ATT0074 DD254 Appendix B- Army Handbook for SCI Contracts.pdf

HANDBOOK FOR US ARMY SENSITIVE COMPARTMENTED INFORMATION (SCI) CONTRACTS

Army

Handbook For

Sensitive Compartmented

Information (SCI) Contracts

HQ USA INSCOM

FORT BELVOIR, VA 22060

Contractor Support Element Fort Meade, MD 20755

31 May 2005

IASE (380) 31 May 2005

MEMORANDUM FOR Handbook Users

SUBJECT: Handbook for SCI Contracts

1. This handbook is a revision of the 1998 version and, in conjunction with DoD 5105.21.M-1, provides a handy reference for those involved in SCI contract administration. As a guide, it does not answer all possible questions nor serve as a full substitute for the several policies, directives, regulations, or directives on which it is based. It is intended to be useful as a tool for those directly involved in SCI contracts. We hope it will be useful to help Contracting Officer’s Representatives / Contract Monitors (COR/CMs), Contractor Special Security Officers (CSSOs), and Facility Security Officers (FSOs) to ensure they meet the requirements of the SCI program to the correct standard.

2. Your comments and suggestions regarding this handbook are sincerely solicited, and will be given every consideration.

3. Should you have any questions concerning your SCI Contract, please contact Contractor Support Element Operations, at Fort Meade, Maryland 20755-5910;

Telephone 301-677-6982/2926.

ORIGINAL SIGNED

BRENDON A. XIQUES

ACofS, Security

TABLE OF CONTENTS

Paragraph Page

CHAPTER 1 - INTRODUCTION

PURPOSE 1-1 1-1

REFERENCES 1-2 1-1

ACRONYMS AND ABBREVIATIONS 1-3 1-1

APPLICABILITY 1-4 1-1

RESPONSIBILITIES 1-5 1-1

CHAPTER 2 - SCI CONTRACTS

INTRODUCTION 2-1 2-1

DD FORM 254 2-2 2-2

CONTRACT COMPLETION/EXPIRATION 2-3 2-2

CONTRACTING OFFICER’S REPRESENTATIVE/CONTRACT MONITOR 2-3 2-2

& THE CONTRACT CYCLE

CHAPTER 3 - PERSONNEL SECURITY /ACCESS/ACCESS AUTHORIZATIONS

INTRODUCTION 3-1 3-1

SCI ACCESSES 3-2 3-1

THE ARMY CONTRACTOR AUTOMATED VERIFICATION SYSTEM 3-3 3-1

(ACAVS)

