A07_ATTACH_3_DD254_DATTACHMENT_ONE_THROUGH_FOUR_for_Data_Collection_Solicitation.doc

ATTACHMENT ONE (Continuation of Block 13 of the DD Form 254 for Contract

To Be Determined)

13. Security Guidance.

Item 10f (Continued). Component-managed SAPFs and SAP Temporary Secure Working Area (TSWA) are governed by Department of Defense Manual 5205, Volumes one through four. Access to SAP information requires employees undergo additional personnel security screening and meet the policies of all SAP directives. SAP inspections and security oversight while at ATC are under the cognizance of the SAPCO, as appropriate. ATC Security and Intelligence Division will conduct SAP briefings and debriefings as required for contractor personnel, refer to Army Regulation 380-381, Special Access Programs and Sensitive Activities. Contractor personnel who access SAPs are subject to random selection for counterintelligence scope polygraph examinations IAW DOD Regulation 5210.48. Failure of selected individual to submit to polygraph examination may result in their access to SAP information being suspended. No subcontracting efforts for SAPs will be initiated without written approval by the ATC Security Manager. SAP information generated in performance of this contract is strictly prohibited for release to foreign nationals. See Attachment Three of this DD Form 254 for the SAP Addendum.

Item 10k. Secret Internet Protocol Network (SIPRNET) access required. SIPRNET access is required to generate and transmit test operation reports. The contractor shall not access, download or disseminate any special access data (i.e. intelligence, NATO, COMSEC, etc.).

Item 11a. Contractor performance does require travel beyond the boundaries of APG during the course of the contract for training or work to be accomplished at sites other than APG. The contractor shall have personnel available and ready to travel on the required date. ATC is engaged in remote testing and test support at sites all over the CONUS. There will be no OCONUS travel. The contractor shall have the capability to support the CONUS remote testing using the personnel that are already supporting ATC’s mission at APG. There will be no access to classified information at the contractor’s facility. Therefore, the contractor will not be required to have any safeguarding capability at their facility. All access to classified information will be at a Government Activity or another contractor’s facility should a contract employee need to accompany a government employee in support of a classified item away from ATC.

Item 11j. The contract requires planning for and application of OPSEC in accordance with Army Regulation 530-1, Operations Security (OPSEC) and the contract clauses and statement of work. OPSEC guidance will also be provided as applicable for each project or program affected by this support. In addition, the ATC Security Manager shall advise the contractor of ATC’s Critical Information (CI), why it needs to be protected, where it is located, who is responsible for it and how to protect it. Individual security classification guides and test plans will be provided by ATC for performance of this contract as needed.

ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for Contract To Be Determined)

14. Additional Security Requirements.

Facility Clearance. The contractor shall possess a SECRET Facility Clearance at the time this contract is awarded. Verification by the ATC Security and Intelligence Division shall be made to the Defense Security Service (DSS) using the Industrial Security Facilities Database (ISFD) to confirm that the company has an active facility security clearance.

Personnel Security Clearances. The contractor shall ensure every contractor employee who performs work on this contract on site at ATC shall possess or be capable of acquiring a final SECRET clearance. Contractor personnel shall not report to work until, at a minimum, an interim SECRET clearance is granted. Once an interim and/or final SECRET clearance is granted, every new contract employee will receive a security indoctrination briefing. This briefing will be conducted within 30 days of issuance of a security clearance. This briefing will at a minimum include the following topics: general security education, OPSEC awareness, Information Systems Security, Force Protection, and training on the Threat Awareness Reporting Program (TARP). This training will also provide any additional security training that may be job specific to the duties performed by the contractor. The contractor will notify the government in writing when this initial security training has been completed. A visit request must be submitted via the Joint Personnel Adjudication System (JPAS) to the ATC SMO code of W4QUAA by the Facility Security Officer (FSO) or Alternate FSO. A visit request must be submitted annually via JPAS to the ATC SMO code of W4QUAA by the FSO or Alternate FSO.

