What we must/should be doing is as follows:

1) MUST specify all copyright info (including 3rd-party) in NOTICE.
2) SHOULD apply the Apcache 2.0 license header to all source files.
3) MUST NOT apply any source headers to 3rd-party files.
3) MUST have a full copy of the Apache 2.0 license in the root directory of the code base.

http://www.apache.org/dev/apply-license.html#new