W91YTZ-22-R-0069 Solicitation DD254.pdf

CUICLASSIFICATION (When filled in):

PREVIOUS EDITION IS OBSOLETE. Page 1 of 10DD FORM 254, MAY 2019 PREVIOUS EDITION IS OBSOLETE. Page 1 of 10DD FORM 254, MAY 2019

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

20220531

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

Top Secret

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED (See Instructions)

None (See instructions)

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

W91YTZ-22-R-0069

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.) 20220812

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

TO BE DETERMINED

a. NAME, ADDRESS, AND ZIP CODE

TBD

b. CAGE CODE

DCSA TBD

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor) Add Row Remove last Row Delete All Rows

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.) Add Row Remove last Row Delete All Rows

SEE ITEM #13

a. LOCATION(S) (For actual performance, see instructions.)

00000

b. CAGE CODE (If applicable, see Instructions.) 1CIG(A)

7701 TELEGRAPH ROAD

ALEXANDRIA VA 22315

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

PROVIDE PHYSICIAN ASSISTANT, SURGE PHYSICIAN ASSISTANT, REGISTERED NURSE, AND EMT PARAMEDIC TRAINIERS. PERIOD OF PERFORMANCE IS 27 SEPT 2022 - 26 SEPT 2023 (PLUS 4 OPTION YEARS)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

PREVIOUS EDITION IS OBSOLETE. Page 2 of 10DD FORM 254, MAY 2019 PREVIOUS EDITION IS OBSOLETE. Page 2 of 10DD FORM 254, MAY 2019

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.) h. FOREIGN GOVERMENT INFORMATION

d. FORMERLY RESTRICTED DATA i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

NISPOM para 4-102; see security guidance

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

SEE 11M REMARKS FOR IA REQUIREMENTES.

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

Public release of any aspect of this contract is prohibited.

Public Release Authority:

13. SECURITY GUIDANCE Add Signature Remove last Signature Delete All Signatures

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

Contract performance will be within MDW (Military District of Washington), Fort AP Hill, and Old Fields West Virginia.

Section 13 Security Guidance (Cont)

(Ref Item 5) Upon Contract Completion:

� All Unclassified, CUI, and Classified Government Materials/Information received, collected, and/or generated in performance of this contract are government property and should be returned to the GOV.

� The contractor shall return all such materials and information to the User Organization COR (COTR/POC) from which it was received;

unless retention or other disposition instructions have been approved in writing by the User Organization COR and Acquisition and Contracting Office awarding this Contract.

� The contractor shall out-process with User Organization Security Office (S-2/G-2) upon departure.

� The contractor shall account for and return all access/identification badges and entry passes/decals issued to them by the GOV at each contract performance location(s) identified in Items 8 and 13.

PREVIOUS EDITION IS OBSOLETE. Page 3 of 10DD FORM 254, MAY 2019 PREVIOUS EDITION IS OBSOLETE. Page 3 of 10DD FORM 254, MAY 2019

(Ref Item 7) The Prime Contractor is responsible to prepare the DD Form 254 for subcontracting. The Prime Contractor is responsible to ensure all security requirements identified in the government provided DD Form 254 (for the prime contract) are reflected in the contractor prepared DD Form 254 for subcontracting and ensure that the ISS and COR receives a signed copy. For contracts requiring access to special access programs, CNWDI, RD, FRD, SCI and COMSEC, the COR must sign block 13 of the subcontract.

(Ref Item 8.a.) Contract performance will be within MDW (Military District of Washington), Fort AP Hill, and Old Fields West Virginia.

Any other CONUS/OCONUS locations as required for contract performance under this contract shall be as directed in writing by the Contracting/User Organization COR:

Contractors shall NOT represent themselves as a government (GG, GS, etc) employee (of HQ USASOC, HQ USSOCOM, the Department of the Army, or of any other government agency).

� UA/RA Security POCs shall utilize DISS to verify the contractor's "access" and correct category in relation to their visit.

� The Contractor Company FSO/Contract POC must notify the UA/RA Security Office of Personnel Terminations and/or transfers to additional contracts/task orders/delivery orders.

(Ref Item 10.a.) Access to COMSEC information requires a final US government clearance at the appropriate level. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires prior approval of the GCA. Non-accountable COMSEC information, though not tracked in the COMSEC material control system, may still require a level of control within a document control system. Refer to NSA/CSS Manual 3-16, "Control of Communications Security Material", and the Committee on National Security Systems Instruction (CNSSI) 4001, "Controlled Cryptographic Items, for guidance. If access to COMSEC information is required at government facilities, contractor personnel will follow the security requirements of the host government activity.