If initially JPAS is not available, a first time visit authorization letter shall be prepared on company letterhead, with the employee’s name, social security number (SSN), date and place of birth, citizenship and security clearance level, date and issuing authority for that clearance. The visit authorization letter will include the type, date and issuing authority for the security investigation. This letter must be verified and signed by the FSO or Alternate FSO, and submitted to the ATC Visitor Desk. In addition, the contractor shall prepare a roster of current employees which includes each employee’s name, social security number, and level of security clearance. This roster shall be verified and signed by the FSO or Alternate FSO and submitted to the ATC Security Manager. This roster shall be updated as required to reflect any changes in employee’s status or information. At the conclusion of this contract, the FSO or Alternate FSO, will submit a termination letter to the ATC Visitor Desk and a copy sent to the ATC Security Manager. If a contract employee becomes involved in any type of adverse information while supporting this contract, the ATC Security Manager will be notified immediately so that a decision can be made whether the employee will continue to have unescorted access into the Restricted Area and whether they will continue to have access to a government owned computer system. Contract personnel whose security clearances are suspended shall not be permitted to work under this contract until their security clearance is reinstated. If possible, a visit authorization will be provided to the COR and ATC Security Manager at Phase-In.

ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for

Contract To Be Determined) Information Systems (IS) Access. The contractor shall designate Information Technology (IT) positions for all personnel requiring access to IS in accordance with Army Regulation 25-2, Information Assurance, Army Regulation 25-1, Army Knowledge Management and Information Technology Management, Army Regulation 380-67, Department of the Army Personnel Security Program and Army Regulation 380-5, Department of the Army Information Security Program. ATC computer related positions will be designated as IT 1, 2, or 3. The contractor shall request the appropriate personnel security investigation based upon the IT position designation. The investigations must be favorably completed prior to employees being permitted access to IS and being placed in an IT position. The contractor shall prepare a list identifying the IT position designations and submit to the ATC Information Assurance Manager (IAM) and ATC Security Manager. In accordance with Army Regulation 25-1, all employees requesting access to an IS shall be required to sign an Acceptable Use Policy (AUP) and adhere to the policies outlined in the document regarding acceptable use of Government-owned computer systems and networks.

This document will be reviewed and signed annually thereafter. Also, prior to gaining access to a government computer system, all employees must take initial Information Assurance (IA) training and annually thereafter. This is mandatory on line training which will be completed by scheduling an appointment with the ATC Cybersecurity Office. All Army IS will be used for OFFICIAL business only. Using Army IS to access pornographic, game, militia or similar sites is strictly prohibited, Access to chat rooms (except AKO chat), use of commercial email addresses to send or receive DoD information, and use of Army IS to download shareware is also strictly prohibited. The contractor shall ensure that all IS used by contractor personnel are protected and accredited in accordance with Army Regulation 25-2 and related supporting directives and AUP guidance published by ATC. The Contractor shall temporarily revert to manual mode when the required automation information systems are not available. Upon availability of the system or equipment, the Contractor shall commence on-line input. Any DoD information processed on either Government furnished or contractor furnished computers belongs to the Government. During the Phase-In period, the Contractor shall complete a Request for Access (DD Form 2875 System Authorization Access Request) and Non-Disclosure Statement to ATC Computer Systems for the designated employees. This form shall be returned to the Government designee after completion. Where applicable, the contractor shall recommend through the COR to the ATC IAM the appointment of an Information Assurance Security Officer and alternate(s). Prior to any classified work being processed on an IS regardless of location, approval must be obtained by the ATC Information Assurance Manager and the ATC Security Manager.

Usage of Privately Owned Personal Electronic Devices (PEDs) Within the Restricted Area (RA). A privately owned personal electronic device (PED) is defined as a civilian multifunction cell phone, personal digital assistant, tablet, blackberry, personal wireless fitness devices (PWFD), digital inventory devices and electronic recording/storage devices. Contractor personnel shall not use the PED’s photographic/recording capability within the ATC Restricted Area (RA). The contractor shall not install or connect a privately owned PED to any government-owned computer or network system. Also, a PED that has the capability to store data cannot be connected to a government computer for purposes of charging the device’s ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for

Contract To Be Determined) battery. Contractor employees must use the appropriate wall adapter to charge a privately owned PED. All PEDs (government or personal) are prohibited in any area that contains a Secure Internet Protocol Router Network (SIPRNET) connection; in any area or briefing room where classified material is being discussed; and in any area designated as a Special Access Program (SAP) area. PEDs are authorized for private, non-work related matters. Under no circumstances will a privately owned PED be used to transmit sensitive government information.

