A07_Attachment_III_DD254_Continuation_Sheets.docx

Contract #___TBD_________ ______ Solicitation #_TBD_____ ___________ Unit/Section_30th Signal Battalion, SMG___ DD Form 254 20160804, Block 13 – Continuation Sheet 8 of 8

4. Ref 10g: There is not a defined requirement for NATO access under this contract so Block Item 10g is checked “No” (See Block10k).

5. Ref 10j: For Official Use Only (FOUO) information or Personal Identifying Information (PII) received or generated under this contract shall be controlled and protected, marked, and safeguarded as specified in AR 25-55, DA Freedom of Information Act Program, AR 380-5 (Chapter 5), DA Information Security Program, and DoD 5200.01-M , Volume 4. This includes PII, as defined in DoDD 5400.11 (DoD Privacy Program).

6. Ref 10k: This work performance will require Contractor access to Army Knowledge Online (AKO), SIPRNET, NIPRNET, CENTRIXS (CX), CX-J, CX-K and CX-FE-and/or other information systems at various Government work locations. All access to classified systems shall only be at Government work locations. All system access SAARs will be sponsored by the Contracting Officer’s Representative (COR), and process thru Bn S2 for clearance/IT verification.

6a. Ref 10k: The Contractor shall use only GFP to access the VPN. Per AR 25-1, paragraph 4-1e, the only authorized access from DoD-owned computers, systems, and networks to the Internet is via the NIPRNET. The VPN allows remote DoD computers to meet this requirement by providing a secure tunnel to the NIPRNET. The VPN must be used at all times that the DoD-owned computer is accessing the Internet when using commercial Internet Service Providers. Split-tunneling of VPN connections is prohibited.

6b. Ref 10k: No Contractor or Employee-Owned Information Systems (EOIS) are allowed connection or access via the VPN. The NIPRNET is Sensitive Information. AR 25-2, paragraph 4-31a, prohibits the use of EOIS for sensitive information. Non-Army Government agencies will require evaluation on case-by-case bases. Non-DoD hosts will be treated as un-trusted hosts.

6c. Ref 10k: Accreditation of the SIPRNET backbone to transport NATO Secret and below information resulted in additional security measures across the board. Per DoDM 5200.01-V1, all cleared Department of Defense (DoD) military, civilian, and contractor personnel briefed on their responsibilities for protecting U.S. classified military information be briefed simultaneously on the requirements for protecting NATO classified information. The Contractor Facility Security Officer (FSO) shall provide a NATO awareness brief to contractor personnel and shall maintain written acknowledgement of the individual’s receipt of the awareness brief along with statement of understanding of responsibilities for safeguarding NATO classified information. The general awareness brief is not a “NATO Access Briefing” and does not constitute “need to know or approval for access” to NATO classified information. The awareness briefing should not be entered in the Joint Personnel Adjudication System (JPAS).

7. Ref 11a: Contractor access to classified information shall be limited to that which is necessary to support this contract. Properly cleared contractor personnel, who have an established need-to-know in accordance with this contract, are authorized access to classified information which supports this work effort. Access to classified information shall be at Government facilities only, to include Government facilities visited while in a temporary duty (TDY) travel status in support of this contract. The Contractor shall not remove any classified materials or information from the Government work site(s), nor shall the Contractor reproduce, generate, or store any classified materials relating to this contract at other than specified Government locations. This includes downloading, storing, or transmitting classified information on or to any unauthorized software, hardware or information technology system. Classified material shall only be stored at Government requiring activity work locations in Government furnished GSA approved security containers, or as directed by the COR and/or Government Security Officials.