(Ref Item 10.e(1)) The contractor will require access to Sensitive Compartmented Information (SCI) materials; SCI security requirements apply. See SCI Addendum. Access to INTELLIGENCE INFORMATION requires a current final (not interim) eligibility at the appropriate level. Due to the sensitive nature of the end user and its mission, the contractor FSO is responsible to report all Foreign Travel and / or Contract with Foreign Nationals to the User Organization Special Security Officer within 72 hours. Company Facility Security Officers will be required to acquire an ACCS account for all Army SCI contracts. Guidance may be requested from the SCI Contract Monitor Lisbeth Chaffin at (703) 664-5000 x2403.

(Ref Item 10.e(2)) The contractor is permitted access to INTELLIGENCE INFORMATION in the performance of this contract. Access to INTELLIGENCE INFORMATION requires a current final (not interim) eligibility at the appropriate level.

(Ref Item 10.f.) A SPECIAL ACCESS PROGRAM (SAP) is a program approved by the Secretary of Defense (i.e. Army). The term "SAP" will not be used unless the program is registered and approved by OSD or the Dept. of the Army as an official SAP. See SAP Addendum.

� Access to SAP information requires a current final (not interim) eligibility at the appropriate level. A current investigation refers to an investigation in the last five (5) years IAW Enclosure 4 DODI 5202.11 Management, Administration and Oversight of DOD Special Access Programs (SAPS).

� SAP REFERENCE DOCUMENTS:

� DOD Instruction 5205.11 Management, Administration and Oversight of DOD SAPs 6 Feb 2013 � DOD SAP Program Manager’s Handbook to the Joint SAP Implementation Guide (JSIG) and the Risk Management Framework (RMF) 11 Aug 2015 � DOD Manual 5205.07 Vol 1 DOD SAP Security Manual: General Procedures, 18 Jun 2015 � DOD Manual 5205.07 Vol 2 DOD SAP Security Manual: Personnel Security, 24 Nov 2015 � DOD Manual 5205.07 Vol 3 DOD SAP Security Manual: Physical Security, 21 Sep 2015 � DOD Manual 5205.07 Vol 4 DOD SAP Security Manual: Marking, 10 Oct 2013 NOTE: DOD Manual 5205.07 Vol’s 1-4 available on www.dcsa.mil/isp/specialprograms.html; Templates for SAP programs are located at www.dcsa.mil/isp/templates.html.

Contractors will be subject to a random polygraph program in accordance with Commander’s policy. The contractor security officer will be responsible to report any/all security matters and concerns, to include adverse information, security incidents/infraction/violations, etc.

involving SAP to their local security officer, 1CIG Industrial Security Office. 1CIG Industrial Security section will notify the SAP PSO or alternate PSO.

(Ref Item 10.i.) Alternative Compensatory Control Measures (ACCM) Program Information is governed by DODM 5200.01-V3, DOD Information Security Program: Protection of Classified Information, Encl 2, Section 18; CJCS Manual 3213.02D, Joint Staff Alternative Compensatory Control Measures Program Management Manual and supporting documentation for each ACCS sub-system, including security classification guides, program security plans, and governing directives. Inspections of ACCM information is SOCOM, component or owned and operated facilities under the auspices of the respective Command or Component ACCM Coordinator/ACCM Program Control Officer (ACCM Coord/ACCM PCO). If applicable, ACCM material maintained by the contractor within their facility must be afforded protection commensurate with DOD requirements and strictly controlled based on need to know and required briefings. DCSA personnel conducting inspections of the contractor must be briefed on to the specific program by the appropriate government ACCM

PREVIOUS EDITION IS OBSOLETE. Page 4 of 10DD FORM 254, MAY 2019

Coord/ACCM PCO responsible for the material prior to being granted access.

(Ref Item 10.j) Controlled Unclassified Information (CUI) provided under this contract shall be safeguarded as specified in the CUI Addendum included with this specification. Refer to DODM 5200.01 Volume 4, DOD Information Security Program: Controlled Unclassified Information when considering protection for CUI.

On September 21, 2001, the US DOD designated the US Special Operations Command (SOCOM) a sensitive unit, as defined by Title 10 United States Code (USC) Section 552 (10 USC 552). In keeping with this designation, any unclassified information related to USSOCOM or any of its component commands, will be designated and identified at a minimum, as CONTROLLED UNCLASSIED INFORMATION.

As such, any release of information which associates USSOCOM, Special Operation Forces (SOF), or any component command with an official activity or program is expressly prohibited unless specifically authorized by SOCOM or an officially designated representative.