Reports of Adverse Information. The contractor shall report to the ATC Security Manager all adverse information on contractor personnel such as security violations, arrests, bankruptcy, wage garnishments and denial, suspension, or revocation of security clearances. The ATC Security Manager may deny employees’ access into APG restricted areas based upon the adverse information.

Installation Access. All contractor personnel will comply with the requirements of

APG Regulation 190-4, Movement Control Within the Installation, for entry, exit, and internal control of personnel, material and vehicles on APG. To gain access to APG, DA Form 1602, Civilian Identification Card, shall be issued to contractors who do not require computer access or do not travel on official Government business upon written approval from the COR. All vehicles and personnel are subject to search and seizure of contraband and/or unauthorized Government property in accordance with Army Regulation 190-13, The Army Physical Security Program.

Unescorted Access into Restricted Areas. Most areas of ATC are within the restricted areas of APG. Pending issuance of the employee's security clearance, unescorted access will be permitted into the APG restricted areas provided contractor personnel was issued an interim or final SECRET clearance by the Central Adjudication Facility (CAF). If a contractor employee had a previously favorable National Agency Check (NAC) or a National Agency Check with Local Agency Check and credit Check (NACLC) or Tier 3 (T3), subject can be granted unescorted access into the restricted area provided there is no more than a 24 month break in service since the date of the termination of the security clearance and there is no known adverse information.

Restricted Area (RA) Security Identification Credential. Contractor personnel will be granted unescorted access provided the security investigation/clearance requirement stated above has been met. Once a written request from the COR has been received and the investigation or security clearance has been verified by the visit authorization letter or a visit request submitted via JPAS, the contractor employee will have their Department of Defense Common Access Card (CAC) programmed for unescorted access into the RA. At the same time the contract employee’s CAC is programmed, they will be issued an organizational credential to be used while in the RA. This credential identifies that the employee has an official need to be in the RA. If a contractor requires camera pass authority, their government point of contact must send an email to ATC Security justifying why the individual needs camera authorization in the RA. Once approved by ATC Security, a camera pass icon will be placed on the organizational credential. Contractor personnel shall wear their security credential above the waist at all times ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for

Contract To Be Determined) when in the restricted areas of APG with the following exceptions: (a) when photography is ongoing and the employee is likely to be in the photograph, and (b) when the employee is actually working with a piece of equipment that could catch the security credential and endanger the safety of the employee.

Photographic and Recording Permits. The Contractor shall obtain applicable permits to use government issued only photographic and recording equipment within APG restricted areas. Contractor employees who must take photographs in the course of their official duties shall ensure that they have the camera icon on their security area picture badge. At no time will a contractor be permitted to take any type of photographs, video or recording with their personal cellular or Smartphone. All images/video captured in the restricted area are for official purposes only and must be OPSEC reviewed/approved prior to distribution. In order to take recording devices into the restricted areas, the contractor employee must get written permission from the ATC Security Manager.

Common Access Card. All contractor employees who require computer access or travel on official Government business shall be issued a Department of Defense Common Access Card (CAC) through the Defense Enrollment Eligibility Reporting System (DEERS). CACs are processed in accordance with the guidelines for the Trusted Associate Sponsorship System (TASS). The contractor organization security manager gets the upcoming applicant vetted per requirements and forwards that information to the COR who is the Trusted Agent (TA) identified in the TASS. Once the TA receives the required information, it is entered into the TASS. The system generates an ID and new applicant password. The ID and password is forwarded to the applicant who will enter this information into TASS. The system will receive this information and it will notify the applicant with an approval email. Once the TA approves issuance of a CAC to the applicant through the TASS, the applicant can go to the nearest RAPIDS center with the proper identification and will be processed for a CAC which will be issued to them on the spot.

