positions with limited privileged-level access to that Information System(s) (IS(s)) or device(s) (for example, power users or a SA on individual systems for configuration or management). This is a position of higher trust.

(1) Personnel with roles, responsibilities, and access authorization of normal users with non-privileged level access to the IS or device.

(2) Personnel with non-privileged level access authorization in the role of official or statutory volunteers. The provisions for statutory volunteers are covered in AR 608–1.

• Personnel Security Controls:

o Information Systems (IS) Access: Contractor personnel assigned to any IT Positions who lose their clearance or have their unclassified system/network accesses revoked or suspended for derogatory reasons shall be barred access to the ISs until favorable adjudication of that investigation.

o The organization’s Information Assurance Security Officer (IASO)/Information Assurance Network Officer (IANO)/Information Assurance Manager (IAM) (as appropriate) shall identify any other official systems/ networks for which that individual has an account (for example, AKO, JPAS, ACCS, DSS NCAISS/ISFD, DTIC, etc.) and have it temporarily disabled or suspended.

o The contractor should consult with the servicing legal office for advice concerning personnel, security, contract and labor relations issues that may impact the final determination. Recheck local records to identify any issues that may be a deciding factor in the waiver process.

• (Ref Item 10.k.) IA Training Requirements: All contractor employees shall receive basic Computer Security

Awareness Training (to include Phishing Awareness, Personal Electronic Devices (PEDs), PII and Safe Home Computing).

• (Ref Item 10.k.) U.S. Army Information Assurance (IA) Training and Certification.

o Compliance with 05-PR-M-0002, Information Assurance (IA) Training and Certification, Version 5.0, Mar 12;

Issuance Date: 28 Feb 06; Update: 30 Mar 12. Army IA personnel must attain and maintain IA certifications appropriate for the technical, specialty and/or management positions.

o The IA workforce includes all privileged users, specialty positions, and IA managers who perform any of the functions described in DoD 8570.01-M, Change 2 Chapters 3 - 5 and 10-11 across all occupational specialties, or whether the duty is performed full-time or part-time as an additional/embedded duty (DoD 8570.01-M par C1.4.4.4).

• (Ref 11.a) HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACT-OR’S FACILITY OR AT A GOVERNMENT ACTIVITY: Contractual performance locations will be as identified in Items 8.a and 13. Cleared contractor personnel will provide supplemental controls IAW the NISPOM.

o The Government Requiring Activity will provide security classification guidance for performance of this contract.

o Submit visit request to the KO/COR and Security Management Office (RA G-2/S-2/J-2) at CENTCOM AOR performance locations for “need-to-know” verification.

• (Ref Item 11.f.) HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES.

o U.S. Classified Information/Materials shall remain under the direct control of the U.S. Government.

o All visits by Foreign National Contractors require an official Request for Visit Authorization (RVA) to be submitted by the Foreign National Contractor’s home country embassy in Washington, D.C., via the Foreign Visit System (FVS) located on the DoD Security Policy Automated Network (SPAN). The RVA shall be submitted with at least a 45-days lead-time before the proposed execution date(s) of the visit.

• (Ref Item 11.i.) TEMPEST/EMINT (Emanation Intelligence)/EMSEC (Emanation Security) REQUIRE-MENTS at Government Location(s)/Facility(ies) are incumbent on the government.

• (Ref Item 11.j. and 11.l.) HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS. OPSEC awareness and execution is crucial to Army success.

o OPSEC requirements apply to National Industrial Security Program (NISP) contractors when it is determined that additional safeguards are essential for specific contracts; they are imposed in addition to the standard requirements of the NISP.

o OPSEC requirements are additional to the requirements of the NISPOM. The prime contractors may not impose OPSEC requirements on their subcontractors unless the KO approves the OPSEC requirements.

• (Ref Item 11.l.) OTHER:

o Disclosure to the Public. Contractors shall not disclose unclassified, PII, FOUO, CUI, or classified informa-tion pertaining to a classified contract to the public without prior review and clearance as specified in the DD254 for the contract, or as otherwise specified by the GCA (NISPOM, paragraph 5-511).

o The RA Contract POC shall provide all required Security Classification Guides (SCGs) for the contractor’s use at all contract performance locations.

o The contractor shall ensure all classified materials used or generated under this contracting effort:

(1) Are marked, handled, stored and protected IAW AR 380-5 and the appropriate SCG(s).

(2) Any classification questions beyond the scope of the SCG or that cannot be derivatively classified shall be directed to the RA Contract POC for this contract.

• All classified materials:

o Shall be marked, handled, stored and protected IAW AR 380-5 and the appropriate classification guide(s). The RA

Contract POC shall provide security classification guidance for performance of this contract.

o Any classification questions beyond the scope of the classification guide, or that cannot be derivatively classified shall be directed to the RA Contract POC for this contract.

