I-B-7_Attachment_0005_FY-17_CENTCOM_CASS_Recomp_Solicitation_DD254_Pkg_27_APRIL_2017.pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

Secret (The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYYYMMDD)

20170216

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs) Revision No.

Date (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYYYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYYYMMDD)

W9124J-17-R-0002

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code) Government locations within the United States Central Command (CENTCOM) Area of Responsibility (AOR).

DSS does not provide oversight for contractors performing classified work outside of the U.S., Puerto Rico, U.S. Possessions and Trust Territories; therefore, any security reviews/inspections will have to be conducted by the supporting security office: (See item 15)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

This DD Form 254 Is Prepared Solely “FOR PLANNING PURPOSES ONLY,” and Shall Not Be Used For Contract Award.

(IAW DoD 5220.22-R, paragraph 7-102.a. and c.; and compliance with the Federal Acquisition Regulation Part 4, 4.4.)

The contractor shall provide trained personnel for a variety of personal services throughout the Central Command (CENTCOM) Area of Responsibility (AOR);

primarily in Afghanistan, Iraq, Jordan, Kuwait, and Qatar. All work under this contract will be performed using a Labor-Hour, Single Award, Task Order Contract;

and will provide personal services in six (6) different labor categories: Contract Specialist, Procurement Technician, Procurement Analyst, Information Technology Specialist, Industrial Property Management Specialist, and Quality Assurance Specialist. The base period of performance for this contract will be for 12 months and will include a 60-day mobilization period if awarded to a non-incumbent Contractor. The contract also includes four 12-month option periods. The total term of the contract shall not exceed a total of 5 years and 6 months. The last 12 month option period shall include a 30-day demobilization period.

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify). For OPSEC Requirements, see Item 13.

k. OTHER Specify) IA Computer Requirements: Use of Government-owned Computers only at DoD Locations/Facilities.

IA Position Requirements: IT-II and IT-III Positions.

IA Network Requirements: Access to Enterprise NIPRNet, SIPRNet and CENTRIXS only at DoD Locations.

IA Training & Certification: Contractors having “privileged” access (IAW 25-2) are required to obtain IA Army Training & Certification IAW DoD policy (DoDD 8570.1-M, Chg 1).

A NATO Awareness Briefing is required for SIPRNet Access (see Item 13).

DD Form 254, DEC 1999 Previous editions are obsolete

Solicitation Number: W9124J-17-R-0002

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct

Through (Specify):

The Requiring Activity (RA) Contract Point of Contact (POC) is responsible to forward the contractor’s request for public release of information relating to Army classified contracts or programs through their security office (G-2/S-2/Security Manager/Security Monitor) to their Public Affairs (PA) Office (PAO). The PAO processes the request in accordance with AR 360-1, The Army Public Affairs Program. The contractor is responsible for obtaining the approval of the KO prior to release of any information received or generated under the contract. The KO should complete this item as required by internal agency directives to direct the prime contractor to the appropriate office that has public release authority. Prime contractors should refer their subcontractors to the KO that was referenced in the prime contract DD Form 254. Information requiring Headquarters (HQ) Department of the Army (DA) or Department of Defense (DoD) level review is forwarded by entry-level public affairs office to the HQDA, Office of the Chief of Public Affairs (OCPA), 1500 Army Pentagon, Washington, DC 20310-1500. The OCPA forwards the request, as required, to the Directorate for Freedom of Information and Security Review, Washington Headquarters Service, Department of Defense, Pentagon, Washington DC 20601-1400.

To the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* (Office of Freedom of Information; 1155 Defense Pentagon, Room 2C757; Washington, DC 20301-1155) for review. * In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

TO BE PROVIDED PRIOR TO CONTRACT AWARD.

ATTACHMENT # 1, (continuation sheet) for “Additional Guidance/Requirements.”

ATTACHMENT # 2 “Protecting "Controlled Unclassified Information" (CUI) Information.

ATTACHMENT # 3 “Contractor Visits To HQ Army Contracting Command (ACC) (ACC Subordinate Organization(s)) (Government) Locations/Facilities.”

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No

TO BE PROVIDED PRIOR TO CONTRACT AWARD.

ATTACHMENT # 1, (continuation sheet) for “Additional Guidance/Requirements.”

ATTACHMENT # 2 Protecting "FOR OFFICIAL USE ONLY" (FOUO) Information.

ATTACHMENT # 3 “Contractor Visits To HQ ACC (ACC Subordinate Organization(s)) (Government) Locations/Facilities.”

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed. Yes No

(Ref Item 8.a. and 13) For Classified Contracts: Defense Security Service (DSS) is relieved of all Industrial Security review/inspection responsibility for all classified materials/contract performance at Government Owned and Government Operated (GOGO) Facilities/Locations identified in the Contract Requirements Document (PWS/SOW) and Items 8.a. & 13.