7a. Ref 11a: Contractor Responsibility: By memorandum dated 1 April 2005, the Deputy Under Secretary of Defense (Counterintelligence and Security) authorized the use of Joint Personnel Adjudication System (JPAS) to verify security clearance levels for cleared personnel who require access to classified information with DOD. Within Army, use of JPAS is mandated. The Contractor Facility Security Officer (FSO) shall ensure all personnel performing on this work effort have security access level, IT/ level, contractor affiliation, Security Management Office (SMO) affiliation and all other required information accurately reflected/populated in JPAS. The Contractor shall make available to the Government requiring activity, and all work locations under this contract, all information necessary to enable verification of security access level/affiliation via JPAS. When Visit Authorization Letters (VALs) are required by the Government requiring activity, they shall be transmitted via JPAS. If any concerned organization is not on-line with JPAS, a hardcopy VAL may be necessary until JPAS is available. The Contractor shall forward VALs for work performance to the 516th Signal Brigade S-2, SMO Code WCD099. The Contractor shall promptly report any change of Contractor personnel on this work effort to the 516th Signal Brigade S2.

7b. Ref 11a: Security In/out-processing. All contractor personnel integrated or embedded with NETCOM organizations shall in-process through the supporting NETCOM organizational G2/S2/Security Office at work performance start date. All contractor personnel integrated or embedded with NETCOM organizations shall out-process and clear through the supporting NETCOM organizational G2/S2/Security Office upon termination of employment on the contract/task order or upon contract/task order expiration/termination, whichever occurs first. Above requirements are applicable if there is a change in primary work performance location while employed on the contract/task order. The prime contractor shall ensure above requirements are included in sub-contracts and lower tier contracts when personnel are integrated or embedded with NETCOM organizations. Per AR 380-49, “embedded and/or integrated contractors are those who operate out of government-supplied on-base space.”

7c. Ref 11a: Required Security Training: Army Learning Management System (ALMS) Initial Security Orientation and Annual Refresher Training. Within 30 business days of work start date, contractor personnel shall complete the Department of the Army standardized computer web-based Initial Security Orientation training and annually thereafter, shall complete the Annual Security Refresher Training, both available at https://www.lms.army.mil, under Information Security Program training. The system will automatically direct the user to the appropriate course based on their training history. Certificates of successful completion, of initial and/or annual refresher training, shall be provided to the COR and the 516th Signal BDE S2 within three (3) business days of completion of training. This training is in addition to unit or installation specific security training.

8. Ref 11e: Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M) and any revisions to DoD 5220.22-M.

8a. Ref 11e: This is a non-personal services only contract (see Block 9). All Contractor personnel working on this contract shall be U.S. citizen personnel and have the required SECRET security clearance at performance start date and shall be able to maintain the required security clearances throughout employment on this contract. Contractor personnel who require a Secret security clearance and who will be performing IT-I functions will require a SSBI completed with suitability determination for IT level I access. The Contractor shall contact the supporting Government Security Office (GSO)/G-2/S-2 for submission of the SSBI (SF 86). The Contractor shall provide the contract/task order number to the GSO/G-2/S-2 as authority to request the investigation. Contractor interim privileged level access to Army systems prior to completion and favorable adjudication of the required investigation will be in accordance with AR 25-2. If contractor personnel have a current favorable SSBI or SSBI Periodic Reinvestigation (SSBI-PR) on record in JPAS, the AR 25-2 investigative requirement for IT-I is satisfied.

8b. Ref 11e: Classified information generated or received during work performance on this contract shall be controlled, marked, protected, transmitted and safeguarded in accordance with AR 380-5 and current Army and DoD policy and shall only be at specified Government requiring activity work locations.

8c. Ref 11e: The process of extracting, paraphrasing, restating or generating classified information based on a security classification guide or one or more source documents, or both, is derivative classification. Any derivatively classified information generated in performance of this contract shall normally be marked according to the classification markings reflected on the source material(s). However, a compilation of information, to include a compilation of unclassified information, could warrant a change in classification level of the information, or, it could warrant the classification of previously unclassified information. The Contractor shall consult with the Contracting Officer’s Representative (COR), and Bn S-2 regarding any potential classification issues when generating information and/or deliverables in support of this contract.

8d. Ref 11e: The Government requiring activity S-2 will identify, or provide, additional instruction or appropriate security classification guides/guidance to the contractor, as required. The Contractor shall notify the COR, and Bn S2 in writing, of any instance where referenced security classification guides/guidance cannot be accessed at links for sites specified in this contract or separate correspondence. The prime contractor shall ensure all applicable security classification guides/guidance are made available to any subcontractor(s), as appropriate.