Foreign Nationals/Immigrant Aliens. Foreign nationals/immigrant aliens cannot be granted unescorted access to the restricted area, and shall not be scheduled to perform work under this contract. However, when foreign nationals/immigrant aliens visit ATC, the contractor shall comply with Army Regulation 380-10, Foreign Disclosure and Contacts with Foreign Representatives and local policies.

Safeguarding Government Information and Property. The contractor shall be responsible for Safeguarding all Government information and property provided for contractor use. The contractor shall safeguard information and material designated as classified, unclassified sensitive, For Official Use Only (FOUO), Operations Security (OPSEC) sensitive, and Personally Identifiable Information (PII) in accordance with applicable directives stated in Item 13 (Security Guidance). The contractor will not release any work related information to the public without prior authorization. In addition, the contractor will not post any personal comments associating them with working for the federal government or any type of work related ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for

Contract To Be Determined) information on social media platforms. This includes discussion forums, blogging, etc. Contractor personnel who have access to the Army Test and Evaluation Command (ATEC) Decision Support System (ADSS) will not disclose ADSS information to any person or entity without explicit authority. Government-furnished property will be secured in accordance with AR 190-51, Security of Unclassified Army Property (Sensitive and Nonsensitive).

Loss or Possible Compromise of Classified Information. The contractor shall immediately report the loss or possible compromise of classified information or material to the ATC Security Manager or his designee in accordance with ATC Regulation 380-5, Information Security Program. In the event that there is a data spillage, the contractor will immediately notify their government supervisor, ATC Security Manager or his designee and the ATC Information Assurance Manager.

Courier Card. The contractor may be required to hand carry classified material from one location on the installation to another location. Also, the contractor may be required to hand carry classified to another cleared facility or military organization. In accordance with Army Regulation 380-5, Department of the Army Information Security Program, the contractor will be in possession of the DD Form 2501, Courier Authorization Card. The card authorizes the appropriately cleared government civilian and contractor to hand carry classified material. The contractor’s level of clearance will be the same level of classified material that is being hand carried. If a contractor needs a DD Form 2501, their government sponsor must submit a written request to the COR. The COR will forward request to ATC Security for approval and subsequent issuance of the card. A courier briefing will be given by ATC Security to all courier card holders prior to issuance of the card. If the contractor loses access or leaves employment with the contractor, the card will be returned to ATC Security.

Key Control. The contractor shall have access as needed to all Government-furnished facilities in accordance with Army Regulation 190-11, Physical Security of Arms, Ammunition and Explosives, Army Regulation 190-51, Security of Unclassified Army Property (Sensitive and Nonsensitive), Army Regulation 380-5, Department of the Army Information Security Program and ATC Regulation 380-8, Security Key and Lock Control. The contractor shall develop and implement procedures to account for, control and safeguard metal and electronic keys and proximity cards received from the Government in accordance with above regulations.

Security Training. The contractor shall develop and implement a security education program to ensure contractor personnel understand and are familiar with security requirements. The contractor shall conduct security indoctrination for all new employees within 30 days after their arrival and refresher sessions annually thereafter. Upon completion of the security indoctrination, the contractor will have each employee sign the Standard Form (SF) 312 Classified Information Nondisclosure Agreement prior to granting access to classified information. The contractor will maintain the SF 312 on each employee and this document should be available to the government upon request. Contractor personnel may attend ATC’s annual refresher training; however, contractor personnel who are unable to attend the training ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for

Contract To Be Determined) shall receive the same training from contractor management. This training will include general security education, OPSEC awareness, Information Systems Security, Force Protection, and training on the Threat Awareness Reporting Program (TARP). Designated ATC Security personnel will conduct Anti-Terrorism/Force Protection training for contractor personnel traveling OCONUS. The FSO or the alternate FSO will provide through the COR a record of all contractor employees who have attended annual mandatory training by name and date of attendance to the ATC Security Manager. ATC Security personnel will conduct indoctrination and termination briefings for contractor personnel supporting SAPs.

