Attachment 15 Redstone Garrison DD254 w attachments (Jul20).pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

UNCLASSIFIED//FOUO

P ag e1

Contract Number: For Solicitation Purposes Only

ATTACHMENT 1

(Item 13. SECURITY GUIDANCE)

General Identification: This is a non-personal services contract to provide Installation Support Services to the US

Army Garrison-Redstone (USAG-R) and USAG-R tenants. The Government will not exercise any supervision or control over the contract service providers. The Contractor shall perform to the standards specified in this

Performance Work Statement (PWS). Contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government. The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary as defined in this

PWS. Place of performance for all non-personal services is on-site at Redstone Arsenal, AL. The period of performance for this contract consists of a ten (10) year performance period, consisting of five (5) base years with five (5) twelve (12) month option periods from 1 June 2021 to 31 May 2031.

(Reference Department of Defense (DoD) 5220.22-R, paragraph 7-102.a. and c;

and compliance with the Federal Acquisition Regulation (FAR) Part 4, 4.403.)

The Base Period of Performance is identified in the Delivery Information Section.

This DD Form 254 (DD254), Contract Security Classification Specification, is based on the Contract "Requirements

Document(s)" (i.e., stated in the Performance Work Statement (PWS)/Statement of Work (SOW)) being used for contract award. The information is as identified by the Requiring Activity (RA) Contract Point of Contact (POC) (to include the terms Contracting Officers’ Representative (COR)/Alternate COR (ACOR)/Government Technical

Monitor (GTM)/Technical Representative (TRep)/Functional Representative (FRep)/etc.) (Hereafter referred to simply as the "RA Contract POC").

The Government Contracting Activity (GCA) has the responsibility to protect and safeguard classified information disclosed to or generated by contractors under the NISP or from visiting the cleared contractor to review the security aspects/ requirements of the contract. The GCA includes the RA, the RA Contract POC, the Contracting Officer

(KO)/ contracting specialist, and the Industrial Security Specialist (ISS).

The Department of the Army (DA) Program/Project Manager and RA ISS assists the RA Contract POC with the preparation of the DD254 for each classified contract by inserting all necessary security requirements identified in the security section of the documents which define contract requirements and performance (for example, request for bid, request for proposal, PWS, or SOW) (referred to as the “contract requirements document”). The RA is responsible for the DD254. Key Personnel involved in the preparation of the DD254 are the Program/Project Manager, RA

Contract POC, the RA ISS (individual certifying the DD254 for the contract), technical/subject matter expert personnel, and contracting personnel.

a. The program/project manager and ISS recognizes the security requirements that the contractor will need to follow.

b. The technical/subject matter expert personnel understand what information or equipment in the program requires protection, and the technical aspects of the requirements.

c. The KO must ensure the contractor complies with the DD254 and any special clauses into the contract.

The KO is the only person authorized to direct changes in any requirements under this contract and, notwithstanding any provisions contained elsewhere in this contract, said authority remains solely with the KO. The KO is responsible to:

a. Ensure an approved acquisition plan, which includes a security specification section, is developed by the

Contracting Officer (KO) and Requiring Activity (RA), in coordination with the supporting Industrial Security e2

Specialist (ISS), defining the security requirements and procedures for the duration of the contract, program, or project.

(AR 380-49, para 1-28.a)

b. Ensure that required security clauses are incorporated into classified contracts and solicitations as mandated in the Federal Acquisition Regulation (FAR) and its applicable supplements. (AR 380-49, para 1-28.b)

c. Ensure the contract requirements document adequately reflect the security requirements for the contracts and the

ISS and/or supporting Security Manager (SM), along with the KO and Program Manager (PM), collaborate in the preparation of the DD254 and security requirement statements for the contract. (AR 380-49, para 1-28.d)

The RA Contract POC is responsible for all security issues and technical matters concerning this contract and contract performance; and to interface between the contractor, the KO, and the HQDA ISS.

The DD254 is required to be reviewed every two years. The program/project manager and the HQDA ISS should conduct this review in coordination with the RA security manager/monitor and the KO to ensure existing security requirements are consistent with the contract requirements.

a. If the review is performed and no changes are required:

(1) The program/project manager and HQDA ISS will provide the KO with a copy of the review.

(2) The KO will provide written notification to the contractor that the DD254 remains valid until the next review or a change occurs in the program.

b. If the review is performed and changes are required:

(1) The program/project manager and HQDA ISS must provide the KO with a revised DD254.

(2) The KO will then prepare a bi-lateral modification to the contract to incorporate the new DD254.

Revisions to the DD254 will be completed whenever:

a. The security guidance or pertinent information changes,

b. When a change in mission occurs impacting the contract,

c. When a contract is modified or an option year is exercised,

d. To ensure security requirements remain current and relevant throughout the contract lifecycle.

e. This includes contractor address changes if they are performing classified work at their facility.

If the RA Contract POC is no longer available (due to PCS, Deployment, retirement, etc.), the RA’s Security Manager is responsible for all security issues and matters concerning this contract and contract performance until a new COR is nominated by the RA and is appointed by the KO. It is the responsibility of the RA to ensure the continued security oversight of their contract/contract performance.

