DRAFT_DDForm254.pdf

13. SECURITY GUIDANCE. (CON’T.)

Solicitation or Contract # Page #

DD FORM 254 (13 CON’T.), MAY 2010

10a. Classified COMSEC material is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. COMSEC access shall be IAW DoD 5220.22-M and AR 380-40. When access is required at Government facilities, contractor personnel will adhere to COMSEC rules and regulations as mandated by Command policy and procedures. Written concurrence of the CM is required prior to subcontracting. 10b. Restricted Data Information is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting. 10c. CNWDI Information is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting. 10d. The contractor is permitted access to Formerly Restricted Data (FRD) in the performance of this contract. Access to FRD requires a final U.S.

Government clearance at the appropriate level. Written concurrence of the KO is required prior to subcontracting. 10e1. SCI Access required. No public release of information authorized, public disclosure or confirmation of any subject related to the support contract is not authorized without first obtaining written approval from the CM. 10e2. Non-SCI Information is not releasable to contractor employees who have not received a clearance at the appropriate security level. Written concurrence of the CM is required prior to subcontracting. Access to Intelligence information required for performance. 10f. Discussion, storage, or processing of SAP information associated with this contract will be conducted in facilities specifically accredited by the Army SAPCO (or designee), or equivalent component-level SAPCO.

Contact the appropriate servicing SAPCO for approved SAP facilities locations. SAP activities are governed by Revision 1 Department of Defense Overprint to the National Industrial Security Program Operating Manual Supplement, 1 APR 04, and applicable program security classification and procedures guides. Component-managed SAPFs and SAP Temporary Secure Working Areas (TSWA) are governed by JAFAN 6/9. Access to SAP information requires employees undergo additional personnel security screening and meet the SAP access standards delineated in the applicable DoD directives and policies.

SAP inspections and security oversight while in component facilities are under the cognizance of the SAPCO, as appropriate. Additional SAP security requirements may apply at alternate locations/facilities based on service/component Command requirements. The KO for these locations/facilities will provide specific guidance as required. SAP inspections conducted at contractor facilities are under the security oversight of the Defense Security Service (DSS) unless officially relieved of their oversight responsibilities. ATC Security and Intelligence Division will conduct SAP briefings and debriefings as required for the contractor personnel, refer to Army Regulation 380-381, Special Access Programs and Sensitive Activities. 10g. Personnel not assigned to a NATO staff position, but requiring access to NATO classified information, NATO COSMIC, NATO Secret or access to the NATO accredited SIPRNET terminals, must possess the equivalent FINAL or Interim U.S. Security Clearance based upon the appropriate personnel security investigation required. Personnel with access to NATO ATOMAL information must have the appropriate level FINAL U.S. Security Clearance. The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees are NATO briefed prior to access being granted. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM Ch 10, Section 7. Prior approval from the CM is required for subcontracting. 10h. Foreign Government Information (FGI) is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level.

Written concurrence of the CM is required prior to subcontracting. 10j. For Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoD 5200.1-R. 10k. Secret Internet Protocol Network (SIPRNET) access required. The contractor shall not access, download or further disseminate any special access data (i.e. intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the KO. In the event that any special access is required, the KO must modify the requirements for the DD Form 254. Note: Once the KO has modified the requirements for the DD Form 254, the Contractor must complete the SIPRNET Access Request Form, along with the modified DD Form 254, and forward to the KO prior to receiving access. A NATO awareness brief will also be required for all Contractors prior to access to the SIPRNET. 11a. Contractor performance is restricted.

Government agency or activity will provide security classification guidance for performance of this contract. Visit request to the CM and/or Security Management Office for need-to-know verification is done through JCAVS IAW Oct 2005 memo. 11f. Contractor employees may be required to perform contract duties OCONUS in support of specific test and evaluation events. Specific locations of such events will be provided to the contractor when the events arise. HQ ATEC will provide security oversight for OCONUS activity. 11j. The contract requires planning for and application of OPSEC in accordance with Army Regulation 530-1, Operations Security (OPSEC) and the contract clauses and statement of work. The ATEC Security Manager will advise the contractor of ATEC's Critical Information (CI), why it needs to be protected, where it is located, who is responsible for it and how to protect it. OPSEC guidance will also be provided as applicable for each unique project or program affected by this support. Individual security classification guides and test plans will be provided by the COR to the contractor for performance of this contract.

US ARMY SCI ADDENDUM TO DD FORM 254

XXX (1)-This contract requires access to Sensitive Compartmented Information (SCI). The Commander, US Army Intelligence and Security Command (INSCOM), acting on behalf of the DA Deputy Chief of Staff (DCS), G-2 is the Cognizant Security Authority (CSA) for the US Army, has exclusive security responsibility for all SCI released to the contractor or developed under the contract and held within the Contractor's SCI Facility (SCIF) or Co-utilization Agreement (CUA).