Operations Security. All written (hard copy) and electronic material produced by the contractor which will be disseminated outside of ATC will be subject to an OPSEC and Security review to be performed by the ATC OPSEC Officer prior to release. This includes all written (hardcopy) and electronic materials produced such as organizational press releases and marketing material. All information associated with a program that is indicated as unclassified/sensitive by the COR shall be afforded protection sufficient to preclude disclosure to individuals who do not have a need to know of the material. As a minimum, the following requirements apply:

a. Distribution of information/reports of this contract shall be limited to personnel associated with this contract and applicable Government personnel.

b. Documents/material shall be kept under lock and key when not in use.

c. Documents/material indicated by the COR as unclassified/sensitive which are no longer required shall be destroyed by shredding or by placing information in a box for destruction during a trip to the incinerator.

Disclosure of Proprietary and Intellectual Information. The contractor may be required to access data and information that is proprietary to another government agency, government contractor or of such a nature that its dissemination or use other than as specified would be adverse or contradictory to the government’s interest. The contractor and their employees shall not divulge or release data or information developed or obtained under this contract except to authorized government personnel or upon written approval from the Contracting Officer.

The Contractor shall not use, disclose or reproduce proprietary data that bears a restrictive legend. The Contractor shall obtain written permission of the originator prior to releasing any information. Under Title 18, Sections 793 and 798, the Contractor and the Contractor employees are liable for any improper release. The Contractor will direct all inquiries, comments, or complaints arising from matters observed, experienced, or learned as a result of, or in connection with the performance of this contract to the Contracting Officer. The resolution of which may require dissemination of official information. In this case, the Contracting Officer, upon a request from the contractor, will coordinate with the ATC Security Manager or designee for guidance. Inquiries the Contractor receives for information relative to the Freedom of ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for

Contract To Be Determined)

Information Act (FOIA) shall be directed to the Contracting Officer, or COR for evaluation. The Government retains the authority to release or deny access to the information. The Contractor shall be responsible for search and submission of records under the Contractors control upon Government request. All work, including but not limited to intellectual property and data rights, produced under this contract is the sole property of the Government.

Departing Employees. The contractor shall ensure all contractor employees return photographic security identification badges and Common Access Cards/ Identification Cards and all permits issued by the Government at the completion of their employment. The turn of these items will be completed no later than 24 hours after their departure. The contractor will ensure that all contract employees receive a security debriefing upon their departure. Following the debriefing, the employee will sign the bottom portion of the SF 312. The contractor will ensure that all employees who maintain a hand receipt do not leave the installation until all items have been accounted for and all equipment under their control has been transferred to the new hand receipt holder. An employment/installation clearance procedure and checklist will be developed and implemented by the contractor to ensure that an employee has turned in all badges, Government property, and keys before leaving employment on the installation and access to the Local Area Network (LAN)/email has been cancelled. This checklist will contain a signature block for the ATC Security and Intelligence Division to initial to ensure all contract employees have cleared all aspects of employment at ATC. Security badges will be returned to the ATC Security and Intelligence Division on the employee’s last day of employment with the government. If departure is after normal business hours, the FSO will collect the badge on the last day of employment and turn the badge in to ATC Security and Intelligence Division the next business day. Keys and proximity cards will be returned to the issuing key custodian prior to the employee departing ATC. In addition, contractor personnel briefed on SAPs shall contact ATC Security personnel to complete a termination briefing prior to termination of employment.

Force Protection. The contractor shall ensure that each contractor employee receives annual Level I Antiterrorism awareness training per Army Regulation 525-13 (Antiterrorism). Contractor personnel may attend ATC’s annual Force Protection training; however, contractor personnel who are unable to attend the training shall receive the same training from contractor management. In addition, contractor personnel traveling outside the 50 States, its territories and possessions shall receive an OCONUS briefing within two (2) months of their scheduled travel. They shall also have received annual Antiterrorism training with 12 months of travel.