A classified contract is any contract that requires a contractor employee to fill a position that requires a security clearance, to have unescorted access (work) to an area requiring a security clearance, or to access classified information/material. All classified contracts require an original DD254 for solicitation and original DD254 for contract award.

Army Federal Acquisition Regulations Supplements (AFARS), Paragraph 5104.403 (22 May 07) and AR 380-5

(Information Security Program, 29 Sept 00, Paragraph 1-6) requires the Security Manager to certify" (sign) Item 16 of the DD254. The HQDA Security Manager (HQDA DCofS, Intelligence/G2) delegated this responsibility to the

HQDA ISS. DD254s prepared for any classified contract awarded for HQDA or HQDA Subordinate Organizations will require the HQDA ISS to certify the DD254 (unless this authority has been further delegated in writing by the

HQDA DCofS, Intelligence/G2).

The signer of the DD254 (Item 16) certifies that all security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort as of the signing of this document. Any changes made to the contract/contract documents (i.e., contract modification, or exercising an

OPTION) without the certifier’s knowledge and approval shall invalidate this certification.

Once invalid, the RA Contract POC/KO becomes responsible/culpable for failing to provide adequate Security

Guidance/ Requirements for the classified contract.

The RA ISS will initiate/report any security incident/violation for failure to provide adequate/current safeguards for the protection of Personally Identifiable Information (PII)/For Official Use Only (FOUO)/Controlled Unclassified

Information (CUI)/classified/ Classified Military Information (CMI) entrusted to member of industry. This could result in the loss of an individual’s security clearance.

e3

Department of Defense (DoD) 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), paragraph 4-103 states the Government Contracting Activity (GCA) is an element of an agency designated by the agency head and delegated broad authority regarding acquisition functions.

“The GCA is responsible for incorporating appropriate security requirements clauses in a classified contract, Invitation for Bid (IFB), Request for Proposal (RFP), Request for Quotation (RFQ), or other solicitation, and for providing the contractor with the security classification guidance needed during the performance of the contract. The

Contract Security Classification Specification (DD254) provides this guidance to the contractor. The Contract

Security Classification Specification must identify the specific elements of classified information involved in the contract that require security protection.”

“The GCA is required to review the existing guidance periodically during the performance stages of the contract and to issue a revised Contract Security Classification Specification when a change occurs to the existing guidance or when additional security classification guidance is needed by the contractor.”

If the RA Contract POC has any questions concerning the “security requirements” certification; ACC’s implementation of DoD 5220.22, National Industrial Security Program (NISP), Industrial Security regulations, policies, and procedures; or Classified Contracts (as defined by DoD 5220.22-R, Industrial Security Regulation (ISR) and the NISPOM)), please contact the HQ HQDA ISS for assistance and guidance. The RA is the responsible to ensure these required actions are accomplished.

The contractor will report any failure to comply with the Security Guidance/Requirements identified in the DD254

Package to the contractor’s Facility Security Officer (FSO) and the Defense Counterintelligence & Security Agency

(DCSA).

The RA cannot use this DD254 Package for award of a different contract. This DD254 Package was prepared solely for this contract, based on the specific contractual requirements of this contract's Requirements Document.

Item 13. SECURITY GUIDANCE: (continued)

DoD 5220.22-M, The National Industrial Security Program Operating Manual (NISPOM), Change 2 (18 May

16), applies to this contract.

(Ref Item 1.) CLEARANCE AND SAFEGUARDING: The contractor shall be required to have a:

o SECRET Facility Clearance (FCL) prior to the start of the contract.

o There is NO safeguarding capabilities requirements.

All contractor employees performing under this contract shall be U.S. citizens.

HOMELAND SECURITY PRESIDENTIAL DIRECTIVE (HSPD)-12 CREDENTIAL Requirements:

o HSPD-12 mandates a government-wide standard for secure and reliable forms of identification (ID) issued by the federal government to its employees and employees of federal contractors for physical access to federally-controlled facilities and/or logical access to federally controlled information systems. The clause shall not be used when contractors require only intermittent access to Federally-controlled facilities.

o The Contractor shall comply with agency personal identity verification procedures that implement:

(1) HSPD-12, Policies for a Common Identification Standard for Federal Employees and Contractors;

(2) Office of Management and Budget (OMB) guidance M-05-24, Implementation of Homeland Security

Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors;

e4

(3) Federal Information Processing Standards Publication (FIPS PUB) Number 201, Personal Identity

Verification of Federal Employees and Contractors;

(4) Army Directive (AD) 2011-008, Army Implementation of Homeland Security Presidential Directive

(HSPD)-12. AD 2011-08 provides Army guidance and assigns responsibilities for the implementation of

HSPD-12;

(5) AD 2014-005, Policy and Implementing Procedures for Common Access Card Credentialing and Access for Uncleared Contractors. AD 2014-005 Army policy and procedures for the unescorted access of uncleared contractor employees to DoD installations, facilities, and/or networks to which the Army is responsible for physical security;

(6) Federal Acquisition Regulation (FAR) Subpart 4.13, Personal Identity Verification of Contractor

Personnel; and

(7) FAR 52.204-9, Personal Identity Verification of Contractor Personnel;

(Ref Item 2.) Pre-Award access is not required.