• SUBCONTRACTING REQUIREMENTS

o The KO is responsible to provide Prior Approval/Written Concurrence if the subcontractor will require access to any of the following access requirements:

(1) Formerly Restricted Data requirement (DD254, Item 10.d.),

(2) North American Treaty Organization (NATO) requirement (DD254, Item 10.g.);

(3) Foreign Government Information requirement (DD254, Item 10.h.);

(4) A SIPRNet Account requirement (DD254, Item 10.k.);

(5) Operation Security (OPSEC) requirement (DD254, Item 11.j.);

o The Prime Contractor (Item 6.a.) is responsible to provide the following information to the RA/RA COR:

(1) What portion(s) of the contract they plan to subcontract.

(2) To whom they are planning to subcontract.

(3) POC and contact information of the company being considered for subcontracting.

o The Requiring Activity (RA) must approve and provide written concurrence for the subcontracting of this contract.

The RA COR and RA internal/support Industrial Security Specialist (ISS) are responsible to provide input on whether or not to approve the subcontracting.

o Preparation of the DD254 for subcontracting.

(1) The Prime contractor is responsible to prepare the DD254 for subcontracting. The government will not prepare the

DD254 for subcontracting nor process the document for subcontractors.

(2) The contractor’s FSO prepares the DD254 for subcontracting, ensuring it meets the security guidance/requirements of the Prime Contract for tasks being subcontracted.

(3) The FSO is responsible to certify the DD254 for subcontracting by signing in item 16 as the certifying official.

(4) Submission of the Subcontracting DD254 to the KO for written approval of subcontracting:

o The KO is the primary Point of Contract for the awarded contract and is responsible to consolidating the input from the Key Personnel and approving the subcontracting. The key personnel in the preparation of the DD254 are:

(1) The program (program/project manager, RA COR, RA Contract POC, etc.) and the RA ISS (individual certifying the DD254 for the contract). The program and ISS recognizes the security requirements that the contractor will need to follow.

(2) The technical/subject matter expert personnel, and contracting personnel. The technical/subject matter expert personnel understand what information or equipment in the program requires protection, and the technical aspects of the requirements.

(3) The KO shall certify their “Approval for Subcontracting” by signing in Item 13 of the DD254 being used for subcontracting.

(4) The COR will maintain a record of all prime and subcontracts for metrics purposes, and provide a copy to the Command ISS.

Item 14. ADDITIONAL SECURITY REQUIREMENTS: (continued)

• (Ref Item 10.j.) DoD Regulation 5400.7, “DoD Freedom of Information Act Program."

• (Ref Item 10.j.) DoDM 5200.01, Vol 4, “DoD Information Security Program-Controlled Unclassified Informa-tion

(CUI).”

• (Ref Item 10.j.) ALARACT 340/2012, DTG: P 110553Z DEC 12, Subject: Handling and Protection of Controlled

Unclassified Information (CUI), paragraph 4. (DFARS Clause 252.204-7000)

• The contractor shall operate under:

o Previously identified Directives, Instructions, Regulations and Manuals;

o HQ ACC (ACC Subordinate Organization(s) if applicable) and the RA’s operational security procedures and policies;

o Any other specific theater/local requirements, regulations, and/or policies for controlling materials and infor-mation associated with this contract.

o In case of conflict, the contractor shall adhere to the more stringent security requirements.

• Contractors are not authorized to courier classified information and/or materials.

o Transporting and safeguarding of classified items shall be the sole responsibility of the government during each course of instruction to include during training activities away from government facilities.

o The government shall provide document custodians when necessary.

• TRAINING REQUIREMENTS. The contractor is responsible to ensure they provide continuing security education to their employees IAW the NISPOM. Contractor employees shall receive required training from the Requiring Activity. The RA Contract POC (COR) is responsible to ensure all contractor employees receive and complete the following training:

o Information Assurance (IA) Training Requirements: All contractor employees shall receive annual basic Computer Security Awareness Training (to include Phishing Awareness, Personal Electronic Devices (PEDs), PII and Safe Home Computing).

o Security Training Requirements: Receive initial and annual training on “Controlled Unclassified Information (CUI) Policies, Principles, and Practices;" and "Threat Awareness and Reporting Program (TARP) Training."

o U.S. Army Information Assurance (IA) Training and Certification. DFARS 52.209-4024, requires all contractor employees and associated subcontractor employees to complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DFARS 252.239-7001, DFARS 239.7102, DoDD 8570.01, DoD 8570.01-M, and AR 25-2 within six months of employment.

