Doc:DoD 5220.22-M Chapter 7

From FISMApedia
Jump to: navigation, search



Section 1. Prime Contractor Responsibilities

7-100 General
  This Chapter outlines the requirements and responsibilities of a prime contractor when disclosing classified information to a subcontractor.
7-101 Responsibilities
  Before a prime contractor may release or disclose classified information to a subcontractor, or cause classified information to be generated by a subcontractor, the following actions are required:
a. Determine the security requirements of the subcontract.
(1) Access to classified information will be required. This is a "classified contract" within the meaning of this Manual. A "security requirements clause" and a Contract Security Classification Specification shall be incorporated in the solicitation and in the subcontract (see the "security requirements clause" in the prime contract). The subcontractor must possess an appropriate FCL and safeguarding capability if possession of classified information will be required.
(a) If access will not be required in the pre-award phase, prospective subcontractors are not required to possess an FCL to receive or bid on the solicitation.
(b) If access will be required during the pre-award phase, all prospective subcontractors must possess the appropriate FCL and have safeguarding capability.
(2) Access to classified information will not be required. This is not a classified contract within the meaning of this Manual. If the prime contract contains requirements for release or disclosure of certain information even though not classified, such as sensitive but unclassified information, the requirements shall be incorporated in the solicitation and the subcontract.
b. Determine clearance status of prospective subcontractors.
(1) All prospective subcontractors have appropriate clearance. This determination can be made if there is an existing contractual relationship between the parties involving classified information of the same or higher category, by accessing the CSA-designated database, or by contacting the CSA.
(2) If a prospective subcontractor does not have the appropriate FCL or safeguarding capability, the prime contractor shall request the CSA of the subcontractor to initiate the necessary action. Requests shall include, as a minimum, the full name, address and contact information for the requester; the full name, address, and contact information for a contact at the facility to be processed for an FCL; the level of clearance and/or safeguarding capability required; and full justification for the request. Requests for safeguarding capability shall include a description, quantity, end-item, and classification of the information related to the proposed subcontract. Other factors necessary to help the CSA determine if the prospective subcontractor meets the requirements of this manual shall be identified, such as any special access requirements.
c. Requesting contractors shall allow sufficient lead time in connection with the award of a classified subcontract to enable an uncleared bidder to be processed for the necessary FCL. When the FCL cannot be granted in sufficient time to qualify the prospective subcontractor for participation in the current procurement action, the CSA will continue the FCL processing action to qualify the prospective subcontractor for future contract consideration provided:
(1) The delay in processing the FCL was not caused by a lack of cooperation on the part of the prospective subcontractor;
(2) Future classified negotiations may occur within 12 months; and
(3) There is reasonable likelihood the subcontractor may be awarded a classified subcontract.
7-102 Security Classification Guidance
  Prime contractors shall ensure that a Contract Security Classification Specification is incorporated in each classified subcontract. When preparing classification guidance for a subcontract, the prime contractor may extract pertinent information from the Contract Security Classification Specification issued with the prime contract; from security classification guides issued with the prime contract; or from any security guides that provide guidance for the classified information furnished to, or that will be generated by, the subcontractor. The Contract Security Classification Specification prepared by the prime contractor shall be certified by a designated official of the contractor. In the absence of exceptional circumstances, the classification specification shall not contain any classified information. If classified supplements are required as part of the Contract Security Classification Specification, they shall be identified and forwarded to the subcontractor by separate correspondence.
a. An original Contract Security Classification Specification shall be included with each RFQ, RFP, IFB, or other solicitation to ensure that the prospective subcontractor is aware of the security requirements of the subcontract and can plan accordingly. An original Contract Security Classification Specification shall also be included in the subcontract awarded to the successful bidder.
b. A revised Contract Security Classification Specification shall be issued as necessary during the lifetime of the subcontract when the security requirements change.
c. Requests for public release by a subcontractor shall be forwarded through the prime contractor to the GCA.
7-103 Responsibilities (Completion of the Subcontract)
  Upon completion of the subcontract, the subcontractor may retain classified material received or generated under the subcontract for a 2-year period, provided the prime contractor or GCA does not advise to the contrary. If retention is required beyond the 2-year period, the subcontractor must request written retention authority through the prime contractor to the GCA. If retention authority is approved by the GCA, the prime contractor will issue a final Contract Security Classification Specification, annotated to provide the retention period and final disposition instructions.
7-104 Notification of Unsatisfactory Conditions
  The prime contractor shall be notified if the CSA discovers unsatisfactory security conditions in a subcontractor's facility. When so notified, the prime contractor shall follow the instructions received relative to what action, if any, should be taken in order to safeguard classified material relating to the subcontract.