(Ref Item 2.) This DD254 reflects the security requirements for the contract when awarded.

o The DD254 "certifier" (signer in Item 16 of the DD254) shall ensure the DD254 Package correctly/accurately reflects the Security Guidance/Requirements of the contract document(s) (as identified by the RA Contract

POC) as of the date of preparation. Changes made to the contract/contract documents without the certifier’s knowledge and concurrence shall invalidate this certification.

o Failure of the RA Contract POC to revise the DD254 Package whenever the contract is changed/modified may result in the DD254 Package being unable to protect classified information provided to industry (contractors).

This shall result in:

(1) The DD254 Package being considered invalid and unable to protect classified information/materials.

(2) A reportable Security Infraction/Violation.

(Ref Item 8.c.) When DCSA is relieved of security oversight responsibility for cleared facilities performing on

Army programs, the ISS is responsible for forwarding a copy of the completed and certified DD Form 254 to the cognizant security agency, as well as any additional offices listed in block 17. (AR 380-49, paragraph 4-5.b)

FOR OFFICIAL USE ONLY (FOUO) INFORMATION.

o In addition to classified information, certain types of unclassified information also require application of access and distribution controls and protective measures for a variety of reasons. Such information is referred to collectively as Controlled Unclassified Information (CUI). The originator of a document is responsible for determining at origination whether the information may qualify for CUI status, and if so, for applying the appropriate CUI markings. This enclosure identifies the controls and protective measures developed for DoD

CUI:

(1) For Official Use Only (FOUO).

(2) Law Enforcement Sensitive (LES).

(3) DoD Unclassified Controlled Nuclear Information (DoD UCNI).

(4) LIMITED DISTRIBUTION.

(5) As well as some of those developed by other Executive Branch agencies.

(6) Source Selection Information.

(7) Proprietary Data (of other contractors).

o FOUO Information generated and/or provided under this contract shall be safeguarded and marked IAW DoDM

5200.01, Volume 4; DoD 5200.1-R, Appendix 3; AR 380-5; and AR 25-55.

o This item is linked directly to the Freedom of Information Act (FOIA) and the appropriate exemptions are in accordance with (IAW) 5 U.S.C. § 552(b), and should only be marked if the information the contract company will be accessing is protected under the FOIA. The NISPOM does not provide guidance concerning FOUO;

the DD254 must provide guidance on protection procedures in Item 13.

(1) Specific guidance in the NISPOM; DoD 5400.7, Department of Defense Freedom of Information Act

Program (FOIA).

e5

(2) As specified in Attachment 2, “Protecting Controlled Unclassified Information (CUI).”

(Ref Item 10.j.) CONTROLLED UNCLASSIFIED INFORMATION (CUI).

o All Army Activities (ALARACT) Message 340/2012, DTG: P 110553Z DEC 12, Subject: Handling and

Protection of Controlled Unclassified Information (CUI), paragraph 4 states: “DoD Contractors. When CUI is to be provided to, or generated by DoD contractors, dissemination controls and protective measures will be included in pertinent contract documents such as the contract clause, statement of work, and DD Form 254

(DoD Contract Security Classification Specification). Solicitations and contracts will included a non-disclosure of information clause that prohibits release of unclassified information to the public without approval of the army contracting activity (e.g., Defense FAR Supplement (DFARS) 252.204-7000). The clause will apply to all contractors.”

o Contractor employees having access to sensitive, proprietary information shall be required by the Requiring

Activity (RA) to sign an “Organization Non-Disclosure of Information Agreement” to prevent a Conflict of

Interest. (DoD Manual (DoDM) 5200.01-V4, 24 Feb 12, Enclosure 3 - Identification and Protection of

Controlled Unclassified Information (CUI)) Solicitations and contracts shall use an “Organization Non-

Disclosure of Information” clause that prohibits release of unclassified information to the public without approval of the contracting activity (e.g., Defense Federal Acquisition Regulation Supplements (DFARS)

252.204-7000).

(Ref Item 10.k.) AR 25-2, Information Assurance (IA), establishes IA policy, roles, and responsibilities.

o Information Assurance (IA) refers to the protection of systems and information in storage, processing, or transit from unauthorized access or modification; denial of service to unauthorized users; or the provision of service to authorized users. It, includes:

(1) Measures necessary to detect, document, and counter such threats.

(2) Measures that protect and defend information and ISs by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation.

(3) Providing for the restoration of Information Systems (ISs) by incorporating protection, detection, and reaction capabilities.

(4) This regulation designates IA as the security discipline that encompasses Communications Security

(COMSEC), Information Security (INFOSEC), and control of compromising emanations (TEMPEST).

o Information Technology (IT) refers to hardware, firmware, and software used as a part of an information system to perform DOD information functions. It includes:

(1) Computers, telecommunications, automated information systems, and automatic data processing equipment.

(2) Any assembly of hardware, software, or firmware configured to collect, create, communicate, compute, disseminate, process, store, or control data or information.