10K. IAW NISPOM para 4-102, the FSO shall ensure that all employees authorized to perform derivative classification markings are sufficiently trained every 2 years. The FSO will retain records of the date of the most recent training (initial or refresher) and the type of training received. Annual Security Refresher Training is also required IAW the NISPOM. Training can be taken at the GOV customer location or via the CDSE website. See http://cdse.edu/documents/cdse/DerivativeClassification.pdf for more information.

(Ref Item 11.a) Cleared contractor personnel are required by DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), to provide supplemental controls. Releasing DoD (Government) activity shall furnish complete classification guidance on this contract if required. Classified Materials shall be marked, handled, stored and protected IAW AR 380-5 and the appropriate classification guide(s). If any classified information is generated in the performance of this contract at the identified location(s), the contractor shall apply derivative classification and markings consistent with the source material.

Any classification questions beyond the scope of the classification guide, or that cannot be derivatively classified shall be directed to the User Organization COR. Contractor personnel shall use the following guidelines for any couriering of collateral classified information and/ or materials. Contractors are not authorized to courier collateral classified information and/or materials without the prior coordination of the User Organization COR/COTR. The contractor shall operate under HQ USASOC operational security procedures and policies; and AR 380-5, DoD 5220.22-R, and DoD 5220.22-M, for controlling / monitoring the transportation / transmission of collateral classified information and/or materials associated with this contract. Courier(s) must be briefed by the Company Facility Security Officer (FSO) on their responsibilities in couriering and protecting classified materials entrusted in their care. The FSO must provide the Contractor with a courier card if couriering is required. Courier cards provided by the FSOs should not be valid more than two years from date of issue.

(Ref 11.a) Have access only at another contractor's facility or at a government activity.

(Ref Item 11.j.) Operations Security (OPSEC) awareness and execution is crucial to Army success. OPSEC is applicable to all personnel and all Army missions and supporting activities on a daily basis. OPSEC training programs shall be action and job-oriented and to be included as a part of their organization’s annual training and all personnel shall know how to apply and practice OPSEC in the performance of their daily tasks. The User Organization COR (COTR/POC) shall ensure the contractor(s) under this contract:

� Comply with DODI 3020.41, Contractor Personnel Authorized to Accompany the U.S. Armed Forces, and DFARS Clause 252.225-7040, Contractor Personnel Authorized to Accompany U.S. Armed Forces Deployed Outside of the United States, if the Contractor is required to travel outside of the United States.

� Complete the AKO Level I OPSEC web-based training course at: http://www.iad.gov/ioss. Provide a certificate of completion within the first 30 days of employment to the COR. Annual refresher training is required.

Antiterrorism (AT) Awareness Training shall be accomplished IAW AR 525-13, Antiterrorism:

� All DoD-employed contractors shall be offered annual AT Awareness Training “under terms and conditions as specified in the contract” (DoDI 2000.16) and IAW AR 525-13.

� The Antiterrorism Level 1 Training System may be accessed at: https://jkodirect.jten.mil/Atlas2/faces/page/login/Login.seam.

� Updated Area Of Responsibility (AOR) Training shall be offered prior to traveling outside the 50 United States (OCONUS), its territories and possessions (to include temporary duty and/or deployment). An unclassified AOR Travel Brief may be obtained from the U.S. Department of State website: http://travel.state.gov/. Contractor companies shall comply with DFARS 252.225-7043, Antiterrorism/ Force Protection for Defense Contractors Outside the United States.

� The User Organization COR shall provide information for the contractor’s training and maintain a memorandum for record documenting the contractor’s training using the “Course Completion Certificate.”

Threat Awareness and Reporting Program (TARP) Training - Contractor personnel shall comply with all TARP (formerly Subversion and Espionage Directed Against the U.S. Army (SAEDA)) reporting requirements in accordance with AR 381-12, and as directed by the Government requiring activity. Contractor personnel shall report threat-related incidents, behavioral indicators, and other matters of Counterintelligence (CI) interest as specified in Chapter 3, AR 381-12, to the nearest military CI office, the Facility Security Officer, the

PREVIOUS EDITION IS OBSOLETE. Page 5 of 10DD FORM 254, MAY 2019

Federal Bureau of Investigation, and DCSA

(Ref 11l) Receive, Store or Generate CONTROLLED UNCLASSIFIED INFORMATION. CUI provided under this contract shall be safeguarded as specified in the CUI Addendum.

(Ref 11m) OTHER. NIPRNET/SIPRNET/JIANT/JWICS/SAPNET/NSANET access required at government facilities only. IT-III normal user accounts only.