8e. Ref 11e: Persons who derivatively classify information and who apply derivative classification markings shall receive training in the proper application of derivative classification principles. The Contractor, in coordination with the COR, and Bn S-2 shall identify by name and position title, those contractor, subcontractor, or any lower tier subcontractor personnel who will be generating and derivatively classifying information in support of this contract. This includes, but is not limited to, personnel who require SIPRNET accounts. These individuals shall successfully complete initial Derivative Classification Training at work performance start date, and once every two years, thereafter. Training consists of the Derivative Classification Course (IF103.16) and Derivative Classification Exam (IF103.06) and is available on-line at DSSA/STEPP website: http://cdse.edu/stepp/index.htmlunder Information Security. Certificates of successful completion, of initial and refresher training, shall be provided to the COR and the 516th Signal Brigade S2 within three (3) business days of completion of the training.

8e. Red 11e: The prime contractor shall require subcontractors to include above requirements in their lower tier contracts.

9. Ref 11f: Contractor personnel will require access to classified information OCONUS as officially directed travel may require. Such access is restricted to U.S. Government controlled compounds/work locations. Storage, custody, and control of classified information OCONUS remains the responsibility of the U.S. Government. Hand-carry of classified information is not authorized.

10. Ref 11j: Operations Security (OPSEC). The Contractor is not required to prepare an OPSEC plan. The Contractor shall comply with DoD Directive 5205.02E, Army Regulation 530-1, and the requiring activity OPSEC program. The Contractor shall ensure all contractor employees and subcontractors performing work under this contract complete Level I OPSEC training within 30 calendar days of start of employee performance on this contract and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the COR, upon request.

11. Ref 11l: Information Assurance (IA) Training. All contractor personnel with access to Government information systems and networks shall successfully complete all required initial and annual IA awareness training as specified in AR 25-2 and as directed by the Government requiring activity. Training is available at https://ia.signal.army.mil.

11a. Ref 11l: Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at https://atc.us.army.mil, in the unit container managed by the COR. Certificates of successful completion of IA training, Acceptable Use Policy (AUP), applicable baseline and computing environment certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

11b. Ref 11l: The Contractor shall ensure that all contractor employees and subcontractor employees requiring IA awareness training complete the training at start of work performance on this contract and annually thereafter for the duration of this contract.

11c. Ref 11l: Information Assurance Workforce Certification. Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.239-7001 (Information Assurance Contractor Training and Certification) applies to this contract. This contract is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management IA skills for personnel performing IA functions within DoD. Functions spanning multiple levels require certification of the highest level functions. Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty.

11d. Ref 11l: The Contractor shall ensure its IA workforce members have the baseline certifications corresponding to their IA functions, as defined in Chapters 3, 4, 5, 10 and 11, and Appendix 3 of DoD 8570.01-M at work performance start date. Contractors shall obtain all required Computing Environment (CE) certificates within 30 days of work start unless specified otherwise in the contract. The IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. Contractor certification holders shall ensure that their certificates remain active and are renewed prior to expiration.

11e. Ref 11l: The Contractor shall ensure that all employees IA certifications are released to the Department of Defense through the Defense Workforce Certification Application, https://www.dmdc.osd.mil/milconnect/faces/index.jspx.

11f. Ref 11l: Table 1 reflects the Personnel Security (IT level) and IA workforce specialty requirements, aligning the IA functional responsibilities and access levels to the contract tasks, in accordance with DoD 8570.01-M.

Table 1. Information Technology Access and IA Certification Requirements.