(Ref Item 10.k.) Use of Government Owned Computers:

o The RA Contract POC will ensure the contractor employee(s) is/are provided with government owned computers at government facility(ies) for processing unclassified/PII/FOUO/CUI/Classified/CMI Government material/information provided, collected, generated and/or developed during the contract’s period of performance.

o The purpose of the government owned computer is to conduct business as required by this contract. The contractor employee is prohibited from any other use of the government owned computer.

o The contractor employee shall not process any government owned information on any contractor or person-ally owned computers, including any government information provided, collected, generated and/or developed during the contract’s period of performance.

o Only contractor employees who meet the requirements of AR 25-2 and AR 380-67 shall be granted access to restricted areas, sensitive information or government equipment and/or unclassified networks (i.e., Enterprise

NIPRNet (Non-Secure Internet Protocol Router Network).

o Contractors placed in IA/IT Positions shall be in compliance with:

(1) DoD 5200.2-R, DoD Personnel Security Program;

(2) AR 25-2, Information Assurance, paragraph 4-14 Personnel Security Standards;

(3) AR 380-67, The Department of the Army Personnel Security Program; and

(4) Any additional guidance as directed by RA’s G-6/S-6.

e6

(Ref Item 10.k.) Personnel Security Standards. Personnel who require access to Government Network(s) processing defense information (unclassified/PII/FOUO/CUI/classified/CMI) to fulfill their duties under this contract shall possess the appropriate security ACCESS (based on AFFILIATION), commensurate with the security requirements of the Government Network being accessed. This ACCESS shall be based on the appropriate

ACCESS requirements as delineated in AR 380-67 and as identified by the contract. The government will not grant access to classified government network(s) to contractor personnel not having the required security clearance and contractual requirement.

(Ref Item 10.k.) The contractor is only authorized to access the appropriate government network as identified in the DD254, Item 10.k, as required for performance of this contract:

o The Enterprise Non-secure Internet Protocol (IP) Router Network (NIPRNet).

(Ref Item 10.k.) Access by Non-U.S. Citizens.

o Minimize employment of non-U.S. citizens in IT positions. However, compelling reasons may exist to grant access to DoD IT resources in those circumstances in which a non-U.S. citizen possesses a unique or unusual skill or expertise that is urgently needed for a specific DoD requirement and for which a suitable U.S. citizen is not available.

o Non-U.S. citizens may hold IT positions under the conditions described in AR 25-2 and AR 380-67 if:

(1) There is written compelling-reason justification.

(2) It is IAW applicable disclosure policies and authorized for foreign disclosure (for example, National

Disclosure Policy 1, DoDD 5230.9, DoDD 5230.25) and U.S. statutes (for example, the Arms Export

Control Act, 22 USC 2551, et. seq.).

(3) The required documentation is in the Certification and Accreditation (C&A) package. (NOTE: The written approval must be on file and provided as an artifact to the C&A package, before requesting the required investigation.)

(4) The required investigation must be completed and favorably adjudicated before authorizing access to DoD systems or networks. Interim access is prohibited.

(5) The Designated Approving Authority (DAA) that accredited the system approves the assignment requirement(s) in writing.

(6) The data owners approve the assignment requirement(s) in writing.

(7) The Industrial Security POC (identified in the DD254, Item 13) approves the assignment requirement(s) in writing.

PERSONNEL SECURITY CONTROLS AND ACCESS. Individuals assigned to IT–III positions who lose their clearance, or have access to classified systems suspended pending the results of an investigation, will be barred access to the ISs until favorable adjudication of that investigation. (AR 25-2, para 4-14b(2)) o Waivers for IT–III personnel for continued access to unclassified systems:

(1) Waivers will be justified in a written request, with the Commander’s concurrence, to the Designated

Approving Authorities (DAA) for approval. Access will be granted only upon DAA authorization. This request and approval will become part of the C&A package. (AR 25-2, para 4-14b(2))

(2) Waivers processed for IT–III personnel only are valid for a period not to exceed 6 months. If a second waiver extension is required, one may be granted as long as a new request for waiver is submitted to the

DAA and approved by the first general officer, or equivalent in position or civilian grade, in the Chain of

Command. (AR 25-2, para 4-14b(3))

(3) While the Commander and DAA have the discretion to process the waiver for IT–III, it is important that this discretion is not without limits.

(1) The Commander and DAA are advised to proceed carefully and deliberately in making a determination on whether the individual constitutes a security risk.

(2) The servicing legal office should be consulted for advice concerning personnel, security, contract and labor relations issues that may impact the final determination. Recheck local records to identify any issues that may be a deciding factor in the waiver process. (AR 25-2, para 4-14b(5))

(4) New, credible derogatory information revokes any standing waiver and results in immediate denial of access to IT systems (exceptions are for military only based on immediate supervision of the individual while on the IS). (AR 25-2, para 4-14b(6))

(5) Contractor, FN or temporary individuals assigned to any IT positions who have their unclassified system or network accesses revoked or suspended for derogatory reasons, will be barred access to the ISs until e7 favorable adjudication of that investigation. The organization’s IASO/IANO/IAM (as appropriate) will identify any other official systems/networks for which that individual has an account (for example, AKO) and have it temporarily disabled or suspended. (AR 25-2, para 4-14b(7))

Personnel Security Controls:

o Information Systems (IS) Access: The organization’s Information Assurance Security Officer

(IASO)/Information Assurance Network Officer (IANO)/Information Assurance Manager (IAM) (as appropriate) shall identify any other official systems/ networks for which that individual has an account (for example, AKO, JPAS, ACCS, DCSA NCAISS/ISFD, DTIC, etc.) and have it temporarily disabled or suspended.

o The contractor should consult with the servicing legal office for advice concerning personnel, security, contract and labor relations issues that may impact the final determination. Recheck local records to identify any issues that may be a deciding factor in the waiver process.