JOINT PERSONNEL ADJUDICATION SYSTEM 3-4 3-2

INDOCTRINATION 3-5 3-3

DEBRIEFING 3-6 3-3

REQUEST FOR INTERIM SCI ACCESS 3-7 3-4

FOREIGN TRAVEL/FOREIGN CONTACTS 3-8 3-4

CONTINUING SECURITY AWARENESS PROGRAMS 3-9 3-4

UNFAVORABLE/ADVERSE INFORMATION 3-10 3-4

SUSPENSION OF ACCESS TO SCI 3-11 3-4

INTENT TO DENY OR REVOKE SCI ACCESS ELIGIBILITY 3-12 3-5

REQUESTS FOR INFORMATION 3-13 3-5

MENTAL HEALTH EVALUATIONS 3-14 3-5

CHAPTER 4 - INFORMATION SECURITY

INTRODUCTION 4-1 4-1

RELEASE OF SCI MATERIAL TO CONTRACTORS 4-2 4-1

SCI COVER SHEETS 4-3 4-2

SCI ACCOUNTABILITY 4-4 4-2

REPRODUCTION OF SCI MATERIAL 4-5 4-2

SCI STORAGE 4-6 4-2

COURIERS 4-7 4-2

DESTRUCTION OF SCI MATERIAL 4-8 4-2

CHAPTER 5 - SECURITY VIOLATIONS 5-1 5-1

i

CHAPTER 6 –PHYSICAL SECURITY

INTRODUCTION 6-1 6-1

SCIF ACCREDITATION PROCESS 6-2 6-1

INSPECTIONS 6-3 6-1

REACCREDITATION 6-4 6-2

CHANGES TO SECURITY POSTURE 6-5 6-2

WITHDRAWAL AND TRANSFER OF SCIF ACCREDITATION 6-6 6-2

EMERGENCY ACTION PLANS (EAP) 6-7 6-2

TEMPORARY SECURE WORKING AREA 6-8 6-2

CONTROL OF ACCESS TO A SCIF 6-9 6-2

STANDARD PRACTICE PROCEDURES 6-10 6-2

CO-UTILIZATION OF SCIFS 6-11 6-5

CHAPTER 7 – TECHNICAL SECURITY

PROCESSING REQUESTS FOR TECHNICAL SURVEILLANCE 7-1 7-1

COUNTERMEASEURES (TSCM) EVALUATIONS

CONTROL OF COMPROMISING EMANATIONS (TEMPEST) 7-1 7-1

CHAPTER 8 - INFORMATION SYSTEM (IS) ACCREDITATION

INTRODUCTION 8-1 8-1

IS ACCREDITATION PROCESS 8-2 8-2

MODIFICATION 8-3 8-3

DURATION OF ACCREDITATION 8-4 8-3

APPENDICES

A. REFERENCES A-1

B. ACRONYMS AND ABBREVIATIONS B-1

C. GLOSSARY C-1

D. FORMS COMMONLY REFERRED TO IN THE HANDBOOK D-1

E. INSTRUCTIONS AND EXAMPLES E-1

E-1 EXAMPLE OF DD FORM 254 E-1-1

E-2 INSTRUCTIONS FOR PREPARATION OF THE DD FORM 254 FOR E-2-1

ARMY SCI CONTRACTS & SUBCONTRACTS

E-3 EXAMPLE OF ARMY SCI ADDENDUM TO DD FORM 254 E-3-1

E-4 INSTRUCTIONS FOR COMPLETION OF THE ARMY SCI ADDENDUM E-4-1

E-5 EXAMPLE OF REQUEST FOR COURIER ORDERS E-5-1

E-6 EXAMPLE OF REQUEST FOR CSSO/ACSSO APPOINTMENT ORDERS E-6-1

E-7 EXAMPLE OF REQUEST FOR INDOCTRINATION AUTHORITY E-7-1

E-8 SECURITY VIOLATION INVESTIGATION REPORT E-8-1

E-9 EXAMPLE OF REQUEST FOR ESTABLISHMENT OF SCIF E-9-1

E-10 EXAMPLE OF REQUEST FOR CUA E-10-1

ii

E-11 EXAMPLE OF CUA E-11-1

E-12 IS RISK/VULNERABILITY ASSESSMENT E-12-1

iii

THIS HANDBOOK SUPERSEDES THE PREVIOUS EDITION OF 1 SEPTEMBER 1998

AND ALL PREVIOUS EDITIONS

CHAPTER 1 INTRODUCTION

1-1. PURPOSE. The handbook provides security guidance for Army User Agencies, Army-supported Combatant Commands, and their supporting contracting offices, Contracting Officer’s Representatives/Contract Monitors (COR/CM) and Contractor Special Security Officers (CSSO)/Facility Security Officers (FSO)/Security Points of Contact (Scty POC) who process Sensitive Compartmented Information (SCI) contract actions.

NOTE: This handbook does not, nor will it try to, cover every possible situation.

The material presented covers the majority of basic or routine situations and requirements which arise as a normal part of providing proper security for SCI.

This handbook should be used in conjunction with DoD 5105.21-M-1.

1-2. REFERENCES. Related publications are listed in Appendix A. This handbook is not designed as a stand alone guide, and as such should always be used in conjunction with the applicable manuals, regulations and directives.

1-3. ACRONYMS AND ABBREVIATIONS. Acronyms and abbreviations not described in DoD 5105.21.M-1 are shown in Appendix B.

1-4. APPLICABILITY. This handbook applies to all Army agencies (to include National Guard and Army Reserves) involved with Army SCI contracts, and Army-supported Combatant Commands. It also applies to all contractors executing Army SCI contracts.

1-5. RESPONSIBILITIES.

a. Headquarters USAINSCOM. HQ, USAINSCOM has sole responsibility and authority for providing SCI contractor security oversight and support to Army agencies which award SCI contracts, and to the contractors which are awarded these SCI contracts/subcontracts. Commander, USAINSCOM executes this mission through the Assistant Chief of Staff (ACofS), Security (G-2), Contractor Support Element (CSE).

The CSE will manage and maintain the Army Contractor Automated Verification System (ACAVS). ACAVS is a web-based system used by User Agency Contracting Officer’s Representatives/Contract Monitors, contractor security officers, and CSE to process requests for SCI access, adding cleared contractors to additional SCI contracts, upgrading contractor SCI accesses, requesting visit certifications, and submitting DD Forms 254 for Army-level concurrence. ACAVS is an electronic system replacing paper requests.

Army Special Security Office (SSO) responsibilities in support of contractor operations are limited to the following:

Assisting the Army COR/CM in affecting coordination with CSE.

Providing SCI communications and pouching support, indoctrinating/debriefing

1-1 contractor personnel, assistance with actions received from CCF, and providing storage space for SCI material on a case-by-case basis, when requested by CSE.

b. USAINSCOM, ACofS, Security (G-2), Contractor Support Element (CSE): Provides centralized SCI contract security oversight and support to Army agencies and Army-supported Combatant Commands which award SCI contracts and contractors executing SCI contracts and related subcontracts. Responsibilities include the following:

1. Interpret and assist in the development of SCI security policy and procedural guidance as it pertains to contractor operations.

2. Coordinate as necessary with Department of the Army (DA), other Military Departments (MILDEP(s) and other government agencies concerning co-utilization of facilities and security services.

3. Conduct final review of all annual Defense Intelligence Agency (DIA) inspection reports.

4. Assist as requested for SCI security training for COR/CM(s).

5. Conduct security training of contractor security officers.

6. Conduct review and concurrence of all DD Forms 254 for SCI access.

7. Designate contractors as Army SCI companies by assigning a numerical designator to companies with verified CAGE codes and Top Secret facility clearances.

The company code is used to keep its contractual actions under the proper company.

8. Maintain the Army Contractor Automated Verification System (ACAVS) with information relative to all Army SCI contracts, COR/CM's, User Agencies, companies, their facilities and contracts, personnel.

9. Provide advice and assistance concerning SCI security oversight and support to Army SCI contractor operations.

10. Process requests for SCI access.

11. Requests to add personnel to additional contracts.

12. Requests for visit certifications.

13. Requests to upgrade SCI accesses.

14. Requests for courier orders to hand carry SCI material and approve use of commercial airlines for air courier waivers.

15. Advising and assisting the COR/CM on contractor SCI security issues.

1-2

16. Monitor status of SCI documents at termination of contract.

17. Review and approve SCIF concept proposals.

18. Requests for Co-Utilization Agreements.

19. Advise and assist the CSSO/FSO on all SCI security matters.

20. Process adverse actions.

21. Authorize indoctrinations and debriefings.

22. Appoint CSSO/ACSSO in writing to manage and implement SCI security policies for

Army-sponsored contractor SCI facilities.

23. Review and approve contractor SCI Facility (SCIF) Standard Practice Procedures (SPP).

24. Monitor status of Corrective actions taken by contractors in response to SCIF inspection findings.

25. Review and adjudicate all contractor security violation reports.

26. Accredit TSWA (non-electronic processing).

27. Approve T-SCIFs.

28. Coordinate IS accreditation actions.

c. Contracting Officer’s Representative/Contract Monitor (COR/CM): The COR/CM must be an appropriately SCI indoctrinated military or DA civilian appointed by the Contracting Officer . The COR/CM must be cleared to the level of the SCI contract and registered in ACAVS. An alternate COR/CM should be appointed and registered in ACAVS to assist the COR/CM whenever the COR/CM is not available. The duties and responsibilities of the COR/CM (duties are also listed on a link on the Contract Edit page in ACAVS), in addition to the requirements of DoD 5105.21.M-1:

1. Ensure the Senior Intelligence Officer (SIO) of their command is included in the SCI contract process (the SIO exercises overall management of SCI programs under the SIO’s security cognizance).

