5._Amendment_Seven_-_DD_254__07_Aug_18.pdf

For the best experience, open this PDF portfolio in

Acrobat X or Adobe Reader X, or later.

Get Adobe Reader Now!

http://www.adobe.com/go/reader

DD Form 254 Continuation Sheets (Date: 20180425) Page 1 of 21 ARTS Number: 7007RCC190008967 Contract Number:

Prime Contractor:

Location: United States Army Regional Cyber Center - CONUS (USARCC-C) IT Support

David N. Miller ____________________ Dana H. Williams ____________________

Contracting Officer's Representative SCI Contract Monitor

RCC-C, Bldg. 61801 RCC-C, Bldg. 61801

2133 Cushing Street 2133 Cushing Street

Fort Huachuca, AZ 85613 Fort Huachuca, AZ 85613

2. Ref 1b: There is no requirement for the Contractor to establish safeguarding capability at any company location.

3. Ref 10a: The Contractor is not required to establish a Communications Security (COMSEC) account. However, some work performance will require access to classified COMSEC information, COMSEC key, and/or Controlled Cryptographic Information (CCI), at Government work locations only. A supporting Government COMSEC Account Manager (CAM) may hand-receipt COMSEC material to properly identified/briefed Contractor personnel at specified Government work locations, in order to perform the mission under the terms of the contract. Contractor access to classified COMSEC information requires U.S. Citizenship, a final personnel security clearance at the requisite level, established need-to-know in accordance with this contract, and receipt of all required briefings prior to being granted access to such information.

3a. Ref 10a: The Contractor shall control, protect, safeguard, and account for COMSEC and/or CCI in accordance with AR 380-40, TB 380-41, and other Army, DoD and National level policy, as directed by the Government requiring activity. The Contractor shall comply with all applicable regulations and directives, including requiring activity policies and procedures in effect at requiring activity work locations. The Contractor shall remove any Contractor employee who fails to comply with COMSEC directives, policies and procedures from performance on this contract. Additionally, contractor employees who violate COMSEC directives, policies and procedures could be subject to criminal prosecution or other legal action.

3b. Ref 10a: Contractor personnel shall be familiar with AR 380-40, Chapter 6, on what constitutes a reportable incident and shall report any such incident immediately but no later 4 hours to the responsible CAM and Contracting Officer’s Representative (COR).

Contractor personnel shall be familiar with the security classification guidelines in AR 380-40, Appendix B and shall ensure any incident information is properly marked/protected and reported via secure means (STE or SIPRNET) from Government requiring activity work locations.

3c. Ref 10a: Contractor personnel shall be subject to the Department of the Army Cryptographic Access Program (DACAP) prior to being granted access to any SECRET

DD Form 254 Continuation Sheets (Date: 20180425) Page 2 of 21

Contract Number:

Prime Contractor:

or TOP SECRET cryptographic information that meets the criteria established in AR 380-40, Chapter 7. Contractor enrollment in DACAP requires: receipt of a DACAP briefing administered by the supporting Government requiring activity Security Office, G- 2/S-2; written acknowledgement that they may be randomly selected to undergo a non-lifestyle, counterintelligence scope polygraph (CSP) examination administered in accordance with applicable directives and law; agreement to report all foreign travel and contacts in accordance with AR 380-67; and execution of Part I, SD 572 (Cryptographic Access Certification and Termination Statement). By executing Part I, SD 572, the Contractor employee acknowledges and agrees to be subject to a CSP examination as a requirement for continuing access to classified cryptographic information. When such access is no longer required, Contractor personnel will be debriefed and shall execute Part II of the SD 572. The Government will deny access to classified cryptographic information to any Contractor employee who refuses to participate in DACAP. The Government will also immediately terminate access to classified cryptographic information for any Contractor employee who declines to submit to a CSP examination, and that employee shall debriefed by the Government requiring activity Security Office, G-2/S-2.

3d. Ref 10a: Contractor access to classified COMSEC information requires a final facility clearance at the requisite level and written approval of the Contracting Officer (KO) prior to sub-contracting any work effort that requires access to COMSEC information.

4. Ref 10e (1): See attached US Army Sensitive Compartment Information (SCI) Addendum. Contractors requiring access to the NETCOM Fusion Center (SCIF) located in Greely Hall, Ft Huachuca, AZ will require access to Top Secret with SCI eligibility. At contract start date, these personnel will require a FINAL TOP SECRET security clearance based on a current Tier 5 (T5) or a current T5 Reinvestigation (T5R) with ICD 704 eligibility (SCI) and at employee work start date will require indoctrination to SCI at the SI/TK/G/HCS level. Contractor personnel shall maintain the required security clearance and SCI eligibility throughout employment on this contract. There is a possibility that additional requirements within the existing functional areas may surface which will require access to Top Secret SCI during the life of this contract. Prior written approval of the Contracting Officer (KO) is required before a subcontract involving access to intelligence information can be issued.

4a. Ref 10e(1): Contractor personnel who are SCI indoctrinated shall report all close and continuous relationships with foreign nationals, any unusual/suspicious contact with foreign nationals and all foreign travel (both official and personal) to the supporting Government Special Security Office (SSO). Such travel shall be reported at least 10 business days prior to actual departure date.