(Ref Item 10.k.) IA Training Requirements: All contractor employees shall receive basic Computer Security

Awareness Training (to include Phishing Awareness, Personal Electronic Devices (PEDs), PII and Safe Home

Computing).

(Ref Item 10.k.) U.S. Army Information Assurance (IA) Training and Certification.

o Compliance with 05-PR-M-0002, Information Assurance (IA) Training and Certification, Version 5.0, Mar

12; Issuance Date: 28 Feb 06; Update: 30 Mar 12. Army IA personnel must attain and maintain IA certifications appropriate for the technical, specialty and/or management positions.

o The IA workforce includes all privileged users, specialty positions, and IA managers who perform any of the functions described in DoD 8570.01-M, Change 2 Chapters 3 - 5 and 10-11 across all occupational specialties, or whether the duty is performed full-time or part-time as an additional/embedded duty (DoD 8570.01-M par

C1.4.4.4).

o The following positions under this contract effort will require the contractor to fill the following Information

Technology (IT) Personnel Security Standards positions IAW AR 25-2, Paragraph 4-14:

(1) IT-III:

o DoD Acquisition Regulations System (DFARS) 48 CFR Parts 239 and 252 RIN 0750-AF52, Supplement; IA

Contractor Training and Certification (DFARS Case 2006-D023) apply to this contract.

o Contractor personnel shall agree to obtain the appropriate baseline certification upon contract award as a

“condition of employment.”

(Ref 11.a) HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACT-

OR’S FACILITY OR AT A GOVERNMENT ACTIVITY: Contractual performance locations will be as identified in Items 8.a and 13. Contractor performance is restricted to the CONUS AOR. Cleared contractor personnel will provide supplemental controls IAW the NISPOM.

(Ref Item 11.e.) PERFORM SERVICES ONLY.

o A part of the scope for this contract he contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform

Financial and Real Estate Analytical and Consulting Support Services as defined in this Performance Work

Statement except for those items specified as government furnished property and services.

(Ref Item 11.g.) BE AUTHORIZED TO USE THE SERICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER.

o DD Forms 1540 (Registration for Scientific and Technical Information Services) and (Military Critical

Technical Data Agreement) must be completed for registration with DTIC. The Garrison must submit the DD

Form 1540 to DTIC on behalf of the contractor. For subcontractors, the prime contractor submits the DD 1540 with the Garrison verifying need-to know. The contractor may submit DD Form 2354 (after registration with

DTIC) to the Defense Logistics Services Center for access to unclassified, militarily critical technical data from other DoD sources. The Garrison must certify the need-to-know to DTIC..

e8

(Ref Item 11.j. and 11.m.) HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS. OPSEC awareness and execution is crucial to Army success.

o OPSEC requirements apply to National Industrial Security Program (NISP) contractors when it is determined that additional safeguards are essential for specific contracts; they are imposed in addition to the standard requirements of the NISP.

o OPSEC requirements are additional to the requirements of the NISPOM. The prime contractors may not impose

OPSEC requirements on their subcontractors unless the KO approves the OPSEC requirements.

(Ref Item 11.l.) OTHER:

o The transfer of materials, courseware, manuals, and/or documents to other Independent Research and

Development (IR&D) efforts, contracts, or company proposals is not permitted.

o Any information obtained, developed, or researched during performance of this contact is considered to be the intellectual property of the U.S. Government. This includes:

(1) Any work(s) not directly relating to this contract, but includes/involves information obtained during interviews or researched during the performance of this contract.

(2) Any work(s) based on the contract performance subjects, and/or organizations.

o Disclosure to the Public. Contractors shall not disclose unclassified, PII, FOUO, CUI, or classified information pertaining to a classified contract to the public without prior review and clearance as specified in the DD254 for the contract, or as otherwise specified by the GCA (NISPOM, paragraph 5-511).

o The RA Contract POC shall provide all required Security Classification Guides (SCGs) for the contractor’s use at all contract performance locations.

o The contractor shall ensure all classified materials used or generated under this contracting effort:

(1) Are marked, handled, stored and protected IAW AR 380-5 and the appropriate SCG(s).

(2) Any classification questions beyond the scope of the SCG or that cannot be derivatively classified shall be directed to the RA Contract POC for this contract.

All classified materials:

o Shall be marked, handled, stored and protected IAW AR 380-5 and the appropriate classification guide(s). The

RA Contract POC shall provide security classification guidance for performance of this contract.

o Any classification questions beyond the scope of the classification guide, or that cannot be derivatively classified shall be directed to the RA Contract POC for this contract.

Prior Approval/Authorize of the Requiring Activity is required prior to the Subcontracting of this contract:

Due to the sensitive nature of the end user and/or its mission, the Requiring Activity (RA) must approve and provide written concurrence for the subcontracting of this contract. The RA COR and RA internal/support Industrial Security

Specialist (ISS) are responsible to provide input on whether or not to approve the subcontracting.