1. The HQ ACC G-2/Command ISS is responsible for the Industrial Security Program (ISP) at all ACC GOGO Location(s)/Facility(ies) identified in the Contract

Requirements Document and DD254 (Items 8 & 13). They shall provide Cognizant Security Oversight (CSO) over all ISP issues, matters, and concerns for this contract, and shall assume responsibility for the:

a. Administration of the ISP on behalf of the Cognizant Security Agency IAW HQ ACC ISP; and all applicable Security Directives, Regulations, and Policies.

b. Oversight of all CUI, Classified or Classified Military Information (CMI) material released to or developed under the contract.

2. The CENTCOM J-2/G-2/S-2 at each CENTCOM AOR location is responsible for the Industrial Security Program requirements at their respective locations.

3. The Contract POC at each contract performance location shall ensure they keep the following offices apprised of ALL security issues/problems noted/identified for this contract (to include ALL Adverse Information, Self-Disclosure items, Security Infractions/Violations, etc.):

a. The HQ ACC G-2/Command ISS, the Contract COR.

b. The CENTCOM J-2/G-2/S-2 at their respective CENTCOM AOR location.

4. (Ref Items 8.c.) When DSS is relieved of security oversight responsibility for cleared facilities performing on Army programs, the HQ ACC ISS is responsible to forward a copy of the completed and signed DD Form 254 to the cognizant security agency, as well as any additional offices listed in block 17.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL Mr. Lynn E. Kirkland Date Signed: 16 February 2017

b. TITLE ACC Command ISS & Industrial Security Certifying Official as delegated by the HQ ACC DCofS, G2 IAW AR 380-49 & AFARS, Paragraph 5104.403 (22 May 07)

c. TELEPHONE (Include Area Code)

(256) 955-8528 (DSN ) 645

lynn.e.kirkland.civ@mail.mil

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

U.S. Army Contracting Command (G-2) ATTN: (AMSCC-IS) Lynn E. Kirkland 4505 Martin Road Redstone Arsenal, AL 35898-5000

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD Form 254 (BACK), DEC 1999 mailto:lynn.e.kirkland.civ@mail.mil

Department of Defense (DD) Form 254 Attachment 1 (continuation sheet)

Solicitation Number/Due Date (from item 2.b.): W9124J-17-R-0002 General Identification (item 9.): The contractor shall provide trained personnel for a variety of personal services throughout the Central Command (CENTCOM) Area of Responsibility (AOR); primarily in Afghanistan, Iraq, Jordan, Kuwait, and Qatar. All work under this contract will be performed using a Labor-Hour, Single Award, Task Order Contract; and will provide personal services in six

(6) different labor categories: Contract Specialist, Procurement Technician, Procurement Analyst, Information Technology Specialist, Industrial Property Management Specialist, and Quality Assurance Specialist. The base period of performance for this contract will be for 12 months and will include a 60-day mobilization period if awarded to a non-incumbent Contractor. The contract also includes four 12-month option periods. The total term of the contract shall not exceed a total of 5 years and 6 months. The last 12 month option period shall include a 30-day demobilization period.

This Defense Department (DD) Form 254 Was Prepared Solely “For Planning Purposes Only.”

(e.g., Contract Solicitation)

It Shall NOT Be Used For Contract Award.

An Original DD Form 254 Is Required For Contract Award

(Reference Department of Defense (DoD) 5220.22-R, paragraph 7-102.a. and c;

and compliance with the Federal Acquisition Regulation (FAR) Part 4, 4.403.)

The Base Period of Performance for this contract will be for 12 months and will include a 60-day mobilization period if awarded to a non-incumbent Contractor.

The contract also includes Four (4) 12-month OPTION periods.

The total term of the contract shall not exceed a total of 5 years and 6 months.

The last 12 month OPTION period shall include a 30-day demobilization period.

This DD Form 254 (DD254), Contract Security Classification Specification, is based on the Contract "Requirements Document(s)" (i.e., stated in the Performance Work Statement (PWS)/Statement of Work (SOW)) being used for contract award. The information is as identified by the Requiring Activity (RA) Contract Point of Contact (POC) (to include the terms Contracting Officers’ Representative (COR)/Alternate COR (ACOR)/Government Technical Monitor (GTM)/Technical Representative (TRep)/Functional Representative (FRep)/etc.) (Hereafter referred to simply as the "RA Contract POC").

The Government Contracting Activity (GCA) has the responsibility to protect and safeguard classified information disclosed to or generated by contractors under the NISP or from visiting the cleared contractor to review the security aspects/ requirements of the contract. The GCA includes the RA, the RA Contract POC, the Contracting Officer (KO)/ contracting specialist, and the Industrial Security Specialist (ISS).