DD Form 254 Continuation Sheets (Date: 20180425) Page 3 of 21

Contract Number:

Prime Contractor:

5. Ref 10e (2): Some contractor personnel may be exposed to collateral intelligence information. Intelligence information is not releasable to contractor employees who have not received a security clearance at the appropriate level. DCID 6/6, Control and Dissemination of Intelligence Information, provides policy on control, access, and dissemination of intelligence information. This policy is available from the Government requiring activity. Written approval of the Contracting Officer (KO) is required prior to subcontracting a work effort that requires access to intelligence information.

6. Ref10g: In performance of this contract certain contractor personnel will require a NATO “Access Briefing.” prior to being granted access to Combined Enterprise Regional Information Exchange System (CX-I), Joint Worldwide Intelligence Communications System (JWICS) and/or some locations may require a NATO Access Briefing prior to being granted access to SIPRNET. NATO Access Briefing will be conducted in accordance with local policy and procedures. The contractor shall immediately notify the COR and local security office when personnel depart, lose eligibility for access, or no longer require access.

7. Ref 10j: For Official Use Only (FOUO) information or Personally Identifiable Information (PII) received or generated under this contract shall be controlled and protected, marked, and safeguarded as specified in AR 25-55 (DA Freedom of Information Act Program), Chapter 5, AR 380-5 (DA Information Security Program), and DoD 5200.01-M, Volume 4 (DoD Information Security Program: Controlled Unclassified Information (CUI)). This includes PII, as defined in DoDD 5400.11 (DoD Privacy Program).

8. Ref 10k: This work performance will require Contractor access to Army Knowledge Online (AKO), SIPRNet and NIPRNet and some contractor personnel will require access to CENTRIXS-ISAF (CX-I), DREN and JWICS. All access to SIPRNet, JWICS, or any other classified systems will only be at Government requiring activity work locations. All system access will be sponsored by the Contracting Officer’s Representative (COR).

8a. Ref 10k: Accreditation of the SIPRNET, JWICS and CX-I backbone to transport NATO Secret and below information resulted in additional security measures across the board. Per DoDM 5200.01-V1, all cleared Department of Defense (DoD) military, civilian, and contractor personnel briefed on their responsibilities for protecting U.S.

classified information shall be briefed simultaneously on the requirements for protecting NATO information. The Contractor Facility Security Officer (FSO) shall provide a NATO ‘awareness briefing’ to contractor personnel performing work at Government requiring activity work locations and shall maintain a written acknowledgement of the individual’s

DD Form 254 Continuation Sheets (Date: 20180425) Page 4 of 21

Contract Number:

Prime Contractor:

receipt of the awareness briefing along with a statement of understanding of responsibilities for safeguarding NATO classified information. The NATO awareness briefing does not constitute “need-to-know or access approval” to NATO classified information and shall not be entered in the Joint Personnel Adjudication System (JPAS).

The Contractor shall provide copies of NATO awareness briefings to the COR, upon request.

8b. Ref 10k: Certain contractor personnel may require access to JWICS in performance of their duties: These contractor personnel are required to be US Citizens, have a final Top Secret clearance and indoctrination to SCI at the SI/TK/G/HCS level and NATO Access briefing. The contractor shall immediately notify the COR and local security office when personnel depart, lose eligibility for access, or no longer require access.

8c. Ref 10k: Certain contractor personnel may require access to CENTRIXS-ISAF (CS- I) in performance of their duties. These contractor personnel will be required to have a Foreign Disclosure Briefing, provided by the Government requiring activity, prior to being granted access to CENTRIXS. The Contractor shall immediately notify the COR when personnel depart, lose eligibility for access or no longer require access to CX-I

8d. Ref 10k: The Contractor shall use only government property to access the VPN.

Per AR 25-1, paragraph 4-1e, the only authorized access from DoD-owned computers, systems, and networks to the Internet is via the NIPRNET. The VPN allows remote DoD computers to meet this requirement by providing a secure tunnel to the NIPRNET.

The VPN must be used at all times that the DoD-owned computer is accessing the Internet when using commercial Internet Service Providers. Split-tunneling of VPN connections is prohibited.

8e. Ref 10k: No Contractor or Employee-Owned Information Systems (EOIS) are allowed connection or access via the VPN. The NIPRNET is Sensitive Information. AR 25-2, paragraph 4-31a, prohibits the use of EOIS for sensitive information. Non-Army Government agencies will require evaluation on case-by-case bases. Non-DoD hosts will be treated as un-trusted hosts.

9. Ref 11a: Properly cleared contractor personnel who have an established need-to-know in accordance with this contract are authorized access to classified information which supports this work effort. Access to classified information which supports this work effort is restricted to Fort Huachuca, Fort Gordon, Fort Eustis or Fort Sam Houston and includes Government facilities visited while in temporary duty (TDY) travel status in support of this contract. The Contractor shall not remove any classified materials or information from the Government work site (s), nor shall the Contractor reproduce, generate, or store any classified materials or information relating to this contract at other

DD Form 254 Continuation Sheets (Date: 20180425) Page 5 of 21

Contract Number:

Prime Contractor:

than specified Government work locations. This includes downloading, storing, or transmitting classified information on or to any unauthorized software, hardware, or information technology system. Classified material shall only be stored at Government requiring activity work locations in Government furnished GSA approved security containers, or as directed by the COR and/or Government Security Officials.

