A07_SolicAttach-J.4_DD254_ContinuationSheets_18R0001.pdf

DD Form 254, Section 13, Continuation Sheet Solicitation No.: W19CRB-18-R-0001 Section 13 Security Requirements:

Ref 10h: Foreign Government Information (FGI): This is classified information that is provided to the U.S.

Government by a foreign government(s), an international organization, or any element thereof. This does not include NATO information. The prime contractor must receive approval from the KO to grant access to a subcontractor.

Foreign Government Information (FGI) is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting. Access to classified foreign government information requires a final U.S. Government clearance. AR 380-5, Chap 4, Sect VII applies.

Ref 10j: For Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DOD Manual 5200.01, Volume 1.

Ref 10k: Security Classification Guide for the Lightweight Laser Designator Rangefinder (LLDR) dated 30 July 2007 will be provided. Contractor personnel performing IT sensitive duties are subject to investigation an assignment requirements IAW AR 25-2, AR 380-67 and affiliated regulations. Classified info will be protected IAW 25-2, ARM 380-67, and affiliated regs. All contractors handle classified info must possess a SECRET clearance. PM requirements include unclassified through SECRET classified levels. Classified materials will be protected IAW AR 380-5 and all FOUO information will be protected IAW NISPOM Chapter 5, FOUO Protection.

Ref 11c: The contractor requires access to classified source data up to and including Secret in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, paragraph 4-208a, and the use of a bibliography. The contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with (1) the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M), and (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor. Contractor performance is restricted to locations in Block 8a. Government agency or activity will provide security classification guidance for performance of this contract. Submit visit request to the KO and/or Security Management Office for need-to-know verification.

Ref 11d: Contractor must provide adequate storage at their facility for classified hardware to the level of SECRET.

Ref 11g. DD Form 1540 and DD Form 2345 must be completed for registration with DTIC. The sponsoring KO must submit DD Form 1540 “Registration for Scientific and Technical Information Services” to DTIC on behalf of the contractor. For subcontractors, the prime contractor submits the DD Form 1540 with the KO verifying the need-to-know. The contractor may also submit DD Form 2345 “Militarily Critical Technical Data Agreement” (after registration with DTIC) to the Defense Logistics Services Center for access to unclassified, militarily critical technical data from other DOD sources. The KO must certify the need-to-know to DTIC. See NISPOM Chapter 11, Section 2 for more information.

Ref 11h: COMSEC is governed by the NSA/CSS Policy Manual 3-16; Control of Communications Security (COMSEC) Material dated August 2005.

Ref 11j. The contractor shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within 90 calendar days of contract award (and annually thereafter), to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. The contractor should use the provided Security Classification Guides (SCG)s to develop their SOP. The SOP/Plan will specify the Government’s critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator. The contractor will ensure that this individual becomes OPSEC Level II certified per AR 530-1. The Government will evaluate contractor OPSEC performance on an annual basis or as conditions warrant. The contractor will implement an employee verification process, whether

Solicitation No.: W19CRB-17-R-0007 Section 13 Security Requirements:

through background checks or other similar processes, and provide a written response explaining how the verification process was completed and attest to the trustworthiness of the workforce, within 45 days of contract award. The contractor shall comply with FAR 52.204-2, Security Requirement. This clause involves access to information identified as “Confidential”, “Secret” or “Top Secret” and requires contractors to comply with: (1) the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DOD 5220.22-M); and (2) any revisions to the DOD 5220.22-M, notice of which has been furnished to the contractor.

Section 13 Security Requirements (continued):

Additional Security Requirements:

1. The contractor shall support the government in ensuring that all aspects of security are maintained on developmental/production systems during all activities including field tests and evaluations, test site surveys, relevant test data maintenance and reductions and limited test site security and test site administration activities.

2. Contractor employees must complete Level I OPSEC training within 45 calendar days of reporting for duty [Government will provide OPSEC Level I Training]. All contractor employees must complete annual OPSEC awareness training.

3. The contractor will implement an employee verification process, whether through background checks or other similar processes and provide a written response explaining how the verification process was completed and attest to the trustworthiness of the workforce, within 45 days of contract award.

4. The contractor shall provide adequate physical, transportation, and informational security of Government property including test hardware, weapons, ammunition, technical data, and proprietary information.