The Department of the Army (DA) Program/Project Manager and RA ISS assists the RA Contract POC with the preparation of the DD254 for each classified contract by inserting all necessary security requirements identified in the security section of the documents which define contract requirements and performance (for example, request for bid, request for proposal, PWS, or SOW) (referred to as the “contract requirements document”). The RA is responsible for the DD254. Key Personnel involved in the preparation of the DD254 are the Program/Project Manager, RA Contract POC, the RA ISS (individual certifying the DD254 for the contract), technical/subject matter expert personnel, and contracting personnel.

a. The program/project manager and ISS recognizes the security requirements that the contractor will need to follow.

b. The technical/subject matter expert personnel understand what information or equipment in the program requires protection, and the technical aspects of the requirements.

c. The KO must ensure the contractor complies with the DD254 and any special clauses into the contract.

The KO is the only person authorized to direct changes in any requirements under this contract and, notwithstanding any provisions contained elsewhere in this contract, said authority remains solely with the KO. The KO is responsible to:

a. Ensure an approved acquisition plan, which includes a security specification section, is developed by the Contracting Officer (KO) and Requiring Activity (RA), in coordination with the supporting Industrial Security Specialist (ISS), defining the security requirements and procedures for the duration of the contract, program, or project. (AR 380-49, para 1-28.a)

b. Ensure that required security clauses are incorporated into classified contracts and solicitations as mandated in the Federal Acquisition Regulation (FAR) and its applicable supplements. (AR 380-49, para 1-28.b)

c. Ensure the contract requirements document adequately reflect the security requirements for the contracts and the ISS and/or supporting Security Manager (SM), along with the KO and Program Manager (PM), collaborate in the preparation of the DD254 and security requirement statements for the contract. (AR 380-49, para 1-28.d)

The RA Contract POC is responsible for all security issues and technical matters concerning this contract and contract performance; and to interface between the contractor, the KO, and the ACC Command ISS.

The DD254 is required to be reviewed every two years. The program/project manager and the ACC Command ISS should conduct this review in coordination with the RA security manager/monitor and the KO to ensure existing security requirements are consistent with the contract requirements.

a. If the review is performed and no changes are required:

(1) The program/project manager and ACC Command ISS will provide the KO with a copy of the review.

(2) The KO will provide written notification to the contractor that the DD254 remains valid until the next review or a change occurs in the program.

b. If the review is performed and changes are required:

(1) The program/project manager and ACC Command ISS must provide the KO with a revised DD254.

(2) The KO will then prepare a bi-lateral modification to the contract to incorporate the new DD254.

Revisions to the DD254 will be completed whenever:

a. The security guidance or pertinent information changes,

b. When a change in mission occurs impacting the contract,

c. When a contract is modified or an option year is exercised,

d. To ensure security requirements remain current and relevant throughout the contract lifecycle.

e. This includes contractor address changes if they are performing classified work at their facility.

If the RA Contract POC is no longer available (due to PCS, Deployment, retirement, etc.), the RA’s Security Manager is responsible for all security issues and matters concerning this contract and contract performance until a new COR is nominated by the RA and is appointed by the KO. It is the responsibility of the RA to ensure the continued security oversight of their contract/contract performance.

A classified contract is any contract that requires a contractor employee to fill a position that requires a security clearance, to have unescorted access (work) to an area requiring a security clearance, or to access classified information/material. All classified contracts require an original DD254 for solicitation and original DD254 for contract award.

Army Federal Acquisition Regulations Supplements (AFARS), Paragraph 5104.403 (22 May 07) and AR 380-5 (Information Security Program, 29 Sept 00, Paragraph 1-6) requires the Security Manager to certify" (sign) Item 16 of the DD254. The HQ ACC Security Manager (ACC DCofS, Intelligence/G2) delegated this responsibility to the ACC Command ISS. DD254s prepared for any classified contract awarded for HQ ACC or ACC Subordinate Organizations (to include ACC Contracting Centers, Expeditionary Contracting Command [ECC], and the Mission and Installation Contracting Command [MICC]) will require the ACC Command ISS to certify the DD254 (unless this authority has been further delegated in writing by the HQ ACC DCofS, Intelligence/G2).

The signer of the DD254 (Item 16) certifies that all “Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort” as of the signing of this document. Any changes made to the contract/contract documents (i.e., contract modification, or exercising an OPTION) without the certifier’s knowledge and approval shall invalidate this certification.

Once invalid, the RA Contract POC/KO becomes responsible/culpable for failing to provide adequate Security Guidance/ Requirements for the classified contract.

The RA ISS will initiate/report any security incident/violation for failure to provide adequate/current safeguards for the protection of Personally Identifiable Information (PII)/For Official Use Only (FOUO)/Controlled Unclassified Information (CUI)/classified/ Classified Military Information (CMI) entrusted to member of industry. This could result in the loss of an individual’s security clearance.

Department of Defense (DoD) 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), paragraph 4-103 states the Government Contracting Activity (GCA) is an element of an agency designated by the agency head and delegated broad authority regarding acquisition functions.

“The GCA is responsible for incorporating appropriate security requirements clauses in a classified contract, Invitation for Bid (IFB), Request for Proposal (RFP), Request for Quotation (RFQ), or other solicitation, and for providing the contractor with the security classification guidance needed during the performance of the contract. The Contract Security Classification Specification (DD254) provides this guidance to the contractor. The Contract Security Classification Specification must identify the specific elements of classified information involved in the contract that require security protection.”