2. Coordinate with the CSE, concerning the proper execution of the DD Form 254.

3. Provide written notification to the CSE of his/her appointment as well as any change in appointment throughout the life of the contract.

4. Review and approve all DD Forms 254 for both prime and related subcontracts prior to forwarding to the CSE. Use ACAVS to submit DD Forms 254 and Army SCI

1-3

Addendum; review and approve (accept) subcontract DD Forms 254 and Army SCI addendum received in ACAVS.

5. Concur with the CSSO/FSO request for a SCIF if required for contract performance.

6. Review and ensure that Requests for SCI Access in ACAVS are justified under the appropriate contract prior to approval.

7. Review and approve visit requests submitted in ACAVS.

8. COR/CMs need to continually assess the need for a contractor employee to be cleared on an Army SCI contract, and take action in conjunction with the CSE to remove the employee from access when no longer needed.

9. Ensure that SCI documents required in support of an SCI contract are properly released to contractors.

10. Maintain receipts of all SCI material by contract released to contractors.

11. Establish a distribution plan for SCI materials originated or developed by the contractor.

12. Review and approve in writing, requests from the CSSO to reproduce SCI material in either hard copy or IS medium. Coordinate approval with the document originator prior to authorization.

13. Review requests from the CSSO for destruction of SCI material. Coordinate approval from the document originator prior to authorization.

14. Review and forward requests not previously identified on DD Form 254 / SCI Addendum for IS processing of SCI to the CSE.

15. Notify the CSE immediately of modification, expiration, termination, extension, or follow-on of any SCI contract.

16. Provide, within 30 days after contract termination, written disposition instructions of all documents and SCI accessed personnel to the CSSO, with an information copy to the CSE.

17. Coordinate with the CSE on all matters pertaining to security and oversight of administrative, personnel, physical, information and information systems requirements.

d. Contractor Special Security Officer (CSSO) The CSSO is assigned security responsibilities in support of a company’s SCI contractual efforts and is appointed in writing by CSE to manage the Army sponsored, DIA- accredited, SCI Facility (SCIF).

The company security officer should use the example request for appointment shown

1-4 at Appendix E-6. The CSSO must be registered in ACAVS to process requests for SCI-related actions. In addition to the requirements of DoD 5105.21-M-1, the CSSO:

1. Coordinates with CSE on all matters of SCI security support and oversight of Army SCI material, including personnel, information, administrative and Information Systems (IS) security.

2. Uses ACAVS for requesting SCI access, requesting to add cleared personnel on additional SCI contracts, requesting visits (VR), requests for upgrade of SCI accesses, and submitting sub-contract DD Forms 254.

3. Prepares the initial request for the establishment of a SCIF, in coordination with the Contracting Officer’s Representative and CSE. See Appendix E-9 for a sample format.

4. Schedules/coordinates the SCI indoctrination of employees upon notification by the CSE.

5. Ensures indoctrinated employees understand the requirements to arrange for SCI visit certifications to another SCIF.

6. Ensures access certifications are processed in ACAVS.

7. Submits the request for courier orders for travel through the COR/CM to the CSE, using the sample letter request at Appendix E-5.

8. Ensures SCI is omitted from public speeches and corporate publicity releases such as sales or promotional brochures and stockholder reports.

9. Conducts or arranges for defensive security briefings.

10. Forwards all foreign contact reports to the CSE.

11. Maintains a current SCIF Access Roster or an electronic system in lieu of the access roster, and Visitor Register.

12. Maintains document receipt records.

13. Ensures that document control personnel adhere to need-to-know procedures for each employee with SCI access.

14. Notifies the CSE of any change in the status (i.e. marriage, divorce, name change, arrest etc.) of SCI accessed personnel.

15. Continuously reviews the validity of the continued need for the accesses of each contractor in ACAVS under the company’s Company Code/CAGE Code, and takes action to delete from contracts, debrief from unneeded SCI accesses, or transfer in status.

1-5

16. Conducts a 100% inventory of an individual's SCI holdings at the time of debriefing.

17. Prepares an SCI security Standard Practice Procedure (SPP) for Army SCIF’s, and submit it to CSE for initial approval and annual review.

18. Conducts periodic physical security inspections of both the interior and exterior of the Army SCIF, to ensure adequate security safeguards and adherence to security procedures.

19. Closely monitors the destruction of SCI in order to verify the use of approved destruction devices, methods and the maintenance of proper destruction records.

20. Notifies the CSE of espionage, sabotage or subversive activities.

21. Reports all suspected/actual loss or compromise of SCI.

22. Notifies CSE immediately of any changes to Army SCI contract(s).

23. Requests in writing from the COR/CM 60 days prior to contract expiration, disposition instructions for SCI material holdings.

24. Upon completion or termination of an Army SCI contract: coordinates/debriefs or requests a Transfer-in-Status of all associated SCI accessed personnel; conduct a 100% inventory and retain, return or destroy all classified material to the COR/CM.

25. Obtains approval prior to processing SCI electronically

26. Monitors the entry of electronic and other equipment into the SCIF IAW TEMPEST/ISD requirements (Chapter 10, DoD 5105.21-M-1). Report any IS configuration changes to CSE.

27. Forwards any proposed structural changes to an Army SCIF to DIA-DAC-2A with an information copy to CSE.

28. Informs CSE of any anticipated or actual changes in CSSO/ACSSO or security personnel.

e. Facility Security Officer (FSO)/Security Point of Contact (Scty POC). The FSO/Scty POC is a contractor employee who processes SCI actions for its SCI contracts in cases where the company is not required to have a SCIF. The FSO or Scty POC must be registered in ACAVS to process requests for SCI-related actions. The FSO/Scty POC:

1. Coordinates with CSE on all matters of SCI security support and oversight of Army SCI material, including personnel, information, administrative and information systems (IS) security.