SUBCONTRACTING REQUIREMENTS

o The KO is responsible to provide Prior Approval/Written Concurrence if the subcontractor will require access to any of the following access requirements:

(1) Operation Security (OPSEC) requirement (DD254, Item 11.j.);

o The Prime Contractor (Item 6.a.) is responsible to provide the following information to the RA/RA COR:

(1) What portion(s) of the contract they plan to subcontract.

(2) To whom they are planning to subcontract.

(3) POC and contact information of the company being considered for subcontracting.

o The Requiring Activity (RA) must approve and provide written concurrence for the subcontracting of this contract. The RA COR and RA internal/support Industrial Security Specialist (ISS) are responsible to provide input on whether or not to approve the subcontracting.

o Preparation of the DD254 for subcontracting.

(1) The Prime contractor is responsible to prepare the DD254 for subcontracting. The government will not prepare the DD254 for subcontracting nor process the document for subcontractors.

(2) The contractor’s FSO prepares the DD254 for subcontracting, ensuring it meets the security guidance/requirements of the Prime Contract for tasks being subcontracted.

(3) The FSO is responsible to certify the DD254 for subcontracting by signing in item 16 as the certifying official.

(4) Submission of the Subcontracting DD254 to the KO for written approval of subcontracting:

e9 o The KO is the primary Point of Contract for the awarded contract and is responsible to consolidating the input from the Key Personnel and approving the subcontracting. The key personnel in the preparation of the

DD254 are:

(1) The program (program/project manager, RA COR, RA Contract POC, etc.) and the RA ISS (individual certifying the DD254 for the contract). The program and ISS recognizes the security requirements that the contractor will need to follow.

(2) The technical/subject matter expert personnel, and contracting personnel. The technical/subject matter expert personnel understand what information or equipment in the program requires protection, and the technical aspects of the requirements.

(3) The KO shall certify their “Approval for Subcontracting” by signing in Item 13 of the DD254 being used for subcontracting.

(4) The COR will maintain a record of all prime and subcontracts for metrics purposes, and provide a copy to the Command ISS.

Item 14. ADDITIONAL SECURITY REQUIREMENTS: (continued)

(Ref Item 10.j.) DoD Regulation 5400.7, “DoD Freedom of Information Act Program."

(Ref Item 10.j.) DoDM 5200.01, Vol 4, “DoD Information Security Program-Controlled Unclassified

Information (CUI).”

(Ref Item 10.j.) ALARACT 340/2012, DTG: P 110553Z DEC 12, Subject: Handling and Protection of

Controlled Unclassified Information (CUI), paragraph 4. (DFARS Clause 252.204-7000)

The contractor shall operate under:

o Previously identified Directives, Instructions, Regulations and Manuals;

o HQDA (HQDA Subordinate Organization(s) if applicable) and the RA’s operational security procedures and policies;

o Any other specific theater/local requirements, regulations, and/or policies for controlling materials and information associated with this contract.

o In case of conflict, the contractor shall adhere to the more stringent security requirements.

Contractors are not authorized to courier classified information and/or materials under this contract.

While performing duties under this contract: The contractor shall adhere to security regulations and policies of the

Installation (where contractual performance will take place), the RA, and HQDA. The RA Contract POC shall provide this information and copies of all pertinent materials.

TRAINING REQUIREMENTS. The contractor is responsible to ensure they provide continuing security education to their employees IAW the NISPOM. Contractor employees shall receive required training from the

Requiring Activity. The RA Contract POC (COR) is responsible to ensure all contractor employees receive and complete the following training:

o Information Assurance (IA) Training Requirements: All contractor employees shall receive annual basic

Computer Security Awareness Training (to include Phishing Awareness, Personal Electronic Devices (PEDs), PII and Safe Home Computing).

o Security Training Requirements: Receive initial, refresher, and annual training on Information Security, “Controlled Unclassified Information (CUI) Policies, Principles, and Practices;" Personnel Security, Reporting Requirements, and "Threat Awareness and Reporting Program (TARP) Training."

o U.S. Army Information Assurance (IA) Training and Certification. DFARS 52.209-4024, requires all contractor employees and associated subcontractor employees filling IT-II Positions (IAW AR 25-2) to complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DFARS 252.239-7001, DFARS 239.7102, DoDD 8570.01, DoD 8570.01-M, and AR 25-2 within six months of employment.

o Additional Training Requirements (as applicable):

(1) Visitor Policy at the RA.

(2) Visits by Foreign Nationals.

(3) Escort procedures (and verification of “Need-to-Know”).

(4) Unit Security Policies, Procedures and Requirements.

(5) RA Standard Operating Procedures (SOP).

(6) Security Classification Guide(s) (SCG[s]) as applicable.

(7) Use of the Secure Communications Devices.

(8) Reproduction of Classified Materials.

(9) Unauthorized Items.

(10) Personal Electronic Devices.

(11) Ethics Training.

Contract Completion:

o “Contract completion” actions (as applicable) shall be taken when:

(1) A contractor employee’s access is suspended (for any reason).

(2) Termination of a contractor employee’s employment.

(3) Completion/Termination of the contract.

(4) Or (sooner) if the purpose of the release has been served (i.e., the contract was completed prior to the estimated completion date).

o All unclassified/PII/FOUO/CUI/Classified/CMI Government material/information received, collected, and/or generated in performance of this contract are government property.