“The GCA is required to review the existing guidance periodically during the performance stages of the contract and to issue a revised Contract Security Classification Specification when a change occurs to the existing guidance or when additional security classification guidance is needed by the contractor.”

If the RA Contract POC has any questions concerning the “security requirements” certification; ACC’s implementation of DoD 5220.22, National Industrial Security Program (NISP), Industrial Security regulations, policies, and procedures; or Classified Contracts (as defined by DoD 5220.22-R, Industrial Security Regulation (ISR) and the NISPOM)), please contact the HQ ACC Command ISS for assistance and guidance. The RA is the responsible to ensure these required actions are accomplished.

The contractor will report any failure to comply with the Security Guidance/Requirements identified in the DD254 Package to the contractor’s Facility Security Officer (FSO) and the Defense Security Service (DSS).

The RA cannot use this DD254 Package for award of a different contract. This DD254 Package was prepared solely for this contract, based on the specific contractual requirements of this contract's Requirements Document.

Item 13. SECURITY GUIDANCE: (continued)

• DoD 5220.22-M, The National Industrial Security Program Operating Manual (NISPOM), Change 2 (18 May 16), applies to this contract.

• (Ref Item 1.) CLEARANCE AND SAFEGUARDING: The contractor shall be required to have a:

o SECRET Facility Clearance (FCL) prior to the start of the contract.

o There is NO safeguarding capabilities requirements.

• All contractor employees performing under this contract shall be U.S. citizens.

• HOMELAND SECURITY PRESIDENTIAL DIRECTIVE (HSPD)-12 CREDENTIAL Requirements:

o HSPD-12 mandates a government-wide standard for secure and reliable forms of identification (ID) issued by the federal government to its employees and employees of federal contractors for physical access to federally-controlled facilities and/or logical access to federally controlled information systems. The clause shall not be used when contractors require only intermittent access to Federally-controlled facilities.

o The Contractor shall comply with agency personal identity verification procedures that implement:

(1) HSPD-12, Policies for a Common Identification Standard for Federal Employees and Contractors;

(2) Office of Management and Budget (OMB) guidance M-05-24, Implementation of Homeland Security Presidential

Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors;

(3) Federal Information Processing Standards Publication (FIPS PUB) Number 201, Personal Identity Verification of

Federal Employees and Contractors;

(4) Army Directive (AD) 2011-008, Army Implementation of Homeland Security Presidential Directive (HSPD)-12. AD 2011-

08 provides Army guidance and assigns responsibilities for the implementation of HSPD-12;

(5) AD 2014-005, Policy and Implementing Procedures for Common Access Card Credentialing and Access for Uncleared

Contractors. AD 2014-005 Army policy and procedures for the unescorted access of uncleared contractor employees to DoD installations, facilities, and/or networks to which the Army is responsible for physical security;

(6) Federal Acquisition Regulation (FAR) Subpart 4.13, Personal Identity Verification of Contractor Personnel; and

(7) FAR 52.204-9, Personal Identity Verification of Contractor Personnel;

PRE-AWARD ACCESS

• (Ref Item 2.) Pre-Award access is not required.

• (Ref Item 2.) This DD254 reflects the security requirements for the contract when awarded.

o The DD254 "certifier" (signer in Item 16 of the DD254) shall ensure the DD254 Package correctly/accurately reflects the Security Guidance/Requirements of the contract document(s) (as identified by the RA Contract POC) as of the date of preparation.

Changes made to the contract/contract documents without the certifier’s knowledge and concurrence shall invalidate this certification.

o Failure of the RA Contract POC to revise the DD254 Package whenever the contract is changed/modified may result in the DD254 Package being unable to protect classified information provided to industry (contractors). This shall result in:

(1) The DD254 Package being considered invalid and unable to protect classified information/materials.

(2) A reportable Security Infraction/Violation.

• (Ref Item 8.a.) The term CONUS refers to the “Continental (or ‘Contiguous’) United States (CONUS) (the 48 contiguous States in the United States territory, including the District of Columbia and adjacent territorial waters, located within the North American continent, between Canada and Mexico). It does not include Alaska or Hawaii.

• (Ref Item 8.a.) Contractual performance will be within the CENTCOM AOR; however, the primary locations to be covered are

Afghanistan, Iraq, Jordan, Kuwait, and Qatar.

• (Ref Item 8.c.) When DSS is relieved of security oversight responsibility for cleared facilities performing on Army programs, the

ISS is responsible for forwarding a copy of the completed and certified DD Form 254 to the cognizant security agency, as well as any additional offices listed in block 17. (AR 380-49, paragraph 4-5.b)

• (Ref Item 10.d.) ACCESS TO FORMERLY RESTRICTED DATA (FRD). The contractor is permitted access to FRD in the performance of this contract.

o Access to FRD requires a FINAL (not interim) eligibility at the appropriate level.

o Written concurrence of the KO and DD254 Certifier (individual who signed Item 16 of the DD254 for the prime contract) is required prior to subcontracting.