1-6

2. Uses ACAVS for requesting SCI access, requesting to add cleared personnel on additional SCI contracts, requesting visits (VR), requests for upgrade of SCI accesses, and submitting sub-contract DD Forms 254.

3. Prepares the initial request for the establishment of a SCIF, in conjunction with the COR/CM and CSE.

4. Schedules/coordinates the SCI indoctrination of employees upon notification by the CSE.

5. Ensures indoctrinated employees understand the requirements to arrange for SCI visit certifications to another SCIF.

6. Ensures access certifications are processed in ACAVS.

7. Ensures that SCI-accessed personnel are included in security awareness training, to include Defense Security Briefings, at SCI work locations.

8. Forwards all foreign contact reports to the CSE (format in DoD 5105.21-M-1).

9. Notifies the CSE of any change in the status (i.e. marriage, divorce, name change, arrest etc.) of SCI accessed personnel.

10. Continuously reviews the validity of the continued need for the accesses of each contractor in ACAVS under the company’s Company Code/CAGE Code, and takes action to delete from contracts, debrief from unneeded SCI accesses, or transfer in status.

11. Notifies the CSE of espionage, sabotage or subversive activities.

12. Reports all suspected/actual loss or compromise of SCI.

13. Notifies CSE immediately of any changes to Army SCI contracts/sub-contracts.

14. Requests in writing from the COR/CM 60 days prior to contract expiration, disposition instructions for SCI material holdings

15. Upon completion or termination of an Army SCI contract: coordinates for debrief or requests a Transfer-in-Status of all associated SCI accessed personnel.

Complies with COR/CM instructions on classified holdings (non-SCI, the FSO/Scty POC does not have a SCIF).

16. Informs CSE of any anticipated or actual changes in FSO/AFSO/Scty POC or security personnel.

1-7

CHAPTER 2 SCI CONTRACTS

2-1. INTRODUCTION.

a. This chapter outlines the process of developing security requirements and specifications for the solicitation or award of an SCI contract. The COR/CM is responsible for the completion and coordination of the DD Form 254, ("Department of Defense Contract Security Classification Specification") and the Army SCI Addendum (Must be included with all DD Forms 254 for Army SCI contracts) prior to an SCI contract being awarded.

b. During planning for the contracting of goods or services which will require access to SCI, the appointed/designated COR/CM will immediately notify and begin coordination with the CSE.

2-2. DD FORM 254.

a. The completed DD Form 254 is the basic document conveying to a contractor the contract security classification specifications and guidelines for the classification, regrading, and downgrading of documents used in the performance of a classified contract.

b. Among other functions, the DD Form 254 is used as the reference document to determine the following: whether SCI documents are to be released on a contract and the disposition of such documents upon contract expiration; whether the contractor requires a new SCIF, or may use an existing contractor or government facility; the level of SCI accesses required for that contract; whether travel to other facilities is required; the amount of lead time required to process such requests; which agency has security cognizance over the SCI material; and an estimated date for completion of the contract.

c. Appendix E-1 contains a blank DD Form 254. Appendix E-2 contains the instructions for completing the DD Form 254. Appendix E-3 contains a blank Army SCI Addendum. Appendix E-4 contains instructions for completing the Army SCI Addendum. The COR/CM may coordinate with the CSE if assistance is needed in the development of the DD Form 254. Both the COR/CM and CSE must ensure that this document is properly prepared prior to solicitation or the awarding of any SCI contract, and that it is kept current throughout the life of the contract.

d. The DD Form 254 shall be completed by the COR/CM, using ACAVS. If not prepared in ACAVS, the COR/CM will forward a copy to the CSE for review and concurrence. The DD Form 254 and Army SCI addendum will be accompanied by a copy of the COR/CM's appointment orders; if the DD Form 254 and SCI Addendum are submitted in ACAVS, the COR/CM will provide a copy of the COR/CM appointment/designation orders to CSE.

2-1

e. Prior to an SCI contract being awarded, the CSE will provide written concurrence of the DD Form 254. A copy of the completed DD Form 254 will be retained by the CSE, the COR/CM (who provides a copy to the CSSO or FSO), the Defense Security Service (DSS), and all parties listed in item 17.

f. The COR/CM is responsible for providing a Standard Form (SF) 26 (Award of Contract), SF 33 (Solicitation/Award of Contract), DD Form 1155 (Purchase order for Supplies or Services), or other similar award document upon award of the SCI contract along with the completed DD Form 254, to the CSE as verification that the contract has been awarded.

g. If a sub-contract is required, the prime contractor will complete a DD 254 and the Army SCI addendum in ACAVS.

NOTE: Never copy information from an “old” DD 254 without checking the required references and this Handbook first. Changes in requirements are periodically received which may necessitate a revision. Do not include items or statements not required that may tend to confuse guidance.

2-3. CONTRACT COMPLETION/EXPIRATION. The estimated completion/expiration date of an SCI contract, as noted on the Army SCI Addendum attached to the DD Form 254, is an important date. The CSE will consider the contract is completed/expired on that date. CSE will begin actions to terminate all SCI support 90 days from that date. CSE will request final disposition instructions from the COR/CM for all SCI documents released, and SCI accessed personnel in support of the contract.

NOTE: To avoid confusion and costly delays, the COR/CM must inform the CSE (within 30 days) of all extensions, modifications or other actions which would prolong the life of the contract. However, if the contract has been completed, the COR/CM will notify, within 30 days, the CSE, who, will assist the COR/CM with all necessary access and document accountability actions.

2-4. CONTRACTING OFFICER’S REPRESENTATIVE/CONTRACT MONITOR & THE

CONTRACT CYCLE.

a. See paragraph 1-5c above for COR/CM duties and responsibilities. The duties and responsibilities are listed on a link on each contract edit page in ACAVS. The COR/CM should review the duties and responsibilities in ACAVS upon accessing the Contract Edit page in ACAVS. The following is a general listing of the COR/CM’s responsibilities during the four phases of an SCI contract.

b. PRE-SOLICITATION.