XXX (2)-The Defense Intelligence Agency (DIA) has security inspection responsibility for SCI and the Defense Security Service (DSS) retains responsibility for all collateral information released or developed under the contract and held within the DoD Contractor's SCIF. All DD Forms 254 prepared for contracts involving access to SCI under this contract must be processed through ACCS to the CM and Industrial Security Specialist for approval.

XXX (3)-The manuals, regulations, and directives checked below provide the necessary guidance for physical, personnel, and information security for safeguarding SCI, and are part of the security classification specification for this contract:

XXX (a)-ICD 503, Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation XXX (b)-ICD 704 Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information XXX (c)-IC Tech Spec-for ICD/ICS 705, Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities XXX (d)-Signals Intelligence Security Regulations (SISR) (Available from the CM) XXX (e)-Imagery Policy Series (Available from the CM) XXX (f)-DoDM 5105 Vol 1 – 3 SCI Administrative Security Manual.

XXX (g)-AR 380-28, DA Special Security System XXX (h)-AR 25-2, Information Assurance XXX (i)-AR 380-381, Special Access Programs XXX (j)-Army Handbook for SCI Contracts.

(k)-Other XXX (4)-Contract estimated completion date (PERIOD OF PERFORMANCE ONLY): 20191108 (NOTE: Option years are not to be included, as an option is not valid until exercised by the government.)

XXX (5)-The name, telephone number, and email and mailing address of the Contract Monitor (CM) and alternate for the SCI portion of this contract are: Kristen Gatch, Address: 2202 Aberdeen Blvd, APG, MD, 21005, Phone: 443-861-9782, Email: kristen.m.gatch.civ@mail.mil, thomas loisel, Address:

2202 Aberdeen Blvd, APG, MD, 21005, Phone: 2542881373, Email: thomas.j.loisel2.civ@mail.mil (Additionally, identify the Security POC, phone number, and email address at the contractor’s/subcontractor’s location): Michael Carr (The CM and the contractor security officer must be registered in the Army Centralized Contracts and Security Portal (ACCS) at the level of contract, in order to process SCI actions)

XXX (6)-All DD Forms 254 prepared for contracts involving access to SCI under this contract must be processed through ACCS to the CM and Industrial Security Specialist for approval and to Contractor Support Element, USAINSCOM, ACofS Security, G2 for review and concurrence of the awarded contract.

XXX (7)-Visit certification to DoD locations is not required, as need to know and accesses is verified at the visiting facility. Non DoD locations the contractor must process request for SCI visit certification(s) through ACCS to the CM for approval and to Contractor Support Element (CSE) for review and processing. Visit certification request must be submitted at least ten (10) working days prior to the visit.

XXX (8)-Debriefings: All FSO’s/CSSO’s must properly debrief all contractors from SCI through ACCS. FSO/CSSO’s must submit the debrief request NLT 7 days and NET 10 days before actual departure. FSO’s/CSSO’s will separate all contractors from JCAVS after completion of debriefing.

XXX (9)-The contractor will not reproduce any SCI related material without prior written permission of the CM.

XXX (10)-Security Classification Guides or extracts are attached or will be provided under separate cover.

XXX (11)-Electronic processing of SCI requires accreditation of the equipment in accordance with ICD 503 and AR 25-2. (Note: NATO security awareness briefing is required for access to JWICS indicated in blocks 10k or 11l of DD 254.).

(12)-This contract requires a contractor Controlled Space or CUA XXX (13)-Request for Indoctrination/Debrief Authority XXX (14)-This contract requires (SI)(TK) (G) (HCS) (Add others as required) XXX (15)-The contractor will perform SCI work under this contract at the following location (Name of government or contractor activity, SCI SMO or CAGE Code):

Agencies: W469AA - US ARMY OPERATIONAL TEST COMMAND(USAOTC), (16)-The contractor identified in Block 6 is a Multiple Facility Organization (MFO) and is authorized to submit DD254 and SCI Addendum for the following SCI locations (Facility Name and CAGE Code).

(17)- SCI Courier Requirement

10. THIS CONTRACT WILL REQUIRE

to 13: k. OTHER: Secret Internet Protocol Network (SIPRNET) access required. The contractor shall not access, download or further disseminate any special access data (i.e. intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the KO. In the event that any special access is required, the KO must modify the requirements for the DD Form 254. Note: Once the KO has modified the requirements for the DD Form 254, the Contractor must complete the SIPRNET Access Request Form, along with the modified DD Form 254, and forward to the KO prior to receiving access. A NATO awareness brief will also be required for all Contractors prior to access to the SIPRNET.

l. OTHER: The contractor is required to handle and safeguard CUI in accordance with DoDM 5200.01, Volume 4, "DoD Information Security Program: Controlled unclassified Information (CUI)", dated 24 Feb 12 and successive editions. Additional information and instruction may be provided by HQ ATEC G-2 or its subordinate command activity security personnel. Contract performance will be at government facilities associated with HQ Army Test and Evaluation Command (ATEC), Army Evaluation Center (AEC), Aberdeen Test Center (ATC) Aberdeen Proving Ground, Maryland, and the Operational Test Command (OTC), Ft. Hood, Texas and Ft. Huachuca, Arizona.