• (Ref Item 10.e) ACCESS TO INTELLIGENCE INFORMATION. The contractor is permitted access to Intelligence Information in the performance of this contract.

• (Ref Item 10.g.) ACCESS TO NORTH ATLANTIC TREATY ORGANIZATION (NATO) INFORMATION: Personnel are not assigned to a NATO staff position, but requiring access to NATO classified information, NATO COSMIC, NATO Secret or access to the NATO accredited SIPRNET terminals in performance of this contract. This is information under the control of, belonging to, and circulated by, NATO. (NOTE: This does not automatically authorize the contractor access to “non-NATO” “FOREIGN GOVERNMENT INFORMATION” unless specifically authorized by Item 10.h.).

o Access to NATO information requires a FINAL (not interim) eligibility at the appropriate level and special briefings.

o The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees receive a NATO Awareness briefing prior to being granted access to NATO information. (NOTE: This does not automatically authorize the contractor access to “non-NATO” “FOREIGN GOVERNMENT INFORMATION” unless specifically authorized by Item 10.h.).

o The contractor will maintain strict compliance in regards to NATO information IAW the NISPOM, Chapter 10, Section 7.

o Prior approval from the KO is required for subcontracting.

• (Ref Item 10.h.) FOREIGN GOVERNMENT INFORMATION. The contractor is permitted access to Foreign Government

Information in the performance of this contract.

o Access to Foreign Government Information requires a FINAL (not interim) eligibility at the appropriate level.

o Contractor employees shall be briefed, and acknowledge in writing, their responsibilities for handling Foreign Government

Information prior to being granted access.

o The contractor shall maintain strict compliance with the NISPOM, Chapter 10, and AR 380-5.

o Written concurrence of the KO and DD254 Certifier (individual who signed Item 16 of the DD254 for the prime contract) is required prior to subcontracting.

• (Ref Item 10.j.) FOR OFFICIAL USE ONLY (FOUO) INFORMATION.

o In addition to classified information, certain types of unclassified information also require application of access and distribution controls and protective measures for a variety of reasons. Such information is referred to collectively as Controlled Unclassified Information (CUI). The originator of a document is responsible for determining at origination whether the information may qualify for CUI status, and if so, for applying the appropriate CUI markings. This enclosure identifies the controls and protective measures developed for DoD CUI:

(1) For Official Use Only (FOUO).

(2) Law Enforcement Sensitive (LES).

(3) DoD Unclassified Controlled Nuclear Information (DoD UCNI).

(4) LIMITED DISTRIBUTION.

(5) As well as some of those developed by other Executive Branch agencies.

(6) Source Selection Information.

(7) Proprietary Data (of other contractors).

o FOUO Information generated and/or provided under this contract shall be safeguarded and marked IAW DoDM 5200.01, Volume 4; DoD 5200.1-R, Appendix 3; AR 380-5; and AR 25-55.

o This item is linked directly to the Freedom of Information Act (FOIA) and the appropriate exemptions are in accordance with (IAW) 5 U.S.C. § 552(b), and should only be marked if the information the contract company will be accessing is protected under the FOIA. The NISPOM does not provide guidance concerning FOUO; the DD254 must provide guidance on protection procedures in Item 13.

(1) Specific guidance in the NISPOM; DoD 5400.7, Department of Defense Freedom of Information Act Program (FOIA).

(2) As specified in Attachment 2, “Protecting Controlled Unclassified Information (CUI).”

• (Ref Item 10.j.) CONTROLLED UNCLASSIFIED INFORMATION (CUI).

o All Army Activities (ALARACT) Message 340/2012, DTG: P 110553Z DEC 12, Subject: Handling and Protection of Controlled Unclassified Information (CUI), paragraph 4 states: “DoD Contractors. When CUI is to be provided to, or generated by DoD contractors, dissemination controls and protective measures will be included in pertinent contract documents such as the contract clause, statement of work, and DD Form 254 (DoD Contract Security Classification Specification). Solicitations and contracts will included a non-disclosure of information clause that prohibits release of unclassified information to the public without approval of the army contracting activity (e.g., Defense FAR Supplement (DFARS) 252.204-7000). The clause will apply to all contractors.”

o Contractor employees having access to sensitive, proprietary information shall be required by the Requiring Activity (RA) to sign an “Organization Non-Disclosure of Information Agreement” to prevent a Conflict of Interest. (DoD Manual (DoDM) 5200.01- V4, 24 Feb 12, Enclosure 3 - Identification and Protection of Controlled Unclassified Information (CUI)) Solicitations and contracts shall use an “Organization Non-Disclosure of Information” clause that prohibits release of unclassified information to the public without approval of the contracting activity (e.g., Defense Federal Acquisition Regulation Supplements (DFARS) 252.204-7000).