DoDD 8570.01, DoD 8570.01-M, and AR 25-2 establishes Information Assurance (IA) policy, roles, and responsibilities. All contractor personnel with IA/IT functions must comply with DoD and Army training requirements within six months of employment IAW DFAR 252.239.7001.

o Information Assurance (IA): The protection of systems and information in storage, processing, or transit from unauthorized access or modification; denial of service to unauthorized users; or the provision of service to authorized users. It also includes those measures necessary to detect, document, and counter such threats. This regulation designates IA as the security discipline that encompasses COMSEC, INFOSEC, and control of compromising emanations (TEMPEST).

o Information Technology (IT): The hardware, firmware, and software used as a part of an information system to perform DOD information functions. This definition includes computers, telecommunications, automated information systems, and automatic data processing equipment. IT includes any assembly of hardware, software, or firmware configured to collect, create, communicate, compute, disseminate, process, store, or control data.

Use of Government Owned Computers:

� The contractor shall be provided with government owned computers at government facility(s) for processing UNCLASSIFIED/ Controlled Unclassified Information (CUI)/ For Official Use Only (FOUO)/ CLASSIFIED information provided, collected, generated and/ or developed during the contract’s period of performance. The purpose of the government owned computer is to conduct business as required by this contract. Any other use of the government owned computer by the contractor is prohibited.

� The contractor is not authorized to process any government owned information on any personally owned computers. This is to include any government information provided, collected, generated and/or developed during the contract’s period of performance.

� Contractors requiring access to restricted areas, sensitive information or government equipment and/or unclassified networks (i.e., Enterprise NIPRNet) shall be limited to those contractor individuals who meet the requirements of AR 25-2 and AR 380-67.

� The contractor is only authorized to access the appropriate government network as identified in the DD Form 254.

Secret Internet Protocol Network (SIPRNET) access may be required. Access to SIPRNet may require a NATO Awareness Briefing. The contractor shall not access, download, or further disseminate any special access data (i.e. Intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the COR. Contractor access to SIPRNET via government accounts is restricted to only sites directly related to meeting the requirements of this contract as validated by the COR and authorized IAW the Contract DD254 and/or the Statement of Work (SOW).

The following Information Technology (IT) position(s) as defined in AR 25-2:

� IT-III Positions. IT -III Positions are defined as IA positions (for example, power users or a SA on individual systems for configuration or management) with limited privileged-level access to that Information System(s) (IS(s)) or device(s). This is a position of higher trust.

• Investigative Levels:

(1) A favorable review of local personnel, base and military, medical, and other security records, as appropriate.

(2) Initiation of a National Agency Check (NAC) (for contractors), as appropriate and favorable review of SF85P and Supplemental Questionnaire.

� IT-II Positions. IT -II Positions are defined as personnel in IA positions (for example, operating system administration of common network applications or enclaves, back-up operators) with limited privileged-level access to control, manage, or configure ISs and devices, with very limited (single device) or no IA device access or management.

• Investigative Levels:

(1) A favorable review of local personnel, base/military, medical, and other security records as appropriate.

(2) Initiation of a National Agency Check with Local Agency and Credit Checks (NACLC) (for contractors), as appropriate or favorable review of SF85P and Supplemental Questionnaire.

� IT-I Positions. IT-I Positions are defined as personnel in IA positions (for example, SAs/NAs for infrastructure devices, IDSs, VPNs, routers; SAs/NAs for classified systems and devices) with privileged-level access to control, manage, or configure IA tools or devices, individual and networked IS and devices, and enclaves.

• Investigative Levels:

(1) Favorable completion of a National Agency Check (NAC) (current within 180 days).

(2) Initiation of a Single Scope Background Investigation (SSBI) and favorable review of SF85P, SF86, and Supplemental Questionnaire.

� Personnel Security Controls:

(1) Individuals assigned to IT–I, IT–II, or IT–III Positions who lose their clearance, or have access to classified systems suspended pending the results of an investigation, shall be barred access to all ISs until favorable adjudication of that investigation.

(2) Contractor personnel assigned to any IT Positions who have their unclassified system or network accesses revoked or suspended for derogatory reasons shall be barred access to the ISs until favorable adjudication of that investigation.

PREVIOUS EDITION IS OBSOLETE. Page 6 of 10DD FORM 254, MAY 2019

(Ref item 11M): Visit request in support of contracts under 1CIG; IAWU) DODM 5200.01 V3: DoD Information Security Program:

Protection of Classified Information and (U) AR 380-49: Industrial Security Program. For all contractors that require access in the performance of a Government contract as embedded, integrated or intermittent visitors, or cleared facility contractors.

• (U) Any and All contractors in support of a contract for the United States Army 1st Capabilities Integration Group (Airborne). must submit via DISS a Visit Request (VR) for all employees working on the contract. Visit notifications are valid based on: duration of the contract to include Task Orders (TO) and or Delivery Order (DO) and subcontract period of performance, not to exceed one year (option years are not exercised until authorized); duration of work the contractor employee is required to work/visit/meet with the government requiring activity in support of the performance of the contractual authorized work effort.