9a. Ref 11a: Contractor Responsibility: By memorandum dated 1 April 2005, the Deputy Under Secretary of Defense (Counterintelligence and Security) authorized the use of JPAS to verify security clearance levels for cleared personnel who require access to classified information within the DoD. Within Army, use of JPAS is mandated.

The Contractor FSO shall ensure all cleared personnel performing on this work effort have security access level, Information Technology (IT) level, Contractor affiliation, Security Management Office (SMO) affiliation and all other required information accurately reflected/populated in JPAS. The Contractor shall make available to the Government requiring activity, and all work locations under this contract, all information necessary to enable verification of security access level/affiliation via JPAS.

9b. Ref 11a: The Contractor shall submit a Visit Authorization Letter (VAL) via JPAS which reflects all contractor personnel who will be performing on this contract. VALs shall include the contract number in the additional information block and COR/Government Requiring Activity (RA) POC name and telephone number. In order to facilitate visit access control, the Contractor shall submit a roster for all un-cleared contractor personnel which also includes contract/task order number and COR/RA name and telephone number. All VARs/rosters shall be maintained current throughout the life of the task order and shall be updated as personnel or other relevant changes occur. All Contractor personnel must be reflected on a current VAR/roster in order to perform on this task order. Prime contractor shall ensure all subcontractors comply with these requirements. All VARs/rosters shall be submitted to locations reflected below::

Regional Cyber Center-CONUS SMO code: WCDP996 Fax number: (520) 538-9804

7th SC (T) SMO code: WH4UAA-6 Fax number: (706) 787-7883

9c. Ref 11a: Collateral Security In/out-processing: All contractor personnel integrated or embedded with NETCOM organizations shall in-process through the supporting NETCOM organizational G2/S2/Security Office at work performance start date. All contractor personnel integrated or embedded with NETCOM organizations shall out-process and clear through the supporting NETCOM organizational G2/S2/Security Office upon termination of employment on the contract or upon contract

DD Form 254 Continuation Sheets (Date: 20180425) Page 6 of 21

Contract Number:

Prime Contractor:

expiration/termination, whichever occurs first. Above requirements are applicable if there is a change in primary work performance location while employed on the contract.

The prime contractor shall ensure above requirements are included in sub-contracts and lower tier contracts when personnel are integrated or embedded with NETCOM organizations. Per AR 380-49, “embedded and/or integrated contractors are those who operate out of government-supplied on-base space”.

9d. Ref 11a: Required Security Training: Army Learning Management System (ALMS) Initial Security Orientation and Annual Refresher Training. Within 30 business days of work start date, contractor personnel shall complete the Department of the Army standardized computer web-based Initial Security Orientation training and annually thereafter, shall complete the Annual Security Refresher Training, both available at https://www.lms.army.mil under Information Security Program training. The system will automatically direct the user to the appropriate course based on their training history.

Certificates of successful completion, of initial and/or annual refresher training, shall be provided to the COR within three (3) business days of completion of training. This training is in addition to unit or installation specific security training.

10. Ref 11e: Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M) and any revisions to DoD 5220.22-M.

10a. Ref 11e: This is a non-personal service contract (see Block 9). All Contractor personnel working on this contract, EXCEPT those who require access to Top Secret/SCI, shall have the required SECRET security clearance at performance start date and shall be able to maintain the required security clearances throughout employment on this contract.

10b. Ref 11e: Contractor personnel who require a Secret security clearance and who will require IT Level I system access or who will be performing IT level I functions require a Tier 5 (T5) Investigation completed with fitness determination for IT Level I access. If Contractor personnel do not have a favorable T5 investigation on record, the Contractor shall contact the supporting Government Security Office/G2/S2 for submission of the T5 investigation (SF 86). The Contractor shall provide the contract/task order number as authority to request the investigation. Contractor interim privileged level access to Army systems prior to completion and favorable fitness determination of the required investigation will be in accordance with AR 25-2.

DD Form 254 Continuation Sheets (Date: 20180425) Page 7 of 21

Contract Number:

Prime Contractor:

10c. Ref 11e: Classified information generated or received during work performance on this contract shall be controlled, marked, protected, transmitted, and safeguarded in accordance with AR 380-5 and current Army and DoD policy and shall only be at specified Government requiring activity work locations.

10d. Ref 11e: The process of extracting, paraphrasing, restating or generating classified information based on a security classification guide or one or more source documents, or both, is derivative classification. Any derivatively classified information generated in performance of this contract shall normally be marked according to the classification markings reflected on the source material(s). However, a compilation of information could warrant a change in classification level of the information, or, it could warrant the classification of previously unclassified information. The Contractor shall consult with the COR regarding any potential classification issues when generating information and/or deliverables in support of this contract.