11g. Ref 11l: Non-Government-owned computing systems or devices. The Contractor shall comply with AR 25-1, and AR 25-2. The Contractor shall not install or connect non-Government-owned computing systems or devices to Government networks without the COR coordinating and obtaining proper authorization from the appropriate Information System Security Manager (ISSM), ensuring that all software has a Government Certificate of Networthiness. The non-Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

11h. Ref 11l: Protection of Sensitive Unclassified Data. The Contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and For Official Use Only (FOUO), proprietary, and Law Enforcement Sensitive information residing on Mobile Computing Devices (MCD) or other external media, is protected in accordance with current Data at Rest (DAR) guidelines and requirements. The Contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to, laptop, netbook, notebook, or tablet computers, and Blackberry or equivalent devices. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks, and other portable digital storage devices. Guidance for protecting DAR information appears in DoD Policy Memorandum, 3 Jul 07, subject: Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Media, and DoD Component implementing instructions.

12. Access to Protected Information. Protected information means all non-public information, including, but not limited to, trade secrets or proprietary information of other Contractors, Government source selection information, Privacy Act or personally identifiable information (PII), or any other information with distribution limited by the U.S. Government. If, during the performance of this requirement, Contractor personnel obtain access by any means to protected information, they shall not disclose, publish, divulge, release, or make known, in any manner or to any extent, the information except as necessary to carry out duties under this contract. Protected information shall be given only to persons specifically granted access to this sensitive information and may not be further divulged without specific prior written approval from an authorized U.S. Government individual. Further, contractor employees may use any non-public information for official/authorized U.S. Government purposes, and they shall not use the information for their personal gain, the gain of their employer, or the gain of anyone else. The Contractor shall notify the Contracting Officer of any potential organizational conflicts of interest created by any such access; however, a nondisclosure agreement will not overcome an Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5. Moreover, the Trade Secrets Act prohibits releasing proprietary information without the owner’s consent. Accordingly, all Government Contractors are required to mark their proprietary information, and any time the Contractor is given inadvertent access to such marked information, the Contractor shall inform the Contracting Officer of the access.

13. Common Access Card (CAC). The Government will provide special access badges as necessary. The Prime Contractor Facility Security Officer (FSO) shall ensure that all Contractor personnel acquire and maintain CACs. The approving Government Trusted Agent (TA) may give access to the FSO using the online Trusted Associate Sponsorship System (TASS), https://www.dmdc.osd.mil/tass. Contractor eligibility remains in force during employment under the contract for those employees who have a valid and recurring requirement for access to Government facilities or automation systems to perform those duties stipulated in the contract. The Contractor shall use a valid CAC to access the Government domain. The Contractor shall immediately return the CACs to the COR when the Contractor employee’s employment is terminated or upon expiration of the contract. The CACs expire when Contractor employee’s eligibility terminates or three years from the issuance date, whichever occurs first. The Contractor is responsible for all CACs and shall report all lost or stolen CACs to the COR immediately.

14. Contractor Identification Requirements. In accordance with FAR 37.114 (c), all contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious are required to identify themselves as such to avoid being mistaken for Government officials. Contractors performing work at Government workplaces shall provide their employees with an easily readable identification (ID) badge indicating the employee's name, the contractor's name, the functional area of assignment, and a recent color photograph of the employee. Contractors shall require their employees wear the ID badges visibly when performing work at Government workplaces. Contractor personnel shall also ensure that all e-mails, documents or reports they produce are suitably marked as Contractor products and/or that Contractor participation is appropriately disclosed. All signature blocks on e-mails shall indicate that the sender is a Contractor employee and include the Contractor's company name.

15. Access and General Protection Security Policy and Procedures. Contractor and all associated sub-contractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply will all personal identity verification requirements of FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

16. Antiterrorism Level I Training. The Contractor shall ensure that all contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas complete Antiterrorism (AT) Level I awareness training within 30 calendar days after start of employee performance on this contract. Within 5 calendar days of training, the Contractor shall certify to the COR or KO that all employees performing work under this contract have completed the AT Level I awareness training. AT Level I awareness training as available at https://jkodirect.jten.mil, course #JS-US007.

16a. Outside Continental United States (OCONUS) Travel. If this contract requires OCONUS travel, contractor employees shall obtain KO or COR approval prior to such travel. The contractor employees shall contact the Government requiring activity Antiterrorism Office (ATO) to receive a specific theater AT/threat briefing prior to departing on OCONUS temporary duty travel.