• (U) Certain companies based on affiliation and/or SCI ownership will send a PERMCERT to the SMO code given based on contractual agreement and will be informed of such.

• (U) Information that must be on the DISS Visit Request: Reason for Visit: OTHER

• (U/FOUO) *Visit Access:

• (U/FOUO) *POC: ISD; (Contract # to include TO/DO / sub as applicable)

• (U/FOUO) *POC Phone: 703.664.5000 X2403

• (U/FOUO) *First Day of Visit:

• (U/FOUO) *Last Day of Visit:

• (U) Note: Date of Visits are based on the Period of Performance not to exceed 1 year

• (U/FOUO) *Visited SMO: W45KAA-3

(Ref Item 12) No public release of information is authorized on SAP/SCI contracts.

(Ref Item 13) User Organizations COR Responsibilities: The User Organization COR is responsible/shall ensure contractor employees are briefed (as required) on Local / Applicable Directives, Regulations, Policies and Procedures concerning classified contract performance, materials, information, and “need-to-know” for contract performance under this contract.

(Ref Item 14) ACCM information is governed by DODM 5200.01-V3; all personnel who require access to ACCM materials will be required to be briefed and/or verified by the organization ACCM PCO prior to being granted access to ACCM.

(Ref Item 15) The HQ USASOC DCS-G2 Industrial Security Office shall be responsible to provide Cognizant Security Oversight (CSO) duties and responsibilities over all Industrial Security issues, matters, and concerns for collateral classified contracts awarded solely for USASOC units/organizations and for contract performance at USASOC locations/facilities.

For SCI & SAP contracts: DCSA is relieved of security inspection authority of all SCI and SAP portions of this contract. The applicable HQ USASOC CSC/CSU/SSO and SAPCO will maintain security oversight and inspection responsibility for all SCI and SAP information in performance of this contract.

(Ref Item 17) Required Distribution: In accordance with Army Regulation 380-49 and the Federal Acquisition Regulation (FAR) -- Part 4, Subpart 4.4 - Safeguarding Classified Information Within Industry, the Contracting Officer is responsible for the disbursement of the DD254 to the Contractor, User Agency, and other locations as identified in Item 8(a).

PROTECTING SPECIAL ACCESS PROGRAM (SAP) INFORMATION

SAP ADDENDUM

Special Access Program (SAP) discussion, storage, and processing associated with this effort will be conducted in SAP Facilities (SAPF) specifically approved in writing by the USSOCOM SAPCO or designated USSOCOM Program Security Officer (PSO). Contact the individual in Block 16 for approved SAPF locations.

SAP activities are governed by:

A. DOD 5220.22-M National Industrial Security Program Operating Manual (NISPOM) Appendix D, NISPOM Supplement;

B. DOD 5220.22 Volume 2, National Industrial Security Program: Industrial Security Procedures for Government Activities C. DOD Manual 5200.01 (DOD Information Security Program) Volumes 1-4, D. DOD Manual 5205.07 (DOD Special Access Program Security Manual) Vol 1 DOD Special Access Program (SAP) Security Manual: General Procedures Vol 2 Special Access Program (SAP) Security Manual: Personnel Security Vol 3 DOD Special Access Program (SAP) Security Manual: Physical Security Vol 4 Special Access Program (SAP) Security Manual: Marking E. DODI 5205.11 Management, Administration, and Oversight of DOD Special Access Programs (SAPS) F. DOD Joint SAP Implementation Guide (JSIG));

G. USSOCOM Manual 380-2 (SAP Security Guide);

H. USSOCOM Manual 380-7 (USSOCOM Arms Control Readiness Inspection Program) and applicable program security classification guides and subsequent versions. Applicable documents will be provided to the contractor by the PSO under separate cover.

PREVIOUS EDITION IS OBSOLETE. Page 7 of 10DD FORM 254, MAY 2019

Access to SAP information requires employees to undergo additional personnel security screening and meet the requirements of DoD SAP accessing directives and policies in accordance with DODM 5205.07, Volume 2. The individual must meet applicable eligibility requirements and possess a final Secret or Top Secret security clearance depending on the level of access required in performance of this contract.

Program Access Requests (PAR) for contractor personnel must be submitted by the Contractor's Program Security Officer (CPSO) to the PSO for approval by the designated Access Approval Authority (AAA). Personnel approved for access will receive a program indoctrination briefing and must sign a SAP Indoctrination Agreement (PIA) prior to receiving access to program information or material.