o Army Operations Security Training for External Official presence sites. Contractors that release, post, or maintain information or documents to the public domain on ACC official websites, per ALARACT, 421-2011 Army Operations Security Training for External Official presence sites, the contractor shall receive mandatory OPSEC training. The two online courses are:

(1) The Social Media and Operations Security Training Course and

(2) The Social Networking Course.

o Foreign Disclosure Training/Briefing Requirement: All DA U.S. contractor filling “Non-Sensitive” or “Non-

Critical Sensitive” Positions will receive an Initial Foreign Disclosure Orientation upon assignment and in-processing at a government location, and at least once a year (determined by the needs of the command’s foreign disclosure program and the nature of the command personnel involved in the program) if still assigned to that location. They shall be briefed regarding visits and meetings between them and personnel representing foreign contractors, as well as visits and meetings between personnel representing foreign contractors. AR 380–10 provides policy on government-to-government disclosure. (AR 380-10, para 6-3) The briefing (AR 380-10, para 2-10) will include information on:

(1) Disclosure of Classified Military Information (CMI) in oral, visual, or documentary form (AR 380–5).

(2) Disclosure of Controlled Unclassified Information (CUI). Note - Not all CUI is marked or has a distribution statement. It is incumbent upon all originators and proponents to review material prior to making a disclosure determination, in order to appropriately identify the information as public domain or CUI. (AR 380-10, para 1-5a.(2))

(3) Additional information may be found in AR 380-10, para 2-10.

o Additional Training Requirements (as applicable):

(1) Visitor Policy at the CENTCOM AOR.

(2) Visits by Foreign Nationals.

(3) Escort procedures (and verification of “Need-to-Know”).

(4) Unit Security Policies, Procedures and Requirements.

(5) RA and CENTCOM AOR Standard Operating Procedures (SOP).

(6) Security Classification Guide(s) (SCG[s]) as applicable.

(7) Use of the Secure Communications Devices.

(8) Reproduction of Classified Materials.

(9) Unauthorized Items.

(10) Personal Electronic Devices.

• Contract Completion:

o “Contract completion” actions (as applicable) shall be taken when:

(1) A contractor employee’s access is suspended (for any reason).

(2) Termination of a contractor employee’s employment.

(3) Completion/Termination of the contract.

(4) Or (sooner) if the purpose of the release has been served (i.e., the contract was completed prior to the estimated completion date).

o All unclassified/PII/FOUO/CUI/Classified/CMI Government material/information received, collected, and/or generated in performance of this contract are government property.

(1) All contractor owned memory and storage devices/media/materials (whether electrical, magnetic or optical) used to process unclassified/PII/FOUO/CUI/Classified/CMI Government material/information is government property.

These devices include any USB/IEEE-1394 (Firewire) Media Storage Devices (i.e., flash drives, memory sticks, CDs, DVDs, discs, external hard drive, etc.).

(2) The contractor employee shall return all such materials and information to the HQ ACC (ACC Subordi-nate Organization(s) if applicable) RA Contract POC from which it was received; unless retention or other disposition instructions are approved in writing by the:

(a) RA Contract POC;

(b) RA Security Branch and Industrial Security POC;

(c) HQ ACC G-2/Command ISS; and

(d) The Acquisition and Contracting Office awarding this Contract/Task Order.

o Contractor employee(s) are responsible to account for and return the following to the RA Contract POC:

(1) Government issued CACs and any other identification badges issued to contractor personnel by the ID Card Section at each contract performance location identified in Items 8.a. and 13.

(2) All access/identification badges issued to contractor personnel by the RA.

• Contractor Employee(s) Working for the Government:

o Contractor employees shall explicitly identify themselves as a "Contractor working for the Government" to all organizations and individuals while employed under the provisions of this contract. This includes conduc-ting mission related support; attending meetings, conferences, and seminars; in message traffic and emails, signature blocks; and on the phone.

(1) Badges issued to contractor employees shall specifically identify them as a “Contractor,” and shall be prominently displayed.

(2) Contractor workspace (office, laboratory, desk) shall contain a sign signifying the space is occupied by “contractor employee” to ensure that Federal employees and the public know that they are not Federal employees. The RA Contract POC will coordinate the contractor employees work area to ensure the contractor is not granted access to information they are not authorized under their contract performance.

(3) When the contractor employee status is not obvious to third parties, they are required to identify them-selves as such to avoid creating an impression in the minds of the public they are Government officials.

(4) Contractors must ensure all contractor produced products (documents or reports) are marked as contrac-tor products or disclose the fact of contractor participation.

o Contractor employees shall not represent themselves as a government employee (GG, GS, SES, WG, WS, or WL) of the RA, the Department of the Army, or of any other government agency.

o Representation means to “represent.” Contractors may be placed in a position where they “represent” the government at meetings,…