17. Threat Awareness and Reporting Program. Cleared contractor personnel shall comply with all Threat Awareness and Reporting Program (TARP) reporting requirements in accordance with AR 381-12, and as directed by the Government requiring activity. Cleared contractor personnel shall report threat-related incidents, behavioral indicators, and other matters of Counterintelligence (CI) interest as specified in AR 381-12, Chapter 3, to the nearest military CI office, the Facility Security Officer, the Federal Bureau of Investigation, or the Defense Security Service.

17a. The Contractor shall ensure all cleared employees, to include cleared subcontractor employees, attend threat awareness training within 30 calendar days of employee work start date and annually thereafter. Training must be conducted by a supporting CI agent or other authorized trainer as specified in AR381-12 Section II, paragraph 2-4b. The initial training may be satisfied by taking the authorized on-line training via AKO at https://www.lms.army.mil if attendance at a CI training session is not possible within 30 calendar days of employee work start. Certificate of completion shall be maintained on file. The on-line training does not replace the requirement to attend the first available CI conducted threat awareness training session. The Contractor shall maintain training records which include employee names, training dates, training locations, and method of training and shall make such records available to the COR and the 516th Signal BDE S2, upon request.

17b. Contractor personnel who require access to information, or who will be performing or participating in any functions, as outlined in AR 381-12, Section II, paragraph 2-6, shall contact their COR who will coordinate with the supporting Government Security Manager for scheduling of special CI threat-awareness briefings and debriefings, as appropriate. This includes contractor personnel who require access to Sensitive Compartmented Information (SCI), Special Access Program (SAP) information, cryptographic information, or who are system administrators or key information network personnel with administrator-level privileges on Army information systems. These briefings/debriefings are a requirement, as specified in paragraph AR 381-12, paragraph 2-6a. The COR will in-turn coordinate with supporting Government on-site Security Manager for this determination.

18. iWATCH. The Contractor shall ensure that all employees and subcontractor employees performing work under this contract are trained on the local iWATCH program within 30 calendar days of start of employee performance on this contract. The requiring activity ATO will provide the locally developed iWATCH training. The Contractor shall maintain all iWATCH training records and shall provide copies to the COR upon request.

19. Contractor personnel shall comply with all applicable security regulations, guidance and procedures, including local, referenced in this contract and in effect at all Government work locations. Contractor personnel shall attend all Government provided or Government sponsored security and security awareness training as specified by the Government requiring activity. This includes successful completion of all required on-line security training, as directed by the Government requiring activity.

20. Ref 17f: The prime Contractor shall provide a copy of the DD Form 254 and all revisions, for any classified subcontract supporting this work effort, to the Government requiring activity. In addition, the prime Contractor shall require any subcontractors who have lower tier sub-contractors to also comply with this requirement. DD Forms 254 shall be provided to the following:

Other locations as directed by the Government requiring activity/COR.

21. Emergencies and Force Protection Conditions. During declared emergencies and/or elevated Force Protection Conditions (FPCONs) Charlie or Delta, contractor performance under this contract shall be determined by the COR or KO. All Contractor employees providing services under this contract are required to report for duty as scheduled and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the KO or COR. The Contractor Project Manager shall keep the COR apprised of all personnel whereabouts when in a temporary duty (TDY) location.

22. Ref 14: References:

--Army CIO/G6 Best Business Practice 05-PR-M-0002, Information Assurance (IA Training and Certification) (available at https://atc.us.army.mil/iastar/docs/Training_BBP.pdf)

--Committee on National Security Systems Instructions (CNSSI) 4009, National Information Assurance Glossary (available at https://www.cnss.gov/CNSS/issuances/Instructions.cfm)

--Memorandum, Department of the Army G-2, 29 May 2007, subject: Classified Visit Request Process (available from the Government requiring agency)

--Memorandum, Office of the Under Secretary of Defense, 1 April 2005, subject: Facilitating Classified Visits with the Department of Defense (available from the Government requiring agency)

--Memorandum, Office of the Under Secretary of Defense, 5 December 2001, subject: Facilitating Necessary Access to NATO Classified Information (available from the Government requiring agency)