Contact the CSE if assistance is required during this phase.

c. SOLICITATION.

2-2

The COR/CM will prepare and submit a Solicitation DD Form 254 and SCI Addendum in ACAVS. If the DD Form 254 and SCI Addendum are completed manually, submit to CSE for review and concurrence. Ensure the solicitation number is entered into item 2C of the DD Form 254. Contact the CSE if additional assistance is required.

d. PRE-CONTRACT AWARD. When a contractor has been selected, the COR/CM must prepare a new DD Form 254 and SCI Addendum in ACAVS. If the DD Form 254 and SCI Addendum are completed manually, submit to CSE for review and concurrence. The COR/CM must review the DD Form 254 and Army SCI Addendum and sign the DD Form 254 in item16, item 13 or provide a separate endorsement, indicating it has been reviewed and approved by the COR/CM. If ACAVS is used, then the approvals will be done in ACAVS. The CSE will also review the DD Form 254, US Army SCI Addendum and will sign in item 13, indicating the contract security classification specification has been reviewed and concurred with by the CSE.

e. CONTRACT AWARD.

1. The COR/CM, in coordination with CSE Operations, will request elimination of all unnecessary pre-solicitation accesses, ensuring all indoctrinated individuals are properly debriefed, and co-utilization agreements are terminated.

2. If the contract requires construction of a new SCIF or creation of a CUA, to co-utilize another contractor's or government agency's SCIF, the COR/CM will closely coordinate this effort with the CSE, to ensure the SCIF concept, request for CUA, or CUA are properly completed and submitted through the correct channels.

3. The COR/CM must review each request for SCI access submitted by the contractor, ensuring that only the required number of personnel are approved for access to SCI material.

4. The COR/CM is responsible to the contractor for the release of all required SCI material, in accordance with DoD 5105.21-M-1 and of paragraph 4-2 of this handbook.

e. MAINTENANCE OF AN ON-GOING CONTRACT.

1. The COR/CM must ensure that the CSE reviews and concurs with all changes to the DD Form 254 involving the safeguarding of SCI material.

2. The COR/CM is responsible to validate all requests related to contract support.

f. COMPLETION/TERMINATION.

1. The COR/CM must notify the CSE in writing as to the status of a contract and all related subcontract(s) 30 days before the estimated completion date. Failure to provide an SF 30, a revision to the current DD Form 254, a follow-on contract DD Form 254 or written status will result in termination of all SCI support to the User Agency, contractor and subcontractors involved.

2-3

NOTE: ACAVS WILL SEND AN AUTOMATIC EMAIL TO A COR/CM OF ANY

CONTRACT THAT WILL BE COMPLETED WITHIN 60 DAYS OF THE ESTIMATED

COMPLETION DATE.

2. Within 30 days following completion of the contract, the COR/CM will provide written disposition instructions to the CSSO, with an information copy provided to CSE for all SCI material furnished to or generated by the contractor.

3. If SCI material is to be retained by the contractor after the completion of the contract, the COR/CM will coordinate the retention of accesses with CSE to ensure the material is properly protected by indoctrinated personnel. Additionally, the COR/CM must issue a DD Form 254 (final) which authorizes the retention of SCI material, indicates the duration of retention, and defines the reason for such retention.

4. The COR/CM will coordinate with CSE concerning the disposition of accesses.

5. If SCI material is to be transferred to another contract, the COR/CM will coordinate this with the CSE, the contractor, and the gaining COR/CM.

6. The COR/CM will monitor all activities surrounding the completion or termination of the SCI contract, and will report any discrepancies concerning required actions such as document inventory, accountability and withdrawal of SCIF accreditation.

2-4

CHAPTER 3 PERSONNEL SECURITY/ACCESSES/ACCESS AUTHORIZATION

3-1. INTRODUCTION. Contractors selected to perform work on an Army SCI contract and require access to SCI must be properly indoctrinated. Prior to indoctrination, the individual must meet minimum personnel security standards established by Director of Central Intelligence Directive No. 6/4. Individual's need-to-know is based upon his / her required work performance associated with the awarded contract.

NOTE: Justifications for SCI accesses must be specific and must clearly identify the type of SCI data required, why the job cannot be performed without SCI and how the individual will use the SCI information. Acceptable examples to be placed in the justification item on the SCI Request template in ACAVS are:

Contractual Obligation, DD Form 254, or the specific duty described for the person in the contractual document.

3.2 SCI ACCESSES.

a. Contract Access: An access which is tied to a specific contract, is requested in ACAVS for COR/CM approval, and is only valid for the duration of that contract.

Such accesses apply to individuals who will perform on an SCI contract, and CSE-appointed CSSOs/ACSSOs.

b. Consultant Access: An individual who is under contract to provide professional or technical assistance to a contractor or GCA in a capacity requiring access to classified information. For purposes of this publication, the individual requires access to SCI in the performance of his/her consultant services.

c. The employee will not be given access to SCI until the CSE has provided authorization to indoctrinate.

NOTE: The consultant does not require a facility security clearance (FSC) or a DD Form 254. The consultant is considered an employee of the hiring contractor for security administration purposes and will be sponsored by the hiring contractor for a personnel security clearance and request for SCI access, and will be inspected/visited as part of that company. The consultant and hiring contractor will execute a written security agreement which will be maintained by the hiring contractor. SCI will not be released to a consultant for retention or removal from the hiring contractor's facility, or a facility to which the consultant has been certified.

3-3. THE ARMY CONTRACTOR AUTOMATED VERIFICATION SYSTEM (ACAVS).

ACAVS is a secure web based application that is used by the CSE and its customer base for unclassified SCI contract actions, to include contract, User Agency, Contracting officer’s representative, company, contractor personnel security, and submission of DD Forms 254.

a. Registration. The COR/CM must be registered in ACAVS before CSE will add the COR/CM’s SCI contract to ACAVS. The CSSO, FSO and Scty POC, as appropriate, 3-1 must be registered in ACAVS in order to submit SCI request actions that are to be accepted by the COR/CM and sent to CSE for action. CSE INSCOM recommends that each company have a primary and alternate person (e.g., FSO/AFSO, CSSO/ACSSO, Scty POC) registered in ACAVS for their company (CAGE/Company code specific) because many companies have not been able to process SCI request actions when the registered person is absent.