SAP inspections and security oversight while in USSOCOM or Component government facilities are under the cognizance of the USSOCOM PSO or SAPCO representative, as appropriate. Additional Component SAP security requirements may apply for activities conducted at Service Component or Sub¬ unified command locations. The Performance Monitor or component command COR at these locations/facilities will provide specific or additional guidance. SAP reviews conducted at contractor facilities are under the security oversight of the DCSA unless officially relieved of oversight responsibilities.

OPSEC-sensitive or classified communication will be conducted via PSO-approved secure channels from within the SAPF. Transmission of documents via secure facsimile between terminals within SAPFs may be approved by the PSO. Only methods outlined in DODM

5205.07 V1, Encl. 5 will be used to mail program material unless an alternate method is approved by the PSO. Briefed personnel are authorized to courier classified information within the continental United States with written approval from the CPSO or PSO. Two (program briefed) personnel are required to courier Top Secret material unless prior approval is obtained from the PSO. Couriers will be in the possession of PSO-issued courier authorization letters prior to travel. All material, to be mailed or carried, will be wrapped and transmitted in accordance with DODM 5205.07, Volume 1.

Prior to processing SAP information on any Automated Information System (AIS), the contractor will provide the PSO with a System Security Plan {SSP) and other documentation required in JSIG for Assessment & Authorization (A&A) from the Authorizing Official (AO), or subsequent policy. The PSO will issue program specific Security Authorization following verification of the A&A process.

USSOCOM Special Access Program (SAP) Policy Memorandum: Removable Media and Two-Person Integrity Control Policy is applicable for this contract.

Destruction of program material will be conducted only by program indoctrinated personnel using destruction equipment and procedures approved by the PSO. A single person may destroy non¬-accountable classified material. Accountable material must be destroyed, and documented, by two program cleared individuals.

The PSO will be advised of any reports which affect the baseline facility clearance or any incident that has an adverse impact on a personnel security clearance. All briefed personnel are required to report any information that could have an impact on their ability to protect classified information. Reportable items include: foreign travel, contacts, or associations; criminal, civil, financial, or mental health issues; and changes in personal status such as marriage, divorce, or employment. CPSOs are reminded of their responsibilities to diligently report any significant action or any change in an employee's eligibility to the PSO immediately.

Per DOD Manual 5205.07 Volume 1, Encl. 11, Sec 3. : "Any (contractual) relationship with a prospective subcontractor requires prior approval by the PSO." All security requirements levied upon the prime contractor will "flow down" to the subcontractor. SAP access and other requirements must be pre¬ coordinated and approved by the PSO prior to implementation.

IAW DODM 5200.01, Vol 3, Encl. 6, any security incident involving the potential loss, compromise, or suspected compromise of classified information must be reported to the PSO immediately using appropriate secure channels. Security infractions will be documented in the individuals personal security file and made available for review during PSO visits.

PROTECTING "CONTROLLED UNCLASSIFIED INFORMATION" (CUI)

23 June 2020

1. GENERAL

a. Controlled Unclassified Information (CUI) is not a security classification, but designates unclassified information that requires any safeguarding or dissemination control per DOD Instruction 5200.48, "Controlled Unclassified Information (dtd 6 March 2020).

b. With the implementation of DODI 5200.48, DODI 5200.01 Vol 4, DOD Information Security Program: Controlled Unclassified Information" (24 Feb 2012, as amended) has been cancelled and "For Official Use Only" (FOUO) and is no longer authorized. All new documents shall be marked in accordance with below guidance:

c. In order to balance the need to safeguard CUI with the public interest the CUI Registry, established by DODI 5200.48 lists categories of CUI Basic/Specified and identifies basis for controls, and includes guidance on handling procedures.

d. There are two subsets of CUI.

1) CUI Basic is the subset of CUI for which law, regulation, or government policy does not set out specific handling or dissemination controls. CUI Basic Handling and dissemination controls are the same as previously used for FOUO.

2) CUI Specified is the subset of CUI for which law, regulation, or government policy contains specific handling guidance separately for CUI Specified.

e. Remarking legacy FOUO documents is not required as long as they remain under DOD control. When needed, FOUO information does not automatically become CUI, so the material must be reviewed by the information owner to determine if it meets the CUI requirements and marked appropriately.

f. When responding to FOIA requests, the responsible DOD agency must base its decision on the content of the information and applicability of any of the FOIA statutory exemptions regardless of whether an agency designates or marks the information as CUI.

PREVIOUS EDITION IS OBSOLETE. Page 8 of 10DD FORM 254, MAY 2019

2. DESIGNATION as CUI: Designating CUI occurs when an authorized holder, consistent with DODI 5200.48 and the CUI Registry, determines that a specific item of information falls into a CUI category or subcategory. The information must be designated as either CUI Basic or CUI Specified and the authorized holder must ensure that appropriate markings are applied to documents to ensure recipients are aware of the CUI status. See the guidance provided by government contracting agency (GCA) for specific categories of CUI related to this contract and guidance on storage, handling and dissemination.