• (Ref Item 10.k.) AR 25-2, Information Assurance (IA), establishes IA policy, roles, and responsibilities.

o Information Assurance (IA) refers to the protection of systems and information in storage, processing, or transit from unauthorized access or modification; denial of service to unauthorized users; or the provision of service to authorized users. It, includes:

(1) Measures necessary to detect, document, and counter such threats.

(2) Measures that protect and defend information and ISs by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation.

(3) Providing for the restoration of Information Systems (ISs) by incorporating protection, detection, and reaction capabilities.

(4) This regulation designates IA as the security discipline that encompasses Communications Security (COMSEC), Information

Security (INFOSEC), and control of compromising emanations (TEMPEST).

o Information Technology (IT) refers to hardware, firmware, and software used as a part of an information system to perform

DOD information functions. It includes:

(1) Computers, telecommunications, automated information systems, and automatic data processing equipment.

(2) Any assembly of hardware, software, or firmware configured to collect, create, communicate, compute, disseminate, process, store, or control data or information.

• (Ref Item 10.k.) Use of Government Owned Computers:

o The RA Contract POC will ensure the contractor employee(s) is/are provided with government owned computers at government facility(ies) for processing unclassified/PII/FOUO/CUI/Classified/CMI Government material/information provided, collected, generated and/or developed during the contract’s period of performance.

o The purpose of the government owned computer is to conduct business as required by this contract. The contractor employee is prohibited from any other use of the government owned computer.

o The contractor employee shall not process any government owned information on any contractor or person-ally owned computers, including any government information provided, collected, generated and/or developed during the contract’s period of performance.

o Only contractor employees who meet the requirements of AR 25-2 and AR 380-67 shall be granted access to restricted areas, sensitive information or government equipment and/or unclassified networks (i.e., Enterprise NIPRNet (Non-Secure Internet Protocol Router Network)) and classified networks (i.e., Enterprise SIPRNet (Secret Internet Protocol Router Network)).

o Contractors placed in IA/IT Positions shall be in compliance with:

(1) DoD 5200.2-R, DoD Personnel Security Program;

(2) AR 25-2, Information Assurance, paragraph 4-14 Personnel Security Standards;

(3) AR 380-67, The Department of the Army Personnel Security Program; and

(4) Any additional guidance as directed by RA’s G-6/S-6.

• (Ref Item 10.k.) Personnel Security Standards. Personnel who require access to Government Network(s) processing defense information (unclassified/PII/FOUO/CUI/classified/CMI) to fulfill their duties under this contract shall possess the appropriate security ACCESS (based on AFFILIATION), commensurate with the security requirements of the Government Network being accessed. This ACCESS shall be based on the appropriate ACCESS requirements as delineated in AR 380-67 and as identified by the contract. The government will not grant access to classified government network(s) to contractor personnel not having the required security clearance and contractual requirement.

• (Ref Item 10.k.) The contractor is only authorized to access the appropriate government network as identified in the DD254, Item

10.k, as required for performance of this contract:

o The Enterprise Non-secure Internet Protocol (IP) Router Network (NIPRNet).

o The Enterprise Secret Internet Protocol Router Network (SIPRNet).

o Combined Enterprise Regional Information Exchange (CENTRIX) System

• (Ref Item 10.k.) NORTH ATLANTIC TREATY ORGANIZATION (NATO) SECURITY AWARENESS BRIEFING:

o The contract does not authorize the contractor to access NATO information. However, a NATO Security Awareness Briefing is required of all personnel who require access to the SIPRNet.

(1) The SIPRNet contains NATO information.

(2) The NATO Security Awareness Briefing informs personnel how to protect NATO information in the event they come across it while on the SIPRNet.

o The NATO Awareness Briefing does not authorize a contractor to access NATO classified information, NATO COSMIC, NATO

Secret or access to the NATO accredited SIPRNet terminals in performance of this contract. This is information under the control of, belonging to, and circulated by, NATO.

o Contact the RA G-2 or G-6 office for information on this requirement.

• (Ref Item 10.k.) Access by Non-U.S. Citizens.

o Minimize employment of non-U.S. citizens in IT positions. However, compelling reasons may exist to grant access to DoD IT resources in those circumstances in which a non-U.S. citizen possesses a unique or unusual skill or expertise that is urgently needed for a specific DoD requirement and for which a suitable U.S. citizen is not available.

o Non-U.S. citizens may hold IT positions under the conditions described in AR 25-2 and AR 380-67 if:

(1) There is written compelling-reason justification.

(2) It is IAW applicable disclosure policies and authorized for foreign disclosure (for example, National Disclosure Policy 1, DoDD 5230.9, DoDD 5230.25) and U.S. statutes (for example, the Arms Export Control Act, 22 USC 2551, et. seq.).

(3) The required documentation is in the Certification and Accreditation (C&A) package. (NOTE: The written approval must be on file and provided as an artifact to the C&A package, before requesting the required investigation.)

(4) The required investigation must be completed and favorably adjudicated before authorizing access to DoD systems or networks. Interim access is prohibited.