SPECIAL ACCESS PROGRAM (SAP) ADDENDUM FOR DD FORM 254

ATTACHMENT THREE

Contract To Be Determined

GENERAL: The policy documents identified below provide the necessary guidance for physical, personnel, and information security for safeguarding SAP information, and are part of the security classification specification for this contract.

a. Department of Defense Manual 5205 Volume 1: Special Access General Procedures, 18 June 2015

b. Department of Defense Manual Volume 2: Special Access Personnel Security Procedures, 24 November 2015

c. Department of Defense 5205 Volume 3: Special Access Physical Security Procedures, 23 April 2015

d. Department of Defense Manual 5205 Volume 4: Special Access Marking Procedures, 10 October 2013

e. SAP-specific Program Security Guides(s) (PSG);

f. SAP-specific Security Classification Guide(s) (SCG);

g. Applicable Facility Specific Standard Operating Procedures

h. Applicable Facility Specific Treaty Plans; and

i. OPSEC Guides.

PROTECTION: All programmatic material relating to this contract and its administration shall be classified in accordance with the requirements outlined in the SAP-specific security classification guides, this DD Form 254, and protected in accordance with the Program Security Guide.

Access: Access to SAP information or material shall be at government facilities and other designated contractor locations only as identified and approved by the Government Program Security Officer (PSO). Access to SAP information will be in accordance with Department of Defense Manual 5205, Volumes one through four. Nomination packages will be sent to the PSO for a Tier Review. Candidates may also be subject to counter-intelligence polygraph exams and random urinalysis testing. Failure of selected individual to submit to the polygraph exams and/or random urinalysis test may result in his or her access to SAP information being suspended. The individual being nominated for access to the SAP must have his company’s Facility Security Officer (FSO) or Contractor Program Security Officer (CPSO) sign the Program Access Request (PAR).

Storage and Handling: Any facility that stores, processes or discusses SAP information or data in regard to this contract will be designated as a SAPF. SAPF’s will be accredited using the standards identified in the references above and approved, in writing, by the PSO prior to any discussions or receipt and/or generation of any classified material. If the proposed SAPF is already accredited by another sponsor and/or located within an accredited Sensitive Compartmented Information Facility (SCIF), the facility will still have to be approved by the PSO. A Co-Utilization Agreement (CUA) is required between the PSO and the SCI CSA or the

ATTACHMENT THREE (Continuation of SAP Addendum for DD Form 254

Contract To Be Determined) established SAP Cognizant Security Authority (CSA) prior to introduction of SAP data into an accredited SCIF or SAPF, respectively. Collateral information/material not directly relating to this contract shall not be introduced or authorized within a SAPF without prior written authorization from the PSO.

Processing: Information Systems (IS) processing SAP data must be certified and accredited and approved to process SAP information by the PSO in writing. Any modifications that affect the security posture of the system will dictate new accreditation (and documentation). Downloading of unclassified information to unclassified media from an IS approved to process SAP information is not permitted.

Communications and Transmissions: Any communications with outside activities not involved with the specific supported SAP are PROHIBITED, unless otherwise authorized by the PSO. It is PROHIBITED to use the following in encrypted emails: SAP nicknames or tri-graphs or di-graphs; SAP, SAR, black program. Information containing any of these terms shall be sent over approved secure communications, refer to the PSG.

Treaty Compliance: Army SAP facilities are subject to inspection and monitoring under select Arms Control Treaties. A notification process must be in place.

Release: Public release of SAP information is PROHIBITED. Finished documents or other materials pertaining to this effort will not be released to the Defense Technical Information Center (DTIC) or any other such information service under any circumstances. A pre-publication and/or presentation(s) review is required prior to the use of any classified or unclassified information which is either tangentially or directly related to any SAP. In each case, approval must be obtained from the PSO. The request must be submitted by the person who desires to make the publication or presentation via the Contract Program Security Officer (CPSO) to the PSO. The contractor shall not use references to SAP accesses or information, even by unclassified acronyms, in advertising, promotional efforts or recruitment of employees.

SUBCONTRACTING: All subcontracts with SAP authorization must have prior approval of the PSO. Contractors will include the provisions of this supplement in all subcontracts requiring SAP access in support of this effort. Any classified program activity that requires the use of a subcontractor facility must meet criteria and be accredited by the PSO. The PSO’s office will provide the SAP-specific documents to the subcontractor once approved for storage.