3. MARKING

a. Unclassified documents containing CUI will be marked CUI at the top and bottom of each page. Each "portion" (i.e., titles, subject lines, paragraphs, bullets, charts, graphs, etc.) containing CUI will be portion marked CUI. Unclassified portions will be portion marked (U). Do not use CUI.

b. The government will provide marking, handling, and dissemination guidance separately for any CUI Specified Information. For classified contracts, this guidance will be contained in the associated SCG.

c. The following CUI Designation Indicator information will be included on the first/title page or cover of all unclassified documents containing CUI:

Controlled By: {Name of DOD Component/Office} CUI Category: {List of Category or Categories of CUI} Distribution/Dissemination Control: {Use None for CUI Basic/As required for CUI Specified} POC: {Phone number and/or email address}

d. Classified documents containing CUI will NOT include CUI in the banner marking at the top and bottom of each page. Each paragraph that contains only CUI will be portion marked CUI. All other paragraphs will be marked according to their classification. Do not "co-mingle" CUI with classified information. The above CUI Designation Indicator information must be included on the first page of documents that contain both CUI and classified information:

"This content is classified at the {insert highest classification level of the document} and may contain elements of Controlled Unclassified Information (CUI), unclassified, or information classified at a lower level than the overall classification displayed. This content shall not be used as a source of derivative classification; refer to {cite specific reference or applicable Security Classification Guide}. It must be reviewed for both Classified National Security Information (CNSI) and CUI in accordance with DODI 5230.09 prior to public release."

4. PROCESSING: Unclassified Automated Information Systems (AIS) used to process CUI under this contract must meet the basic security requirements listed in NIST SP 800-171 REV 2, "Protecting Controlled Unclassified Information in Non-Federal Systems and Organizations," 21 FEB 2020. AIS accredited and approved for processing classified information under this contract are also approved to process DOD CUI.

5. DISSEMINATION: CUI may be disseminated between officials of DOD agencies, DOD contractors, consultants, and grantees to conduct official business for the DOD provided the dissemination is consistent with controls imposed by a Distribution Statement or Limited Dissemination Controls (LDC). Guidance on Distribution Statements and LDCs will be provided separately by the government for any prescribed CUI Specified Information. For classified contracts, this information will be contained in the program SCG. CUI always requires Foreign Disclosure Decision before release outside of DOD agencies, contractors, consultants and grantees.

6. STORAGE: During working hours, to prevent unauthorized access, do not leave CUI unattended, read or discuss around unauthorized personnel. CUI shall be placed in an out of sight location if the work area is accessible to persons who do not have a need to know for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks is adequate when internal building security is provided during non-working hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

7. TRANSMISSION: CUI may be transmitted using the following:

a. Mail. CUI may be sent via first class mail or parcel post. Bulk shipments may be sent fourth class mail. Contents must be properly marked, but no markings will appear on the outer wrapper.

b. Fax. Normally CUI may be sent via fax. To prevent unauthorized disclosure, coversheets should be used, the locations of both fax machines should be considered, and availability of an authorized recipient at the receiving end should be confirmed. Security classified fax may be used without any of the above verifications.

c. Email/Web sites. Email may be used on approved secure communications or systems using other protective measures such as Public Key Infrastructure (PKI) or transport layer security (i.e., https). Email messages must be appropriately marked to identify CUI status.

Personnel will not use unofficial or personal email accounts, messaging systems, or other non-DOD information systems, except approved government contractor systems to conduct official business involving CUI.

d. Video Teleconferencing. Only use government agency approved secure, encrypted video conferencing and collaborative platforms (SVTC). CUI may not be discussed over commercially available video conferencing applications.

e. Avoid wireless transmission unless no other means are available.

8. DESTRUCTION. When no longer needed, CUI must be disposed of in a way that will make it unreadable, indecipherable and irrecoverable. Use of approved sensitive/classified material destruction devices is recommended (ISOO CUI Notice 2019-03,. "Destroying Controlled Unclassified Information in Paper Form", 15 July 2019.

9. UNAUTHORIZED DISCLOSURE. Report misuse, mishandling or Unauthorized Disclosure of CUI to the Unauthorized Disclosure Program Management Office, the controlling agency and the appropriate military department counterintelligence organization. While unauthorized disclosure of CUI does not constitute a security violation, a formal security inquiry/investigation is required is disciplinary action will be taken against the individual(s) responsible. Unauthorized disclosure of certain CUI, such as export controlled technical data, PREVIOUS EDITION IS OBSOLETE. Page 9 of 10DD FORM 254, MAY 2019 may result in civil and criminal sanctions against responsible persons based on procedures codified in relevant law, regulation, or government wide policy.