(5) The Designated Approving Authority (DAA) that accredited the system approves the assignment requirement(s) in writing.

(6) The data owners approve the assignment requirement(s) in writing.

(7) The Industrial Security POC (identified in the DD254, Item 13) approves the assignment requirement(s) in writing.

• (Ref Item 10.k.) Contractor employees performing under this contract shall be in the following IT position(s) (as defined in AR 25-

2):

o IT-II Positions. IT -II Positions are defined as personnel in IA positions with limited privileged-level access to control, manage, or configure ISs and devices, with very limited (single device) or no IA device access or management (for example, operating system administration of common network applications or enclaves, back-up operators).

o IT-III Positions. IT -III Positions are defined as IA positions with limited privileged-level access to that Information System(s) (IS(s)) or device(s) (for example, power users or a SA on individual systems for configuration or management). This is a position of higher trust.

(1) Personnel with roles, responsibilities, and access authorization of normal users with non-privileged level access to the IS or device.

(2) Personnel with non-privileged level access authorization in the role of official or statutory volunteers. The provisions for statutory volunteers are covered in AR 608–1.

• PERSONNEL SECURITY CONTROLS AND ACCESS. Individuals assigned to IT–I, IT–II, or IT–III positions who lose their clearance, or have access to classified systems suspended pending the results of an investigation, will be barred access to the ISs until favorable adjudication of that investigation. (AR 25-2, para 4-14b(2)) o Waivers for IT–II and IT–III personnel for continued access to unclassified systems:

(1) Waivers will be justified in a written request, with the Commander’s concurrence, to the Designated Approving Authorities (DAA) for approval. Access will be granted only upon DAA authorization. This request and approval will become part of the C&A package. (AR 25-2, para 4-14b(2))

(2) Waivers processed for IT–II and IT–III personnel only are valid for a period not to exceed 6 months. If a second waiver extension is required, one may be granted as long as a new request for waiver is submitted to the DAA and approved by the first general officer, or equivalent in position or civilian grade, in the Chain of Command. (AR 25-2, para 4-14b(3))

(3) While the Commander and DAA have the discretion to process the waiver for IT–II and IT–III, it is important that this discretion is not without limits.

(1) The Commander and DAA are advised to proceed carefully and deliberately in making a determination on whether the individual constitutes a security risk.

(2) The IT–II/IT–III roles must be highly supervised. Any access to protective devices (for example, firewalls, VPNs, intrusion detection systems (IDSs), IPSs, and so on) will be prohibited until favorable adjudication. (AR 25-2, para 4- 14b(4))

(3) The servicing legal office should be consulted for advice concerning personnel, security, contract and labor relations issues that may impact the final determination. Recheck local records to identify any issues that may be a deciding factor in the waiver process. (AR 25-2, para 4-14b(5))

(4) New, credible derogatory information revokes any standing waiver and results in immediate denial of access to IT systems (exceptions are for military only based on immediate supervision of the individual while on the IS). (AR 25-2, para 4-14b(6))

(5) Contractor, FN or temporary individuals assigned to any IT positions who have their unclassified system or network accesses revoked or suspended for derogatory reasons, will be barred access to the ISs until favorable adjudication of that investigation. The organization’s IASO/IANO/IAM (as appropriate) will identify any other official systems/networks for which that individual has an account (for example, AKO) and have it temporarily disabled or suspended. (AR 25-2, para 4- 14b(7))

• Personnel Security Controls:

o Information Systems (IS) Access: Contractor personnel assigned to any IT Positions who lose their clearance or have their unclassified system/network accesses revoked or suspended for derogatory reasons shall be barred access to the ISs until favorable adjudication of that investigation.

o The organization’s Information Assurance Security Officer (IASO)/Information Assurance Network Officer (IANO)/Information Assurance Manager (IAM) (as appropriate) shall identify any other official systems/ networks for which that individual has an account (for example, AKO, JPAS, ACCS, DSS NCAISS/ISFD, DTIC, etc.) and have it temporarily disabled or suspended.

o The contractor should consult with the servicing legal office for advice concerning personnel, security, contract and labor relations issues that may impact the final determination. Recheck local records to identify any issues that may be a deciding factor in the waiver process.

• (Ref Item 10.k.) IA Training Requirements: All contractor employees shall receive basic Computer Security Awareness Training

(to include Phishing Awareness, Personal Electronic Devices (PEDs), PII and Safe Home Computing).