1. Register with CSE at https://acavs.inscom.army.mil/signup/. After registration, wait one day and go to https://acavs.inscom.army.mil to access the home page.

2. Once you have accessed the homepage, read the ACAVS Alerts and News,. To access your virtual workspace, click on the gray button, “click to enter ACAVS”.

b. Guidance. Procedures for use of ACAVS are in the ACAVS Users Guide. The

ACAVS Users Guide is located at https://acavs.inscom.army.mil/signup/acavsusersguide.htm or from the link on the User’s ACAVS workspace. The Guide will be updated periodically to reflect current ACAVS business practices. If the ACAVS Users Guide does not provide the guidance you are seeking, please contact CSE Operations.

c. ACAVS Training.

1. CSE conducts ACAVS training of companies during its Staff Assistance Visits.

Company security officers may host a training seminar for area companies involved with Army SCI contracts; in such cases, the proposed host needs to coordinate with CSE Operations.

2. CSE conducts consolidated COR/CM and ACAVS training at the User Agency’s location. User Agency COR/CMs may request ACAVS training from CSE by coordinating with their SIO and local SSO, and submit an email or letter request to CSE INSCOM, with several proposed dates for training.

3-4. JOINT PERSONNEL ADJUDICATION SYSTEM (JPAS). JPAS consists of two subsystems: Joint Clearance Access Verification System (JCAVS), used by security professionals, and Joint Adjudication System (JAMS), used by the adjudication facility. JPAS is the Army’s system of record to determine clearance eligibility and current access level. Procedures for using JPAS are located on the JPAS Gateway web site (https://jpas.dsis.dod.mil).

a. In-processing. CSE will take an Owning SCI Security Management Office (SMO) relationship for all Army-affiliated contractors cleared for SCI access on Army SCI contracts. In cases where the individual record (Person Summary) reflects Owning SCI SMO by another DoD entity, CSE will take a Servicing SCI SMO relationship. CSE cannot enter SCI accesses and NDS unless the Non-Disclosure Agreement (NDA) line reflects Yes.

b. Out-processing. Upon transfer or debrief of the individual, CSE will out-process the individual from JCAVS.

3-2 https://acavs.inscom.army.mil/signup/ https://acavs.inscom.army.mil/ https://acavs.inscom.army.mil/signup/acavsusersguide.htm

c. Facility Security Officers must be registered in JPAS per Defense Security Services instruction to industry. CSE expects that company security officers (CSSO/FSO/Scty POC) will take an Owning non-SCI SMO relationship of their contractor personnel. In cases where a company has a Contractor Special Security Officer (CSSO) appointed by CSE, the CSSO can take a Servicing SCI SMO relationship of their contractor personnel who are or are cleared for SCI access on an Army SCI contract. This relationship allows the CSSO to post indoctrinations and debriefings, as authorized by the CSE.

3-5. INDOCTRINATION. Indoctrination consists of the initial instruction given to an individual prior to that individual being permitted access to any SCI. The instruction normally given in the form of a video taped briefing or reading a prepared indoctrination text, consists of an explanation of the unique nature of SCI, the requirements to protect intelligence sources and methods involved in obtaining SCI and the established administrative procedures for safeguarding SCI.

a. The CSE must first authorize a CSSO to indoctrinate an employee before the CSSO may do so. The CSSO, appointed by CSE, may request indoctrination and debriefing authority from CSE. See example for requesting indoctrination/debriefing authority at Appendix E-7.

b. Prior to indoctrination, the individual must execute a SCI Nondisclosure Statement (NDS), DD Form 1847-1 before proceeding with the indoctrination and being given access to SCI. The original NDS will be forwarded to the CSE and a copy will be retained by the CSSO.

c. Indoctrinations may only be conducted by an SSO or by the CSSO who has been given written initial indoctrination authority by the CSE. At the time of indoctrination, the employee will sign a DD Form 1847, SCI Indoctrination Memorandum, which will be forwarded to the CSE, and a copy will be maintained on file by the CSSO.

d. At the time of initial indoctrination, the CSSO must give the employee, a "Defensive Security Briefing" and maintain a record of the briefing.

e. SCI indoctrination assistance may be obtained from an SSO or CSSO in coordination with the CSE. The CSE will notify, by email or facsimile, the CSSO/FSO/Scty POC that a contractor employee may be indoctrinated for SCI access.

The CSSO/FSO/Scty POC must identify to CSE where (message address) the indoctrination is to be accomplished, such as, SSO INSCOM, and the employee’s telephone number. If accomplished by a CSSO, then comply with the instructions listed above.

3-6. DEBRIEFING. Upon termination of an Army SCI contract, or when an individual no longer requires access to SCI, or when directed by the CSE, SCI access must be formally terminated. This procedure is called debriefing and is normally performed by the office which conducted the indoctrination. At the time of debriefing, the individual will be required to execute a DD Form 1848, SCI Debriefing Memorandum, which will be forwarded to the CSE, with a copy maintained by the CSSO. As with indoctrination

3-3 assistance, debriefing assistance can be requested from an SSO or CSSO upon coordination with the CSE.

3-7. REQUEST FOR INTERIM SCI ACCESS. Requests for access in exceptional circumstances are based on the compelling need of an organization to prevent failure or serious impairment of missions or operations that are in the best interest of national security. The COR/CM must authenticate on their organizational letterhead the Compelling Need for the interim access to SCI, accompanied by a copy of the most recent SF86. Requests may not be submitted until 45 days after the initial request for

SSBI.

3-8. FOREIGN TRAVEL/FOREIGN CONTACTS. See DoD 5105.21-M-1. Provide reports to CSE (do not forward Foreign Travel Questionnaires unless they contain Yes answers).