US ARMY SCI ADDENDUM TO DD FORM 254 (7 APR 09)

Contract Number (from item 2.a.): W91YTZ-22-R-0069 General Identification (item 9.): Provide support IAW PWS

XXX (1) This contract requires access to Sensitive Compartmented Information (SCI). The Commander, USASOC, acting on behalf of the DA Deputy Chief of Staff (DCS), G-2 as the Cognizant Security Authority (CSA) for the US Army, has exclusive security responsibility for all SCI released to the contractor or developed under the contract and held within the Contractor's SCI Facility (SCIF) or Co-utilization Agreement (CUA) SCIF. The Defense Intelligence Agency (DIA) has security inspection responsibility for SCI and the Defense Security Service (DSS) retains responsibility for all collateral information released or developed under the contract and held within the DoD Contractor's SCIF. The manuals, regulations, and directives checked below provide the necessary guidance for physical, personnel, and information security for safeguarding SCI, and are part of the security classification specification for this contract:

XXX DoD 5105.21-M-1, SCI Security Manual, Administrative Security XXX Signals Intelligence Security Regulations (SISR) (Available from the SCI-CM) XXX Imagery Policy Series (Available from the SCI-CM) XXX ICD 503, Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation ICD/ICS 705-1, Physical and Technical Security Standards for Sensitive Compartmented Information Facilities XXX AR 25-2, Information Assurance XXX AR 380-28, DA Special Security System ____ AR 380-381, Special Access Programs (SAP).

XXX Army Handbook for SCI Contracts.

XXX (2) Contract estimated completion date 26 SEPT 2023 (plus 4 option years) XXX (3) The name, telephone number, email address and mailing address of the Contract Monitor (CM) for the SCI portion of this contract is: COR/CM LTC Robert Schmand; Alt CM Lisbeth Chaffin (703) 664-5000 x2403 XXX (4) All DD Forms 254 prepared for subcontracts involving access to SCI under this contract must be forwarded to the CM for approval.

XXX (5) The contractor will submit the request for SCI visit certifications through the SCI-CM for approval of the visit.

XXX (6) The contractor will not reproduce any SCI related material without prior written permission of the SCI-CM.

(7) Security Classification Guides or extracts are attached or will be provided under separate cover.

_____ (8) Electronic processing of SCI requires accreditation of the equipment in accordance with ICD 503 and AR 25-2 (Note: Check only if item 11l indicates that a requirement exists for SCI IA processing.)

(9) This contract requires a contractor SCIF.

XXX (10) This contract requires X (SI) X (TK) X (G) X (HCS) (Add others as required)

List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

Add Attachment View Selected Attachment Remove Selected Attachment

JAMIE S. TURNER

703-664-5000 X2420 jamie.s.turner.mil@army.mil CW4 JAMIE S. TURNER GSSO

NAME & TITLE OF REVIEWING OFFICIAL SIGNATURE

ROBERT SCHMAND

703-664-5177 robert.schmand.civ@army.mil ROBERT SCHMAND A/COR

NAME & TITLE OF REVIEWING OFFICIAL SIGNATURE

DENISE MALONEY

202-697-0434 denise.b.maloney.civ@mail.mil DENISE MALONEY COR

NAME & TITLE OF REVIEWING OFFICIAL SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

PREVIOUS EDITION IS OBSOLETE. Page 10 of 10DD FORM 254, MAY 2019

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

SEE SAP & SCI ADDENDUMS.

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

For SCI & SAP contracts: DCSA is relieved of security inspection authority of all SCI and SAP portions of this contract. The applicable HQ USASOC CSC/CSU/SSO and SAPCO will maintain security oversight and inspection responsibility for all SCI and SAP information in performance of this contract.

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

Regional Health Contracting Office - Atlanti

a. GCA NAME

W91YTZ

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

Regional Contracting Office - Atlantic

(RHCO-A)

6021 5th Street Fort Belvoir, VA 22060

c. ADDRESS (Include ZIP Code)

LTC Kathleen Hamilton

d. POC NAME

+1 (571) 515-8248

e. POC TELEPHONE (Include Area Code) kathleen.e.hamilton4.mil@mail.mil

f. EMAIL ADDRESS (See Instructions)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

CHAFFIN LISBETH J.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

CHIEF INDUSRIAL SECURITY

b. TITLE

1CIG(A)

7701 TELEGRAPH ROAD

ALEXANDRIA VA 22315

c. ADDRESS (Include ZIP Code)

W91YTZ

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

TBD

e. CAGE CODE OF THE…