• (Ref Item 10.k.) U.S. Army Information Assurance (IA) Training and Certification.

o Compliance with 05-PR-M-0002, Information Assurance (IA) Training and Certification, Version 5.0, Mar 12; Issuance Date:

28 Feb 06; Update: 30 Mar 12. Army IA personnel must attain and maintain IA certifications appropriate for the technical, specialty and/or management positions.

o The IA workforce includes all privileged users, specialty positions, and IA managers who perform any of the functions described in DoD 8570.01-M, Change 2 Chapters 3 - 5 and 10-11 across all occupational specialties, or whether the duty is performed full-time or part-time as an additional/embedded duty (DoD 8570.01-M par C1.4.4.4).

o The following positions under this contract effort will require the contractor to fill the following Information Technology (IT) Personnel Security Standards positions IAW AR 25-2, Paragraph 4-14:

(1) IT-I:

(2) IT-II:

(3) IT-III:

o The following positions under this contract effort will require the contractor to fill the following IA Category and Level positions (IAW DoD 8570.01-M):

(1) IAMI/II/III or

(2) IATI/II/III or

(3) IASAE I/II/III or

(4) CND-SP position (Analyst/Infrastructure Support/Incident Responder/Auditor/SP Manager) o DoD Acquisition Regulations System (DFARS) 48 CFR Parts 239 and 252 RIN 0750-AF52, Supplement; IA Contractor Training and Certification (DFARS Case 2006-D023) apply to this contract.

o Contractor personnel shall agree to obtain the appropriate baseline certification upon contract award as a “condition of employment.”

• (Ref 11.a) HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACT-OR’S FACILITY

OR AT A GOVERNMENT ACTIVITY: Contractual performance locations will be as identified in Items 8.a and 13. Contractor performance is restricted to the CENTCOM AOR. Cleared contractor personnel will provide supplemental controls IAW the

NISPOM.

• (Ref Item 11.f.) HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S.

POSSESSIONS AND TRUST TERRITORIES.

o U.S. Classified Information/Materials shall remain under the direct control of the U.S. Government.

o All visits by Foreign National Contractors require an official Request for Visit Authorization (RVA) to be submitted by the

Foreign National Contractor’s home country embassy in Washington, D.C., via the Foreign Visit System (FVS) located on the DoD Security Policy Automated Network (SPAN). The RVA shall be submitted with at least a 45-days lead-time before the proposed execution date(s) of the visit.

• (Ref Item 11.j. and 11.l.) HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS. OPSEC awareness and execution is crucial to Army success.

o OPSEC requirements apply to National Industrial Security Program (NISP) contractors when it is determined that additional safeguards are essential for specific contracts; they are imposed in addition to the standard requirements of the NISP.

o OPSEC requirements are additional to the requirements of the NISPOM. The prime contractors may not impose OPSEC requirements on their subcontractors unless the KO approves the OPSEC requirements.

• (Ref Item 11.l.) OTHER:

o The transfer of materials, courseware, manuals, and/or documents to other Independent Research and Development (IR&D) efforts, contracts, or company proposals is not permitted.

o Any information obtained, developed, or researched during performance of this contact is considered to be the intellectual property of the U.S. Government. This includes:

(1) Any work(s) not directly relating to this contract, but includes/involves information obtained during interviews or researched during the performance of this contract.

(2) Any work(s) based on the contract performance subjects, and/or organizations.

o Disclosure to the Public. Contractors shall not disclose unclassified, PII, FOUO, CUI, or classified information pertaining to a classified contract to the public without prior review and clearance as specified in the DD254 for the contract, or as otherwise specified by the GCA (NISPOM, paragraph 5-511).

o The RA Contract POC shall provide all required Security Classification Guides (SCGs) for the contractor’s use at all contract performance locations.

o The contractor shall ensure all classified materials used or generated under this contracting effort:

(1) Are marked, handled, stored and protected IAW AR 380-5 and the appropriate SCG(s).

(2) Any classification questions beyond the scope of the SCG or that cannot be derivatively classified shall be directed to the

RA Contract POC for this contract.

• All classified materials:

o Shall be marked, handled, stored and protected IAW AR 380-5 and the appropriate classification guide(s). The RA Contract POC shall provide security classification guidance for performance of this contract.

o Any classification questions beyond the scope of the classification guide, or that cannot be derivatively classified shall be directed to the RA Contract POC for this contract.

• Prior Approval/Authorize of the Requiring Activity is required prior to the Subcontracting of this contract:

Due to the sensitive nature of the end user and/or its mission, the Requiring Activity (RA) must approve and provide written concurrence for the subcontracting of this contract. The RA COR and RA internal/support Industrial Security Specialist (ISS) are responsible to provide input on whether or not to approve the subcontracting.

• SUBCONTRACTING REQUIREMENTS

o The KO is responsible to provide Prior Approval/Written Concurrence if the subcontractor will require access to any of the following access requirements:

(1) Formerly Restricted Data requirement (DD254, Item 10.d.),

(2) North American Treaty Organization (NATO) requirement (DD254, Item 10.g.);

(3) Foreign Government Information requirement (DD254, Item 10.h.);

(4) A SIPRNet Account requirement (DD254, Item 10.k.);

(5) Operation Security (OPSEC) requirement (DD254, Item 11.j.);

o The Prime Contractor (Item 6.a.) is responsible to provide the following information to the RA/RA COR:

(1) What portion(s) of the contract they plan to subcontract.

(2) To whom they are planning to subcontract.

(3) POC and contact information of the company being considered for subcontracting.

o…