LEGAL COUNSEL: Should the contractor require private counsel to represent corporate interests in matters related to or associated with SAP sponsored activities, the

Procurement Contracting Officer (PCO), and PSO shall be notified in writing. The private counsel shall be treated as a subcontractor.

ATTACHMENT THREE (Continuation of SAP Addendum for DD Form 254

Contract To Be Determined) In those incidents where the issues are not program specific, it is the responsibility of the appropriate indoctrinated contractor personnel to prevent inadvertent dissemination of SAP related information/data, operational procedures and/or administrative details to the private counsel.

RETENTION OF PROGRAM RELATED DOCUMENTION: Upon completion of this contract and acceptance by the Government of final deliverables, the contractor shall:

Conduct an inventory/audit of all classified documents received and/or generated under this contract and forward it to the PSO.

In accordance with PSO direction, the contractor shall destroy classified material utilizing approved destruction procedure/methods and maintain certificates of destruction for final close-out review. Retention of SAP information at the contractor facility is not generally authorized beyond contract close-out unless a follow on contract/task is anticipated. A written request for authorization for document retention must be forwarded through the PCO to the PSO for approval.

ISSUES/CONFLICT REPORTING:

Any questions regarding classification, access, or any other security related issue in regard to this contract must be referred, in writing, to the PSO.

Any suspected or confirmed security incident or violation involving SAP information will be immediately reported, in writing, to the PSO.

Any conflict between instructions contained in any referenced policy and this DD Form 254 must be reported to the PSO by the most expedient means.

FOUO ADDENDUM FOR DD FORM 254

ATTACHMENT FOUR

Contract To Be Determined

PROTECTING “FOR OFFICIAL USE ONLY” (FOUO) INFORMATION

1. GENERAL:

a. The “For Official Use Only” (FOUO) marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking, but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

b. Other non-security markings, such as “Limited Official Use” and “Official Use Only” are used by non-DoD User Agencies for the same type of information and should be safeguarded and handled in accordance with instruction received from such agencies.

c. Use of the above markings does not mean that the information cannot be released to the public under FOIA, only that the government must review the information prior to its release to determine whether significant and legitimate government purpose is served by withholding the information or portions thereof.

2. MARKINGS:

a. An unclassified document containing FOUO information will be marked “For Official Use Only” at the bottom of the front cover (if any), on the first page, on each page containing FOUO information, on the back page, and on the outside of the back cover (if any).

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked, “FOUO.”

c. Any “For Official Use Only” information released to a contractor by a DoD user Agency is required to be marked with the following statement prior to transfer.

“This document contains information EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FOIA. Exemptions apply.”

d. Removal of the “For Official Use Only” marking can only be accomplished by the originator or other competent authority. When the “For Official Use Only” status is terminated, all known holders will be notified to the extent practical.

ATTACHMENT FOUR (Continuation of FOUO Addendum for DD Form 254

Contract To Be Determined)

3. DISSEMINATION: Contractors may disseminate “For Official Use Only” information to their employees and subcontractors who have a need for the information in connection with a classified contract. Contractors must ensure employees and subcontractors are aware of the special handling instructions detailed below.

4. STORAGE: During working hours, “For Official Use Only” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: “For Official Use Only” information may be sent via first-class mail or parcel post. Bulky shipments may be sent by fourth-class mail. DoD components, officials of DoD components, and authorized DoD contractors, consultants, and grantees send FOUO information to each other to conduct official DoD business. Tell recipients the status of such information, and send the material in a way that prevents unauthorized public disclosure. Make sure documents that transmit FOUO material call attention to any FOUO attachments. Normally, you may send FOUO records over facsimile equipment. To prevent unauthorized disclosure, consider attaching special cover sheets, the location of sending and receiving machines, and whether authorized personnel are around to receive FOUO information. FOUO information may be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Mark the records “For Official Use Only” and tell the recipient the information is exempt from public disclosure under the FOIA and requires special handling.

6. DISPOSITION: When no longer needed, FOUO information must be shredded.

7. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of “For Official Use Only” information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions and disciplinary action may be taken against those responsible.