10e. Ref 11e: The Government requiring activity will identify, or provide, additional instruction or appropriate security classification guides/guidance to the contractor, as required. The Contractor shall notify the COR, in writing, of any instance where referenced security classification guides/guidance cannot be accessed at links or sites specified in this contract or specified in separate correspondence. The prime contractor shall ensure all applicable security classification guides/guidance are made available to any subcontractor(s), as appropriate.

10f. Ref 11e: Persons who derivatively classify information and who apply derivative classification markings shall receive training in the proper application of derivative classification principles. The Contractor, in coordination with the COR, shall identify by name and position title, those contractor, subcontractor, or any lower tier sub-contractor personnel who will be generating and derivatively classifying information during work performance on this contract. This includes, but is not limited to, personnel who require SIPRNet or JWICS accounts. These individuals shall successfully complete initial Derivative Classification Training at work performance start date, and once every two years thereafter. Training consists of the Derivative Classification Course (IF103.16) and Derivative Classification Exam (IF103.06) and is available on-line at the DSSA/STEPP website http://www.cdse.edu/stepp/index.html, under Information Security. Certificates of successful completion, of initial and refresher training, shall be provided to the COR within three (3) business days of completion of the training.

10g. Ref 11e: The prime contractor shall require sub-contractors to include above requirements in their lower tier contracts.

DD Form 254 Continuation Sheets (Date: 20180425) Page 8 of 21

Contract Number:

Prime Contractor:

11. Ref 11f: Contractor personnel may require access to classified information OCONUS as officially directed travel may require. Such access is restricted to U.S.

Government controlled compounds/work locations. Storage, custody and control of classified information OCONUS remains the responsibility of the U.S. Government.

Hand carry of classified information is not authorized.

12. Ref 11j: The Contractor is not required to prepare an OPSEC Plan. However, the Contractor shall comply with DoD Directive 5205.02E, Army Regulation 530-1, and the requiring activity OPSEC program. The Contractor shall ensure all contractor employees and subcontractors performing work under this contract complete Level I OPSEC training within 30 calendar days of start of employee performance on this contract and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the COR upon request.

13. Ref 11l: Information Assurance (IA) Training. All contractor personnel with access to Government information systems and networks shall successfully complete all required initial and annual IA awareness training as specified in AR 25-2 and as directed by the Government requiring activity. Training is available at https://ia.signal.army.mil.

13a. Ref 11l: Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at https://atc.us.Army.mil, in the unit container designated by the COR. Certificates of successful completion of IA training, Acceptable Use Policies (AUP), applicable baseline and computing environment certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

13b. Ref 11l: The Contractor shall ensure that all contractor employees and subcontractor employees requiring IA awareness training complete the training at start of work performance on this contract and annually thereafter for the duration of this contract.

13c. Ref 11l: Information Assurance Workforce Certification. Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.239-7001 (Information Assurance Contractor Training and Certification) applies to this contract. This contract is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management IA skills for personnel performing IA functions within DoD. Functions spanning multiple levels require certification of the highest level functions. Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty.

DD Form 254 Continuation Sheets (Date: 20180425) Page 9 of 21

Contract Number:

Prime Contractor:

13d. Ref 11l: The Contractor shall ensure its IA workforce members have the baseline certifications corresponding to their IA functions, as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3 of DoD 8570.01-M at work performance start date. Contractors will obtain all required Computing Environment (CE) certificates within 6 months of being engaged. The IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. The Contractor shall ensure that all employee certifications remain active and renewed prior to expiration.

13e. Ref 11l: The Contractor shall ensure that all employees IA certifications are released to the Department of Defense through the Defense Workforce Certification Application at https://www.dmdc.osd.mil/milconnect/faces/index.jspx.

13f. Ref 11l: Table 1 reflects the Personnel Security (IT Level) and IA Workforce Specialty requirements, aligning the IA functional responsibilities and access levels to the contract tasks, in accordance with DoD 8570.01-M.

Table 1. Information Technology Access and IA Certification Requirements.

Functional Category

IT

Level

(IAW

AR 25-

2)

Security

Clearance

Investigation

Required

IA

Certification

Category and

Level (IAW

DoD 8570.01-

M and BBP

05-PR-M-

0002)

Computing

Environment

Application Systems Analysis II SECRET TIER 3 (T3) IAT II Yes

Data Security Analysis I SECRET T5 IAT-II Yes

Data Security Analysis (CND

Neat/Policy) I SECRET T5

P:

CNDCSSP-A

E: IAT II Yes

Data Security Analysis (CND

Sensors) I SECRET T5

CNDCSSP-IS

Database Analysis/Programming II SECRET T3 IAT II Yes

Systems Administration II SECRET T3 IAT-II Yes

Systems Administration (Proxy) I SECRET T5

P: IAT II

E:

CNDCSSP-IS Yes

DD Form 254 Continuation Sheets (Date: 20180425) Page 10 of 21

Contract Number:

Prime Contractor:

Systems Administration

(Windows Systems

Management) I

TOP

SECRET/SCI T5 IAT II Yes

Systems Engineering I SECRET T5 IAT II Yes

System Engineering (JRSS

O&M Support) I

SECRET/SCI T5

Systems Engineering

(Networks, Proxy) I SECRET T5

Information Technology

Security Analysis II SECRET T3 IAM II No

Security Analysis II SECRET T3 IAT II Yes

Security Analysis ( CND, CND

Sensors) I SECRET T5

Network Administration I SECRET T5

Network Administration

(JRSS O&M Support) I

SECRET/

SCI T5

Network Architect Support

(Infrastructure) I

SECRET/

SCI T5 IAT II Yes

(Exchange/AD Server and

Workstation Support/Web Site

Development/ Technical Tasks) I SECRET T5 IAT II Yes

(Networks) I SECRET T5

Program Management I

SECRET/SCI T5 IAM II No

DD Form 254 Continuation Sheets (Date: 20180425) Page 11 of 21

Contract Number:

Prime Contractor:

Project Management I SECRET T5 IAM II No

Security Management I

SECRET/SCI T5 IAT II No

Subject Matter Expert Support

(Active Directory) I SECRET T5 IAT II Yes

Subject Matter Expert (CND) I

E: IAM II Yes

Subject Matter Expert Support

(Networks) I SECRET T5

Subject Matter Expert (JRSS

Service Migration Team (SMT) I

Subject Matter Expert (JRSS

O&M Support) I

Subject Matter Expert Support I SECRET T5 IAT II Yes

Account Administration II SECRET

T3 IAT-II Yes

SIPR Systems Integration I SECRET

T5 IAT II Yes

Web Content Administration II SECRET T3 IAT II Yes

Web Software Development II SECRET T3 IAT II Yes

Web Technical Administration II SECRET T3 IAT II Yes

Incident Handling (DCO) I

SECRET/SCI

T5

CNDCSSP-IR

Threat Analysis (DCO) I

CNDCSSP-A

E: IAT III Yes

Forensics / Malware Analysis

(DCO) I

CNDCSSP-IR

Defense Assessment Analysis

(DCO) I

CNDCSSP-

AU

DD Form 254 Continuation Sheets (Date: 20180425) Page 12 of 21

Contract Number:

Prime Contractor:

Application Development

(DCO) II

System Administration (DCO) II

Database Administration (DCO) II

Network Engineering

/Architecture(DCO) I

ITIL Support III

SECRET T3 N/A No

Operations Bridge Support III

Help Desk Support III

Logistics Support III

13g. Ref 11l: Non-Government-owned computing systems or devices. The Contractor shall comply with AR 25-1 and AR 25-2. The Contractor shall not install or connect non- Government-owned computing systems or devices to Government networks without the COR's coordinating and obtaining proper authorization from the appropriate Information System Security Manager (ISSM), ensuring that all software has a Government Certificate of Networthiness. The non-Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

13h. Ref 11l: Protection of Sensitive Unclassified Data. The Contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and For Official Use Only (FOUO), proprietary, and Law Enforcement Sensitive

DD Form 254 Continuation Sheets (Date: 20180425) Page 13 of 21

Contract Number:

Prime Contractor:

information residing on Mobile Computing Devices (MCD) or other external media, is protected in accordance with current Data at Rest (DAR) guidelines and requirements.

The Contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to, laptop, Netbook, notebook, or tablet computers, and Blackberry or equivalent devices. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks, and other portable digital storage devices.

14. Ref 12: No public release of SCI or NON-SCI information is authorized, public disclosure or confirmation of any subject related to the support contract is authorized without first obtaining written approval from the KO.

15. Access to Protected Information. Protected information means all non-public information, including, but not limited to, trade secrets or proprietary information of other Contractors, Government source selection information, Privacy Act or personally identifiable information (PII), or any other information with distribution limited by the Government. If, during the performance of this requirement, Contractor personnel obtain access by any means to protected information, they shall not disclose, publish, divulge, release, or make known, in any manner or to any extent, the information except as necessary to carry out duties under this contract. Protected information shall be given only to persons specifically granted access to this sensitive information and may not be further divulged without specific prior written approval from an authorized U.S.

Government individual. Further, contractor employees may use any non-public information for official/authorized Government purposes, and they shall not use the information for their personal gain, the gain of their employer, or the gain of anyone else. The Contractor shall notify the Contracting Officer of any potential organizational conflicts of interest created by any such access; however, a nondisclosure agreement will not overcome an Organizational Conflict of Interest (OCI) as defined in FAR Subpart

9.5. Moreover, the Trade Secrets Act prohibits releasing proprietary information without the owner’s consent. Accordingly, all Government Contractors are required to mark their proprietary information, and any time the Contractor is given inadvertent access to such marked information, the Contractor shall inform the Contracting Officer of the access.

16. Common Access Card (CAC). The Government will provide special access badges as necessary. The Prime Contractor Facility Security Officer (FSO) shall ensure that all Contractor personnel acquire and maintain CACs. The approving Government Trusted Agent (TA) may give access to the FSO using the online Trusted Associate Sponsorship System (TASS), https://www.dmdc.osd.mil/tass. Contractor eligibility remains in force during employment under the contract for those employees who have a valid and recurring requirement for access to Government facilities or automation

DD Form 254 Continuation Sheets (Date: 20180425) Page 14 of 21

Contract Number:

Prime Contractor:

systems to perform those duties stipulated in the contract. The Contractor shall use a valid CAC to access the Government domain. The Contractor shall immediately return the CACs to the COR when the Contractor employee’s employment is terminated or upon expiration of the contract. The CACs expire when Contractor employee’s eligibility terminates or three years from the issuance date, whichever occurs first. The Contractor is responsible for all CACs and shall report all lost or stolen CACs to the COR immediately. SIPRNet tokens will be issued, by the Information Assurance Manager (IAM), to contractors requiring access to SIPRNet terminals. SIPRNet tokens expire when Contractor eligibility terminates and shall be returned to the IAM immediately.