3-9. CONTINUING SECURITY AWARENESS PROGRAMS.

a. The CSSO will establish and maintain a continuing security awareness program for SCI indoctrinated personnel. This program must be tailored to the corporation and its physical facilities. It will provide instruction to indoctrinated personnel concerning their responsibilities for handling and safeguarding SCI material. The CSSO will maintain a record of each individual's participation in all training. The CSSO's program will consist of the following items as a minimum:

1. A means to disseminate information to all indoctrinated personnel concerning SCI security policy and security procedures

2. Annual, general SCI security briefing.

3. Annual SPP review.

b. The FSO/Scty POC should coordinate with the SSO at the contractors’ work location and request they be included in the local SSO’s security awareness programs (Chapter 2, paragraph P, DoD 5105.21-M-1).

3-10. UNFAVORABLE/ADVERSE INFORMATION. The CSSO/FSO will provide to the supporting CSE a copy of any information of a potentially disqualifying nature (DCID 6/4) concerning any Army-affiliated contractor who is cleared for, or has been nominated for, SCI access. This includes any adverse reports the FSO has submitted to DISCO. In cases where the information is of an urgent nature, the CSSO/FSO will telephonically report the information to the supporting CSE for further action. The CSSO/FSO will then submit a written report to the CSE.

3-11. SUSPENSION OF ACCESS TO SCI. If a CSSO becomes aware of potentially disqualifying information (DCID 6/4), he/she should temporarily deny the individual access to the SCIF. This fact should be reported to the CSE with the report of adverse information. The CSE will review the information and, if warranted, recommend suspending the individual’s access to SCI. The CSE will report the information to CCF for further action.

3-4

3-12. INTENT TO DENY OR REVOKE SCI ACCESS ELIGIBILITY. Commander, CCF, Fort Meade, MD, is the Army authority for denying, revoking, or reinstating SCI access eligibility. The CSE will forward the letter of intent to deny or revoke, received from CCF, through the CSSO/FSO to the affected individual.

3-13. REQUESTS FOR INFORMATION. At times, CCF needs additional information in order to adjudicate an individual’s investigative file for access to SCI. CCF will send a Memorandum Request for Information to the CSE. The CSE will coordinate the requirements of the Memorandum with the CSSO/FSO. The CSSO/FSO will comply with the requirements and meet the suspense date.

3-14. MENTAL HEALTH EVALUATIONS. At times, CCF requests that nominees for SCI access undergo a mental health evaluation in order to adjudicate the individual’s investigative file for access to SCI. The CSE will coordinate such actions with the CSSO/FSO, the affected individual, and the mental health facility. In cases where the individual is overseas, the CSE may request assistance from the nearest SSO.

3-5

CHAPTER 4 INFORMATION SECURITY

4-1. INTRODUCTION. Information security includes a wide range of functions, and involves both the physical and procedural safeguards implemented to protect classified information.

4-2. RELEASE OF SCI MATERIAL TO CONTRACTORS. One of the most important tasks assigned to a COR/CM is to ensure that the contractor has the necessary SCI to perform the contractual work effectively. The COR/CM must determine if the contractor has a need-to-know, and ensure that when information is released to a contractor, it is not in violation of specific handling instructions/caveats. The following guidance is provided to assist the COR/CM in performing this function. The CSE may also be called upon for assistance. The COR/CM is the only person who can authorize the release of SCI to a contractor on the SCI contract. Administrative security regulations referenced on the DD 254 may be released to the contractor by the CSE as well as indoctrination booklets and tapes without COR/CM involvement.

Receipt of SCI from any other source must be reported by the CSSO immediately to the CSE and COR/CM.

a. Prior to contract award, the COR/CM should make an initial determination of what SCI will be required for execution of the contract. During the life of the contract, there may be additional requirements for SCI material, which will be reviewed by the COR/CM. Additionally, the COR/CM will ensure that SCI material that is unnecessary or no longer pertinent to the contractual effort is not retained.

b. SCI material required for the Army SCI contract (i.e., when approved by the COR/CM) will be transmitted by approved means and will be properly controlled.

Approved methods of transmission include the use of the Defense Courier Service (DCS), the Defense Special Security Communications System (DSSCS), SCI couriers appointed by the CSE, and an approved secure facsimile in conjunction. A "Classified Document Accountability Record," DA Form 3964, is the proper means of accounting for SCI released by the COR/CM to the contractor. The COR/CM will send releasable SCI material directly to the CSSO provided both the sender and receiver have access to one of the approved transmission systems/methods outlined above and the addressee is properly authorized (accredited) to receive the type of material being transmitted. In cases requiring the COR/CM to obtain release authority prior to release of SCI to a contractor, documentation of such authority will accompany the document and DA Form 3964.

c. Accountability is not to be confused with applying appropriate controls on the dissemination of SCI information. Control is the process of validating the need to know and verifying the requisite compartmented access prior to the transfer of information, regardless of form. Contractors must adequately control and track the disposition of all SCI material to ensure its return to Army control at contract termination.

e. Upon expiration of a contract, SCI material furnished or generated as a part of such contract must be accounted for, and final disposition for all material must be

4-1 determined. Final accountability and disposition is the responsibility of the COR/CM;

however, it can be accomplished best through a cooperative effort of the CSSO, the CSE and the COR/CM. If final disposition instructions are not received within 30 days of completion of the contract and retention of the material is not authorized by DD Form 254 for a follow-on contract, the CSSO will initiate a request to the COR/CM for disposition instructions.

f. If a follow-on contract is awarded, all SCI material will be accounted for and disposition will be determined within 30 days of award of the follow-on contract. If all SCI material is to be transferred, this is reflected in item 4 of the DD Form 254. If the COR/CM wishes to have some or all of the SCI material destroyed or returned, the COR/CM will advise the CSSO of these requirements in writing.

f. SCI material, with the exception of GAMMA, originated by Defense agencies and MILDEP(s), which is not further identified with special handling caveats (i.e., ORCON, PROPIN) may be released to a contractor by a user agency SSO after the COR/CM has determined that the contractor has a need-to-know. Release of GAMMA information, material marked with restrictive caveats, and NSA or CIA originated material requires special release authority as outlined in DCID 6/6.