(1) All contractor owned memory and storage devices/media/materials (whether electrical, magnetic or optical) used to process unclassified/PII/FOUO/CUI/Classified/CMI Government material/information is government property. These devices include any USB/IEEE-1394 (Firewire) Media Storage Devices (i.e., flash drives, memory sticks, CDs, DVDs, discs, external hard drive, etc.).

(2) The contractor employee shall return all such materials and information to the HQDA (HQDA Subordinate

Organization(s) if applicable) RA Contract POC from which it was received; unless retention or other disposition instructions are approved in writing by the:

(a) RA Contract POC;

(b) RA Security Branch and Industrial Security POC;

(c) HQDA G-2/Command ISS; and

(d) The Acquisition and Contracting Office awarding this Contract/Task Order.

o Contractor employee(s) are responsible to account for and return the following to the RA Contract POC:

(1) Government issued CACs and any other identification badges issued to contractor personnel by the ID

Card Section at each contract performance location identified in Items 8.a. and 13.

(2) All access/identification badges issued to contractor personnel by the RA.

(3) Entry passes/vehicle decals issued to them by the Provost Marshal's Office at any of the contract performance location(s) identified in Items 8.a. and 13.

Contractor Employee(s) Working for the Government:

o Contractor employees shall explicitly identify themselves as a "Contractor working for the Government" to all organizations and individuals while employed under the provisions of this contract. This includes conducting mission related support; attending meetings, conferences, and seminars; in message traffic and emails, signature blocks; and on the phone.

(1) Badges issued to contractor employees shall specifically identify them as a “Contractor,” and shall be prominently displayed.

(2) Contractor workspace (office, laboratory, desk) shall contain a sign signifying the space is occupied by

“contractor employee” to ensure that Federal employees and the public know that they are not Federal employees. The RA Contract POC will coordinate the contractor employees work area to ensure the contractor is not granted access to information they are not authorized under their contract performance.

(3) When the contractor employee status is not obvious to third parties, they are required to identify them-selves as such to avoid creating an impression in the minds of the public they are Government officials.

(4) Contractors must ensure all contractor produced products (documents or reports) are marked as contractor products or disclose the fact of contractor participation.

o Contractor employees shall not represent themselves as a government employee (GG, GS, SES, WG, WS, or

WL) of the RA, the Department of the Army, or of any other government agency.

o Representation means to “represent.” Contractors may be placed in a position where they “represent” the government at meetings, conferences, and/or seminars; however, contractors are not authorized to provide the

“final” position or “approval” of an action. Government personnel have the responsibility to provide the “final” position or “approval” of an action. This responsibility shall not be delegated.

o Contractors shall not be empowered to act in place of the government. Contractors shall consider themselves as a “limited agent,” with set limits when acting as a government representative.

(1) Limits and responsibilities shall be set beforehand and the contractor shall be thoroughly briefed concerning their responsibilities and the limit of their authority.

(2) The RA Contract POC shall provide a written statement outlining these responsibilities and the limit of the contractor’s authority.

(3) A signed copy of this document shall be kept as part of the RA Contract POC's file for the contract.

Contractor Visits: Any visits or meetings conducted/attended by the contractor shall be IAW the NISPOM; AR

380-5, OUSD Memorandum, Facilitating Classified Visits within the Department of Defense (1 Apr 05); and other applicable directives/ regulations as required.

o The Joint Personnel Adjudication System (JPAS), the personnel security system of record for the Department of Defense (DoD), will be used to verify the ACCESS level (based on the contractor’s AFFILIATION - the company employing the individual contractor) for visitors requiring access to classified information.

o Visit Authorization Letters (VALs) are no longer required for personnel whose ACCESS level and

AFFILIATION are accurately reflected (listed) in JPAS. Use of JPAS fulfills the requirements of paragraph

6-202 of the Information Security Program Regulation (DoD 5200.1-R). VALs shall still be required for visits outside of the Department of Defense, and for locations/ facilities not having JPAS access or capabilities.

o See DD254 Attachment 3 for more specific information on ACC’s requirements for “Contractor Visits to HQ

ACC (ACC Subordinate Organization(s)) (Government) Locations/Facilities.”

PERSONNEL CLEARANCE LEVEL (PCL): All Contractor personnel performing under this contract require a FINAL SECRET Personnel Clearance Level (PCL). A FINAL SECRET PCL is based on the favorable adjudication of a current (less than ten [10] years old) National Agency Check with Local Agency and Credit

Checks (NACLC) or a Tier 3 (T3) investigation; and the individual does not have more than a 24 month break in service.

o The Tier 3 (T3) Background Investigation replaced the NACLC investigation effective 16 Feb 16.

Investigations conducted after 16 Feb 16, will be based on a T3 Investigation.

o Outdated NACLC or T3 investigations will require a T3 Reinvestigation (T3R).

o T3 Reinvestigations (T3Rs):

(1) Five (5) year reinvestigations will be required for a Secret clearance beginning 30 Sep 17.