17. Contractor Identification Requirements. In accordance with FAR 37.114 (c), all contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious are required to identify themselves as such to avoid being mistaken for Government officials.

Contractor personnel who are retired military shall not use their retired military rank/titles while working in an official role as a Government contractor on this contract.

Contractors performing work at Government workplaces shall provide their employees with an easily readable identification (ID) badge indicating the employee’s name, the contractor’s name, the functional area of assignment, and a recent color photograph of the employee. Contractors shall require their employees to wear the ID badges visibly when performing work at Government workplaces. Contractor personnel shall also ensure that all e-mails, documents or reports they produce are suitably marked as Contractor products and/or that Contractor participation is appropriately disclosed. All signature blocks on emails shall indicate that the sender is a Contractor employee and include the Contractor’s company name. In the case of this contract, company ID badges shall be worn in conjunction with any Government provided identification cards or badges.

18. Access and General Protection Security Policy and Procedures. Contractor and all associated sub-contractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office.

Contractor workforce must comply will all personal identity verification requirements of FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

Contractor personnel shall comply with all security policies/procedures in effect at all work and TDY locations.

DD Form 254 Continuation Sheets (Date: 20180425) Page 15 of 21

Contract Number:

Prime Contractor:

19. Antiterrorism Level I Training. The Contractor shall ensure that all contractor employees, including sub-contractor employees, requiring access to Army installations, facilities, or controlled access areas complete Antiterrorism (AT) Level I awareness training within 30 calendar days after start of employee performance on this contract.

Within 5 calendar days after completion of training, the contractor shall certify to the COR or KO that all employees performing work under this contract have completed the AT Level I awareness training. AT Level I awareness training is available at https://jkodirect.jten.mil, course # JS-US007. This training is in addition to any required unit or theater specific AT Level I training which may be more stringent based on area of operation or need for heightened awareness.

20. Outside Continental United States (OCONUS) Travel. If this contract requires OCONUS travel, contractor employees shall obtain KO or COR approval prior to such travel. The contractor employees shall contact the Government requiring activity Antiterrorism Office (ATO) to receive a specific theater AT/threat briefing prior to departing on OCONUS temporary duty travel.

21. Threat Awareness and Reporting Program. Contractor personnel shall comply with all Threat Awareness and Reporting Program (TARP) reporting requirements in accordance with AR 381-12, and as directed by the Government requiring activity.

Contractor personnel shall report threat-related incidents, behavioral indicators, and other matters of Counterintelligence (CI) interest as specified in AR 381-12, Chapter 3, to the nearest military CI office, the Facility Security Officer, the Federal Bureau of Investigation, or the Defense Security Service (DSS).

21a. The Contractor shall ensure all contractor employees, to include sub-contractor employees, attend threat awareness training within 30 calendar days of employee work start date and annually thereafter. Training must be conducted by a supporting CI agent. The initial training may be satisfied by taking the authorized on-line training at https://www.lms.army.mil if attendance at a CI training session is not possible within 30 calendar days of employee work start. Certificate of completion shall be maintained on file. The on-line training does not replace the requirement to attend the first available CI conducted threat awareness training session. The Contractor shall maintain training records that include employee name, training dates, training locations, and method of training and shall make such records available to the COR, upon request.

21b. Contractor personnel who require access to information, or who will be performing or participating in any functions, as outlined in AR 381-12, paragraph 2-6, shall contact their COR who will coordinate with the supporting Government Security Manager for scheduling of special CI threat-awareness briefings and debriefings, as appropriate.

This includes contractor personnel who require access to Sensitive Compartmented

DD Form 254 Continuation Sheets (Date: 20180425) Page 16 of 21

Contract Number:

Prime Contractor:

Information (SCI), Special Access Program (SAP) information, cryptographic information, or who are system administrators or key information network personnel with administrator-level privileges on classified or unclassified Army information systems.

These contractor personnel shall notify their COR in advance of any foreign travel to determine if special CI threat travel briefings/debriefings are required, as specified in AR 381-12, paragraph 2-6a. The COR will coordinate with the supporting Government on-site Security Manager for this determination.

22. iWATCH. The Contractor shall ensure that all employees and subcontractor employees performing work under this contract are trained on the local iWATCH program within 30 calendar days of start of employee performance on this contract.

The requiring activity ATO will provide the locally developed iWATCH training. The Contractor shall maintain all iWATCH training records and shall provide copies to the COR upon request.