5. All contractor employees, including subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete Anti-terrorism Level I awareness training prior to performing activities related to this contract on Army installations, facilities, and controlled access areas. The contractor shall submit current certificates of completion for each contractor employee and subcontractor employee requiring access to Army installations to the COR or to the Anti-Terrorism Officer (ATO), if a COR is not yet assigned, within 30 calendar days after completion of training by each of the employees and subcontractor personnel, but no later than prior to accessing Army installations, facilities or controlled access areas. Anti-terrorism Level I awareness training is available at the following website: https://atlevel1.dtic.mil/at.

https://atlevel1.dtic.mil/at

CUI/FOUO DD Form 254 Attachment

Section 13 DD254, Block 13, Section 10j Continuation Sheet Attachment Controlled Unclassified Information (CUI) and Sub-Category For Official Use Only (FOUO)

1. The definition of CUI is information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies, excluding information that is classified pursuant to Executive Order 13526 of December 29, 2009, or the Atomic Energy Act, as amended (References (m) and (n)).

2. When CUI is to be provided to or generated by DOD contractors, the controls and protective measures to be applied shall be described in the pertinent contract documents (e.g., contract clause; statement of work; or DD Form 254, “Department of Defense Contract Security Classification Specification”). Solicitations and contracts shall use a non-disclosure of information clause that prohibits release of unclassified information to the public without approval of the contracting activity.

3. The Contractor shall not release to anyone outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract without prior approval from the government.

4. Technical Data is any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process or to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media, such as computer software, drawings, or photographs, text in specifications, or related performance or design documents, or computer printouts. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation.

5. GOVERNMENT DISTRIBUTION STATEMENTS: Will be added to all technical data generated during the execution of this contract, in accordance with DoD Directive 5230.24.

6. The contractor shall protect CUI from unauthorized disclosure by appropriately marking, safeguarding, disseminating, and destroying such information.

7. CUI may be identified in security classification guides to ensure the information receives appropriate protection.

8. For unauthorized disclosures of CUI, no formal security inquiry or investigation is required. However, appropriate management action shall be taken to fix responsibility for unauthorized disclosure of CUI whenever feasible or required by other guidance, and appropriate disciplinary action shall be taken against those responsible. The DOD Component that originated the CUI shall be informed of its unauthorized disclosure.

FOR OFFICIAL USE ONLY (FOUO)

1. The “FOR OFFICIAL USE ONLY” marking is assigned to information at the time of its creation in a DOD User Agency. It is not authorized as a substitute for a security classification marking but it is used on official government information that may be withheld from the public under exemptions 2 through 9 IAW Army Regulation 25-55, The Department of the Army Freedom of Information Act Program.

2. Control, marking, and protection of FOUO information will be in accordance with this document and Army Regulation 380-5, The Department of the Army Information Security Program, Chapter 5, para 5-1 through 5-6.

3. Specific Handling Instructions: All emails containing (FOUO) will be digitally encrypted in accordance with AR 25-1, para. 6-4 (M-7b.) dated 4 Dec 08.

CUI/FOUO DD Form 254 Attachment

Section 13 DD254, Block 13, Section 10j Continuation Sheet Attachment Controlled Unclassified Information (CUI) and Sub-Category For Official Use Only (FOUO)

4. FOR OFFICIAL USE ONLY is restricted to personnel with a valid need to know unless public release authorization has been obtained. Information, in any media format may only be disseminated of FOUO data to those individuals or organizations with direct affiliation with the given program or project. Further dissemination of such information will be at the discretion of the Government Security Manager. Personnel no longer requiring access to FOUO must delete or surrender any in their possession and terminate future access to it. The contractor may disseminate “FOR OFFICIAL USE Attachment Controlled Unclassified Information (CUI) and Sub-Category For Official Use Only (FOUO) ONLY” (FOUO) information to their employees who have a need to know for the information in connection with this contract.

5. All FOUO material will be destroyed by tearing or shredding to make unreadable. Electronic media will be purged with approved software or destroyed through a physical process. Attachment Controlled Unclassified Information (CUI) and Sub-Category For Official Use Only (FOUO). Use of the above marking does not mean that the information cannot be released to the public, only that the Government prior to its release determines whether a significant and legitimate government purpose is served by withholding the information or portions of it must review it.

6. An unclassified document containing FOUO information will be marked “FOR OFFICIAL USE ONLY” at the bottom of the front cover (if any), on the first page, on each page, on the back, and on the outside of the back cover (if any). No portion marking will be shown.

7. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of the information appearing on the page. If an individual portion contains FOUO information but no classified information, the page will be marked FOUO.

8. Removal of the “For Official Use Only” marking can only be accomplished by the originator or other competent authority. When the “For Official Use Only” status is terminated, all know holders will be notified to the extent practical.