(2) HOWEVER - “Until further notice, Tier 3 (T3) Periodic Reinvestigations (PRs) (T3Rs) will continue to be conducted at ten (10) year periodicity. The Department will delay implementation of five-year T3Rs until the Office of Personnel Management (OPM) eliminated their backlog or a modernized solution is available that meets or exceeds the Federal Investigative Standards.” (OUSD(I) Memorandum, Extension of Periodic Reinvestigation Timelines to Address the Background Investigative Backlog, 17 Jan

17; HQDA G-2 Memorandum, Army Implementation of the Extension of Periodic Reinvestigation

Timelines Investigation Backlog, 2 Feb 17; and OUSD(I) Memorandum, DCSA Clarification on

Submission of Top Secret Periodic Reinvestigations (PRs), 10 Feb 17) o The contractor is responsible for ensuring employees meet (and continues to meet) the security criteria for this contract, and incur all costs associated with obtaining the required clearances. Contractor personnel shall ensure their clearance investigations do not expire.

ADVERSE/DEROGATORY INFORMATION: Compliance with AR 380-49, AR 380-67, NISPOM

(paragraph 1-302), and Defense Security Service (DSS) Industrial Security Letter (ISL) 2011-04 (23 Sep 11).

o Adverse/Derogatory information is any information that negatively reflects on the integrity or character of a cleared employee (all contractor employees granted Personnel Security Clearances (PCLs) and all employees being processed for PCLs), that suggests their ability to safeguard classified information may be impaired, or that their access to classified information clearly may not be in the interest of national security. Examples of adverse information include culpability for security violations meeting the following criteria:

(1) Drug abuse, legal and illegal drugs.

(2) Excessive use of alcohol.

(3) DUI, DWI and alcohol related incidents at work.

(4) Child/Spouse abuse.

(5) Disruptive, violent, or other inappropriate behavior in the workplace.

(6) Excessive indebtedness.

(7) Wage garnishments or other indications of financial instability.

(8) Behavior that casts doubt on the individual’s judgment, reliability or trustworthiness.

(9) Mishandling of protected information.

(10) Repeated instances of failing to follow established security procedures.

(11) The unauthorized release of classified information and/or unauthorized access to classified information systems, or other violations of information systems security requirements.

(12) Refer to the 29 Dec 05 Adjudicative Guidelines or the Adjudicative Desk Reference for additional potentially disqualifying conditions.

o Contractors are reminded that any adverse/derogatory information coming to their attention regarding cleared employees must be reported for the full duration of the individual’s employment with the company. An individual’s anticipated departure or termination of employment, for whatever reason, and whether imminent or not, does not change the contractor’s reporting responsibility.

o The Company Facility Security Officer (FSO)/contractor shall report any adverse/derogatory information coming to their attention concerning their cleared employees:

(1) To DCSA if the contractor employee has a security clearance (identified in JPAS), even if they are currently performing on an unclassified contract for the RA. (IAW the NISPOM, paragraph 1-302), and Defense

Security Service (DSS) Industrial Security Letter (ISL) 2011-04 (23 Sep 11))

(2) If the contractor employee does not have a security clearance, the RA’s G-2 PERSEC official making the

Favorable Background Check determination shall be notified.

(3) The COR, who shall (is responsible) report the Adverse/Derogatory information to the KO and the ISS.

The ISS and RA are responsible to report the information IAW AR 380-49.

(4) NOTE: The Headquarter (HQ) DA ISS should also be apprised to ensure compliance with National

Industrial Security Program (NISP) guidance and requirements.

(5) NOTE: NACIs do not fall under the NISPOM; however, you should contact the contract Requiring

Activity (RA) as Adverse/Derogatory information reports may be a factor in determining suitability for

CAC or IT access.

o Adverse/Derogatory information reports submitted pursuant to NISPOM 1-302.a should be recorded as an incident report in the Joint Personnel Adjudication System (JPAS). The Defense Industrial Security

Clearance Office (DISCO) will make a final determination of continued eligibility.

o Culpability Report is to be submitted when the responsible individual committed a violation that involved a deliberate disregard of security requirements, a violation that involved gross negligence in the handling of classified information, or the violation was not deliberate in nature but involves a pattern of negligence or carelessness. (NISPOM, paragraph 1‐304) o Contractor employees no longer meeting requirements for a Favorable Background Check, or who lose their security clearance, shall be barred from performance under the contract. The contractor shall ensure there is no lapse of contractual support without specific written authorization from the KO. The contractor is responsible to promptly replace any contractor employee who has been barred from performance under the contract, and to ensure there is no lapse in contractual performance.

o All incidents involving Critical Program Information (CPI) will be reported to the program office, DCSA, and the local Counterintelligence (CI) office.

ADVERSE/DEROGATORY INFORMATION REPORTS:

o The Company FSO/contractor shall report Adverse/Derogatory information obtained concerning contractor personnel assigned to/working under/or to be assigned this contract in an expeditious manner through appropriate G-2/S-2/J-2 security channels (the use of secure communications channels may be required):

o The report shall contain the:

(1) The contractor’s Name/SSAN.

(2) The complete name of the company employing the contractor. Please include the Company FSO’s name and contact information, and the CAGE Code.

(3) The Contract Number the contractor is assigned to/working under/or to be assigned to.

(4) Information concerning the Adverse Information being reported.

o The report shall be provided to the:

(1) RA Contract POC;

(2) RA’s Security Branch (G-2/S-2) and RA Industrial Security POC;

(3) HQDA G-2 and Command ISS.

o The HQ HQDA ISS shall promptly forward the information to the contractor’s FSO’s and other locations as…