23. Contractor personnel shall comply with all applicable security regulations, guidance, and procedures, including local, referenced in the DD Form 254, Performance Work Statement (PWS), and in effect at all work locations. Contractor personnel shall attend all Government provided security and security awareness training as specified by the Government requiring activity. This includes successful completion of all required on-line security training, as directed by the Government requiring activity.

24. The prime contractor shall provide a copy of the DD Form 254 and all revisions, for any classified subcontract supporting this work effort, to the Government requiring activity work location (2RCC-W). In addition, the prime contractor shall require any sub-contractors who have lower tier sub-contractors to also comply with this requirement.

DD Forms 254 shall be provided to the following:

NETCOM 7th SC (T) ATTN: NETC-IS/G-2 423 22nd Street, Bldg. 21715 2133 Cushing Street (Greely Hall), Ste. 2320 ATTN: NETC-SFC-ISS/G-2 Fort Huachuca, AZ 85613-7070 Fort Gordon, GA 30905 (Unclassified fax (520) 538-8787) Unclassified Fax (706) 787-7943/7907

Other locations as directed by the Government requiring activity/COR

25. Emergencies and Force Protection Conditions. During declared emergencies and/or elevated Force Protection Conditions (FPCONs) Charlie or Delta, contractor performance under this contract shall be determined by the COR or KO. All Contractor employees providing services under this contract are required to report for duty as scheduled and remain on duty during declared emergencies and/or elevated FPCON

DD Form 254 Continuation Sheets (Date: 20180425) Page 17 of 21

Contract Number:

Prime Contractor:

levels unless otherwise directed by the KO or COR. The Contractor Project Manager shall keep the COR apprised of all personnel whereabouts when in a temporary duty (TDY) location.

26. Contractor personnel will require access to Army Knowledge Online (AKO). The COR will provide sponsorship for this access.

27. Contractor personnel shall comply with all entry control requirements and security policies/procedures in effect at all work and TDY locations. This includes, but is not limited to, displaying Common Access Card (CAC) or any special access badges as required at any work location.

28. ORAL ATTESTATION OF SECURITY RESPONSIBILITIES. (DFARS Clause 252.204-7005)

(a) Contractor employees cleared for access to Top Secret (TS), Special Access Program (SAP), or Sensitive Compartmented Information (SCI) shall attest orally that they will conform to the conditions and responsibilities imposed by law or regulation on those granted access. Reading aloud the first paragraph of Standard Form 312, Classified Information Nondisclosure Agreement, in the presence of a person designated by the Contractor for this purpose, and a witness, will satisfy this requirement. Contractor employees currently cleared for access to TS, SAP, or SCI may attest orally to their security responsibilities when being briefed into a new program or during their annual refresher briefing. There is no requirement to retain a separate record of the oral attestation.

(b) If an employee refuses to attest orally to security responsibilities, the Contractor shall deny the employee access to classified information and shall submit a report to the Contractor’s security activity.

29. FAR Clause 52.204-2 (Security Requirements) is applicable to this contract.

30. Ref 14: References:

AR 25-1 Army Information Technology AR 25-2 Information Assurance AR 25-55 The Department of the Army Freedom of Information Act Program AR 190-13 The Army Physical Security Program (FOUO requires AKO access) AR 190-51 Security of Unclassified Army Property (Sensitive and Non-sensitive) AR 350-1 Army Training and Leader Development AR 380-5 Department of the Army Information Security Program AR 380-49 Industrial Security Program

DD Form 254 Continuation Sheets (Date: 20180425) Page 18 of 21

Contract Number:

Prime Contractor:

AR 380-67 Personnel Security Program AR 381-12 Threat Awareness and Reporting Program (TARP) AR 380-40 Policy for Safeguarding and Controlling Communications Security

(COMSEC) Material (FOUO requires AKO access) AR 525-13 Antiterrorism (FOUO) AR 530-1 Operations Security (OPSEC) TB 380-41 Security: Procedures for Safeguarding, Accounting and Supply Control of

COMSEC Material (FOUO requires AKO access) DCID 6/6 Control and Dissemination of Intelligence Information (available from

Government Requiring Activity) DoDM 5105.21-V1 Sensitive Compartmented Information (SCI) Administrative

Security Manual: Administration of Information and Information Systems Security

DoDM 5105.21-V2 Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Physical Security, Visitor Control, and Technical Security

DoDM 5105.21-V3 Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Personnel Security, Industrial Security, and Special Activities

DoDM 5200.01, Vol 1 DoD Information Security Program: Overview, Classification, and Declassification

DoDM 5200.01, Vol 2 DoD Information Security Program: Marking of Classified Information DoDM 5200.01, Vol 3 DoD Information Security Program: Protection of Classified Information DoDM 5200.01, Vol 4 DoD Information Security Program: Controlled Unclassified Information (CUI) DoDD 5205.02E DoD Operations Security (OPSEC) Program DoDD 5400.11 DoD Privacy Program DoDD 8140.01 Cyberspace Workforce Management DoDI 8500.01 Cybersecurity DoD 5220.22-M National Industrial Security Program Operating Manual

(NISPOM)

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information

Technology (IT) DoD 8570.01-M Information Assurance Workforce Improvement Program