9. During working hours, “For Official Use Only” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other classified records in unlocked files or desks is adequate when internal building security is provided during non-working hours. When such internal security is not exercised, locked buildings or rooms will provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

“For Official Use Only” information may be sent via First Class US Mail or by parcel post. Bulky shipments may be sent by Fourth Class US Mail.

10. Unauthorized disclosure of “For Official Use Only” information does not constitute a security violation but the Government Customer should be informed of any unauthorized disclosure. The unauthorized disclosure for FOUO information protected by the Privacy Act may result in criminal sanctions.

Release of Non-SCI Intelligence Information DD Form 254 Attachment Solicitation No.: W91CRB-16-D-0028 Section 13 DD254, Block 13, Section 10e.2 Continuation Sheet

Ref: 10e. (2) Release of Non-SCI Intelligence Information to DOD Contractors

1. As defined in Executive Order 12333 of December 4, 1981, "United States Intelligence Activities", foreign intelligence is defined as "... information relating to the capabilities, intentions and activities of foreign powers, organizations or persons: including information on international terrorist activities."

2. In accordance with DCID 6/6, pursuant to the provisions and definitions of Executive Order 12333, the following guidance is provided to you regarding the release, control, dissemination, and use of intelligence information in support of ARDEC contracts:

3. All intelligence material, reproductions thereof, and all other material generated based on, or incorporating data there from (including authorized reproductions), will be controlled in the same manner as the originals, and remain the property of the US Government and may be withdrawn at any time.

4. You must maintain a record of all intelligence material, regardless of classification, released to your custody.

5. You must accomplish a verification of all materials, if held for at least one year, released under the contract.

Further, such verification will be conducted upon the anniversary date of the contract, or on a mutually agreed date, and the Senior Intelligence Officer, ARDEC, will be furnished a copy of the verification list. The objective of this requirement is not only to afford the required security for intelligence data, but should be viewed as an opportunity to return documents no longer needed or superseded.

6. You will not reproduce intelligence material released to your custody without the express written permission of the Senior Intelligence Officer, ARDEC.

7. When written permission is received to reproduce intelligence materials, you will control and account for such reproductions in the same manner as pertains to the originals.

8. Prior to granting an employee access to the intelligence materials, you will brief the employee on his obligation to safeguard the information. The appropriate portion of SF312, "Classified Information Non-Disclosure Agreement,” will be executed at the time of briefing.

9. You and the Contracting Officer’s Representative (COR) will jointly determine those employees who require access to the intelligence material and you will maintain records to identify completely by name and title all employees so authorized. Requests for additions or personnel changes should be provided to the COR prior to access. Additionally, you will maintain records of authorized visitors who have had access to the intelligence material.

10. You will not release intelligence material to any activity, employee, or other person not directly engaged in providing services under the contract unless specific written authorization for such release is received from this office. This prohibition precludes release without authority to another contractor, including a sub-contractor, government agency, private individual, or organization.

11. The intelligence materials will not be released to foreign nationals or non-US citizens except with the specific written authorization from the Senior Intelligence Officer, ARDEC, whether or not they are also consultants, U.S.

contractor employees, and regardless of the level of their access authorization.

12. The intelligence materials released to you will not be destroyed unless written authorization for such destruction is received from the Senior Intelligence Officer, ARDEC. In the event such authorization is received, you will effect such destruction in accordance with Chapter 5, Section 7 of the National Industrial Security Program Operating Manual, DoD 5220.22-M, dated February 2006, Incorporating Change 1, March 28, 2013.

Release of Non-SCI Intelligence Information DD Form 254 Attachment

Solicitation No.: W91CRB-16-D-0028 Section 13 DD254, Block 13, Section 10e.2 Continuation Sheet

13. If access to SIPRNET and INTELINK-S is granted, the following guidelines apply:

a. The computer account will be used in support of an official government project.

b. You will not willfully compromise the account password.

c. You will notify the COR when the account is no longer needed, or account information needs revising, or the account password has been knowingly compromised.

d. The account will be used in accordance with all existing instructions, policy directives, and guidelines to ensure no improper or fraudulent use.

e. Data and files associated with this account are subject to random review.

f. The account password will be changed in accordance with current Army policy.

g. You are responsible for not only safeguarding the classified contents of this account, but also the physical configuration of the network.

14. Upon expiration of a contract, all substantive intelligence materials released to you, all reproductions thereof, and all other materials incorporating material there from will be returned to this office for disposition. In the event that the contract is extended, or that a new similar contract requiring the released data is negotiated, it is the responsibility of the COR to affect an extension or document transfer with the Senior Intelligence Officer.

15. The name and address of the Senior Intelligence Officer is as follows:

TBD, CECOM