4-3. SCI COVER SHEETS. Refer to the guidelines in DoD 5105.21-M-1.

4-4. SCI ACCOUNTABILITY. After an SCI contract has been awarded, the COR/CM and the CSSO will determine what SCI material, in addition to any specific documents already outlined in the DD Form 254, is required by the contractor for execution of the contract. The material will be forwarded by the COR/CM's local SSO, using a DA Form 3964, to the CSSO by approved methods of transmission as outlined above.

Once received at the contractor SCIF, the CSSO must comply with DoD 5105.21-M-1.

a. Notify the CSE and COR/CM if any SCI documents are received from sources other than the COR/CM or CSE.

b. Notify the CSE and COR/CM immediately if there is any discrepancy between the DA Form 3964 and the contents of the package containing the SCI or if the information was transmitted via unauthorized means.

4-2 4-5. REPRODUCTION OF SCI MATERIAL. Refer to DoD 5105.21-M-1 and the Army SCI Addendum to the DD form 254.

4-6. SCI STORAGE. The CSSO will ensure that SCI is stored in accordance with the provisions of the SCIF accreditation and in the manner outlined in the approved SPP.

Special care must be given to ensure only approved storage containers are used and that the safe combinations are classified and handled properly, in accordance with DoD 5105.21-M-1.

4-7. COURIERS. Refer to the guidelines in DoD 5105.21-M-1. An example of a Request for Courier Orders is at Appendix E-5. COR/CM’s must approve all courier requests.

4-2

4-8. DESTRUCTION OF SCI MATERIAL. Refer to the guidelines in DoD 5105.21-M-1.

4-3

CHAPTER 5 SECURITY VIOLATIONS

5-1. Any violation of SCI security regulations, practices dangerous to security (PDS), or established security practices which result in a compromise, possible compromise or potential compromise of SCI, must be reported to the CSE within 72 hours. Follow the guidance at DoD 5105.21-M-1, submit to CSE, and use the example format at Appendix E-9

5-2 Do not submit the report directly to DIA.

5-1

CHAPTER 6 PHYSICAL SECURITY

6-1 INTRODUCTION. This chapter must be used in conjunction with DoD 5105.21- M-1 and DCID 6/9. The construction of a Sensitive Compartmented Information Facility (SCIF) is a major undertaking and should be pursued only after all alternatives, such as a CUA to operate in another contractor or government facility, have been explored. However, a SCIF may be required at a contractor's location for the performance of an SCI contract, and the planning and preparation of such construction will require close coordination between the CSSO, the COR/CM, and the CSE. The following steps are involved in the construction.

6-2. SCIF ACCREDITATION PROCESS

a. SCIF CONCEPT APPROVAL. The Request for SCIF Establishment will be submitted through the COR/CM for approval to CSE for action. See example of

Request for Establishment of SCIF at Appendix E-9.

b. SCIF PRE-CONSTRUCTION APPROVAL. Provide a copy of the Fixed Facility Checklist (FFC) and the TEMPEST Addendum (if IS processing is involved) to CSE.

Actual construction should not begin until DIA provides formal pre-construction approval.

c. SCIF ACCREDITATION.

1. The company CSSO will submit one copy of the accreditation package to DIA, copy furnished to CSE.

2. The CSSO will then finalize a Standard Practice Procedure (SPP) for the SCIF and forward to CSE for review and approval.

NOTE: If the SCIF will contain IS equipment to process and/or store SCI information under the Army SCI contract (to include word processing equipment), the CSSO will submit, in addition to the FCC, an Appendix J, DoD 5105.21-M-1. The CSSO should also submit to the CSE, through the COR/CM, a request for IS Accreditation IAW DCID 6/3).

d. DIA will review the accreditation package for compliance with SCI physical security standards. Once satisfied that the SCIF meets all the criteria, DIA will issue an accreditation message/memorandum.

6-3. INSPECTIONS. This paragraph outlines the various inspections required to provide adequate oversight for the safeguarding of SCI material involved in Army SCI efforts.

a. Self Inspections. The CSSO will provide a copy of the self inspection results to

CSE.

6-1

b. Physical Security Inspection. DIA conducts periodic inspections. CSSOs will provide a copy of the corrective action report to CSE

c. Technical Security Countermeasures Evaluation (TSCM). If the COR/CM determines that a TSCM is needed, the requests for a TSCM evaluation will be forwarded to DIA with a copy furnished to CSE. Contact CSE prior to making the request.

d. Army Staff Assistance Visits (SAV). The CSE will conduct Staff Assistance Visits of Army SCI programs at various intervals. This review will ensure DoD and Army SCI policies are being followed. CSSO(s) will receive notification at least 30 days in advance. This is not an inspection, but an effort to assist CSSO(s) prepare for DIA inspections.

e. Self-Inspections. See DoD 5105.21-M-1. The CSSO will provide a copy of the completed self-inspection to CSE.

6-4. REACCREDITATION. See DoD 5105.21-M-1.

6-5. CHANGES TO SECURITY POSTURE. See DoD 5105.21-M-1. Provide a copy of the report to CSE.

6-6. WITHDRAWAL AND TRANSFER OF SCIF ACCREDITATION. See DoD 5105.21- M-1.

a. Withdrawal. Provide the request for withdrawal to CSE. Provide a copy of the closeout inspection of the facility to CSE.

b. Transfer. If an Army contractor who operates an Army SCIF, which is co-utilized by other MILDEP(s) or government agencies, completes or loses his Army contract(s), the CSSO will notify the other MILDEP(s) and/or agencies that the SCIF is no longer required by the Army. If another MILDEP or agency wishes to pick up security cognizance for the SCIF, they should submit a request for transfer through their channels to DIA, copy furnished CSE.

6-7. EMERGENCY ACTION PLANS (EAP). See DoD 5105.21-M-1. If not included in the SCIF SSP, provide a copy of the EAP to CSE for approval.

6-8.…