Army CIO/G6 Best Business Practice 05-PR-M-0002, Information Assurance (IA Training and Certification) (available at https://www.milsuite.mil/wiki/Portal:Army_Cybersecurity/Best_Business_Practices)

DD Form 254 Continuation Sheets (Date: 20180425) Page 19 of 21

Contract Number:

Prime Contractor:

Committee on National Security Systems Instructions (CNSSI) 4009, National Information Assurance Glossary (available at http://www.cnss.gov/CNSS/issuances/Instructions.cfm )

Deputy Under Secretary of Defense memorandum, 1 Apr 2005, Subject: Facilitating Classified Visits within the Department of Defense

Department of the Army G2 memorandum, 29 May 2007, subject: Classified Visit Request Process

NETCOM Regulation 380-5, Information Security

NETCOM Regulation 380-67, Personnel Security

Operation Order (OPORD) 0910-300, 9th Signal Command (Army), 14 AUG 09, DAR Deployment

US Army Cyber Command and Second Army Security Classification Guide for Cyberspace Operations and Security, 19 May 2016 (all subsequent versions) (FOUO available from the Government requiring activity).

DD Form 254 Continuation Sheets (Date: 20180425) Page 20 of 21

Contract Number:

Prime Contractor:

US ARMY SCI ADDENDUM TO DD FORM 254

XXX (1) This contract requires access to Sensitive Compartmented Information (SCI). The Commander, US Army Intelligence and Security Command (INSCOM), acting on behalf of the DA Deputy Chief of Staff (DCS), G-2 as the Cognizant Security Authority (CSA) for the US Army, has exclusive security responsibility for all SCI released to the contractor or developed under the contract and held within the Contractor's SCI Facility (SCIF) or Co-utilization Agreement (CUA) SCIF. The Defense Intelligence Agency (DIA) has security inspection responsibility for SCI and the Defense Security Service (DSS) retains responsibility for all collateral information released or developed under the contract and held within the DoD Contractor's SCIF. The manuals, regulations and directives checked below provide the necessary guidance for physical, personnel, and information security for safeguarding SCI, and are part of the security classification specification for this contract:

XXX DoD Manual 5105.21, Vol 1 - 3, SCI Administrative Security Manual XXX Signals Intelligence Security Regulations (SISR) (Available from the CM) XXX Imagery Policy Series (Available from the CM) N/A ICD 503, Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation XXX ICD 705, Sensitive Compartmented Information Facilities XXX AR 25-2, Information Assurance XXX AR 380-28, DA Special Security System (U) N/A AR 380-381, Special Access Programs (SAPS).

XXX Army Handbook for SCI Contracts XXX Other:; DoD Manual 5220.22-M, National Industrial Security Program Operating Manual (NISPOM)

XXX (2) Contract estimated completion date: 30 Nov 2019 (NOTE: Section “F” of the contract normally provides the Period of Performance. Option years are not to be included, as an option is not valid until exercised by the government.)

XXX (3) The name, telephone number, e-mail address and mailing address of the Primary and Alternate Contract Monitors (CM) for the SCI portion of this contract are:

PRIMARY: Dana H. Williams, NETCOM, RCC-C, Ft. Huachuca, AZ 85613; TOP SECRET/SCI; (520) 538-9571; DSN 879; NIPR email: dana.h.williams.civ@mail.mil.

ALTERNATE: Matthew W. Barker, NETCOM, RCC-C, Ft. Huachuca, AZ, 85613; TOP SECRET/SCI;

(520) 538 0180; DSN 879; NIPR email: matthew.w.barker10.civ@mail.mil .

Security POC, phone number and e-mail address at the contractor’s/subcontractor’s location: Enter upon contract award. The CM and the contractor security officer must be registered in Army Centralized Contracts and Security Portal (ACCS) in order to process SCI actions.

XXX (4) All DD Forms 254 prepared for subcontracts involving access to SCI under this contract must be forwarded to the CM for approval and then to HQ INSCOM, ACofS Security, G-2, Contractor Support Element (CSE) for review and concurrence prior to award of the subcontract.

XXX (5) The contractor will submit the request for SCI visit certifications through the CM for approval of the visit. The certification request must arrive at the Contractor Support Element at least ten (10) working days prior to the visit. Visit certification requests will be processed through ACCS.

mailto:adelina.r.cartagena.civ@mail.mil mailto:matthew.w.barker10.civ@mail.mil

DD Form 254 Continuation Sheets (Date: 20180425) Page 21 of 21

Contract Number:

Prime Contractor:

XXX (6) The contractor will not reproduce any SCI related material without prior written permission of the

CM.

(7) Security Classification Guides or extracts are attached or will be provided under separate cover.

(8) Electronic processing of SCI requires accreditation of the equipment in accordance with ICD 503 and AR 25-2. (Note: Check only if item 11m indicates that a requirement exists for SCI AIS processing.)

(9) This contract requires a contractor SCIF.

XXX (10) This contract requires X (SI) X (TK) X (G) X (HCS) (Add others as required)

XXX (11) The contractor will perform SCI work under this contract at the following locations:

Greely Hall, Bldg. 61801, 2133 Cushing Street, Ft. Huachuca, AZ 85613; Other CONUS locations as dictated by mission…