02 FA880723R0005 Attachment 02 DD254.pdf

CLASSIFICATION (When filled in): Unclassified

FA8807-23-R-0005

PREVIOUS EDITION IS OBSOLETE. Page 1 of 7DD FORM 254, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED (See Instructions)

Top Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

Top Secret

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER

FA8807-23-R-0005

DUE DATE (YYYYMMDD)

20231231

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

20230214

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

TBD

b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO)

(Name, Address, ZIP Code, Telephone required; Email Address optional)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

a. NAME, ADDRESS, AND ZIP CODE

N/A

b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO)

(Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

a. LOCATION(S) (For actual performance, see instructions.)

TBD

b. CAGE CODE

(If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

MUOS Service Life Extension (SLE) Phase 1 C-Type Contract enables selected industry partners to provide targeted technical risk reduction deliverables to support, develop, and document initial design efforts. Risk reduction efforts include modeling and simulation, prototyping, detailed analysis of payload/satellite, and examination of unique UHF issues (e.g., PIM, high-power effects). Early design efforts include a System Requirements Review (SRR), System Functional Review (SFR), and a comprehensive Preliminary Design Review (PDR) that provides evidence of viable Contractor designs.

FA8807-23-R-0005

PREVIOUS EDITION IS OBSOLETE. Page 2 of 7DD FORM 254, APR 2018

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA

g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.)

h. FOREIGN GOVERMENT INFORMATION

d. FORMERLY RESTRICTED DATA

i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

Access to Government Automated Information Systems

(SIPRNET & JWICS)

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDI 5200.48, only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

See Block 13

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

SSC/CG: 483 N. Aviation Blvd, Los Angeles, AFB, El Segundo, CA, 90245, (310) 653-3275, smc.pc.ppoquad@us.af.mil

Public Release Authority:

SSC/PA, 483 North Aviation Blvd., El Segundo, CA 90245,

(310) 653-1204, SMC PA@us.af.mil

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

This DD254 is for solicitation purposes only. It must be returned to the SSC/CG Security Office, to update with a contract number, contractor’s name, address, CAGE code, and cognizant security office information when selected for the contract.

FAR 52.204-2 Security Requirements. Security Requirements Clause: (a)This clause applies to the extent that this contract involves access to information classified up to “Top Secret” (b)The Contractor shall comply with (1)The Security Agreement ( DD Form 441/DD Form 254), including 32 Code of Federal Regulation (CFR) Part 117, National Industrial Security Program Operating Manual (NISPOM); and (2)Any revisions to that manual, notice of which has been furnished to the Contractor. (c) If, subsequent to the date of this contract, the security classification or security requirements under this contract are changed by the Government and if the changes cause an increase or decrease in security costs or otherwise affect any other term or condition of this contract, the contract shall be subject to an equitable adjustment as if the changes were directed under the Changes clause of this contract. (d)The Contractor agrees to insert terms that conform substantially to the language of this clause, including this paragraph (d) but excluding any reference to the Changes clause of this contract, in all subcontracts under this contract that involve access to classified information.

FA8807-23-R-0005

PREVIOUS EDITION IS OBSOLETE. Page 3 of 7DD FORM 254, APR 2018

By signing this form, the requesting Government program office and the servicing Contractor (or Subcontractor) verify that the stated access requests on this form are based on legitimate and bona fide need(s)/requirement(s) of the Government.

Classified information and unclassified controlled information as prescribed in all applicable Security Classification Guides (SCGs) shall be protected as outlined in the DoD 5220.22-M; Change 2 and Defense Counterintelligence & Security Agency (DCSA) Assessment and Authorization Process Manual (DAAPM) Version 2.1. Classified national security information, and Controlled Unclassified Information (CUI) shall be protected as outlined in the SCG, NISPOM and/or DoDI 5200.48, Controlled Unclassified Information (CUI).

For any conflicts, challenges and/or questions regarding this guidance, contact:

SSC/CG Security at 483 N. Aviation Boulevard, El Segundo, CA 90245 or e-mail at SSC.CG.PPOquad@spaceforce.mil

Reference Block 10a: COMMUNICATIONS SECURITY (COMSEC) INFORMATION:

The contractor is authorized access to COMSEC material and information. If access is required, the contractor will protect COMSEC material DoD 5220.22-M as identified by the servicing COMSEC Custodian to include Air Force Manual 17-1302-0, Communications Security (COMSEC) Operations.

Access to COMSEC material by personnel is restricted to U.S. citizens holding a final U.S. Government clearance and is not releasable to personnel holding only a reciprocal clearance. All contractor employees who require access to classified COMSEC information in the performance of this contract shall be briefed IAW the NIPSOM, CNSSP No. 3, AFMAN 17-1302-0 and other locally required directives as needed.

For on-base contracts, Prime Contractors must forward requests for COMSEC material/information to Government COMSEC Custodian through the Contracting Officer. The Government Program Manager shall designate the number of the Prime Contractor personnel requiring cryptographic access. The number will be limited to the minimum necessary and will be on a strict need-to-know basis. The contractor shall maintain a record of all COMSEC briefings. National Communications Security Information Memorandum (NACSIM) National Communications Security/Emanations Security Information Memorandum (NACSEM) documents are not considered COMSEC controlled material.

Prior approval from the Contracting Officer is required in order for a Prime Contractor to grant COMSEC access to a subcontractor.

Additionally, the Prime Contractor shall notify the National Security Agency (NSA) Central Office of Record (COR) before negotiation or awarding subcontracts.

(For Visitor Groups) Contractor will require access to COMSEC information at the on-base locations listed in item 8a. On-base contractors will not require their own COMSEC account. Access will be controlled by SSC/Los Angeles Garrison or host installation. On-base contractors will protect COMSEC material IAW directives identified by the installation COMSEC Custodian to include Air Force Manual 17-1302-0. See SCI addendum latest Version.

Further disclosure, to include subcontracting, of COMSEC information by a contractor requires prior approval of the SSC/Los Angeles Garrison technical code. Access to any COMSEC information requires special briefings at the contractor facility. Access to classified COMSEC information requires a final U.S. government clearance at the appropriate level. Use of COMSEC information is governed by the NSA industrial COMSEC manual, NSA/CSS policy manual 3-16.

Reference Block 10e(1) - (U) National Intelligence Information: SCI.

No public release of information authorized, public disclosure or confirmation of any subject related to the support contract is not authorized without first obtaining written approval from the SSC/IN SSO Security Office. The SSC/IN SSO Security Office shall have security cognizance for SCI. All activities involving SCI (including discussions) will be conducted in sensitive compartmented information facilities (SCIFs). Physical security standards for SCIFs are contained in ICD 705, applicable IC specifications, or standards and implementing DoD Component policies. See SCI Addendum V5.

Reference 10e(2) - (U) Non-SCI: Contractor will require access to intelligence information and must comply with directions provided by the Contracting Officer (CO) or Contracting Officer’s Representative (COR). The Program Manager has determined that disclosure does not create an unfair competitive advantage for the contractor or a conflict of interest with the contractor’s obligation to protect the information. The CO or COR will identify what intelligence information is required for the contractor to satisfy the contract and will submit that information to the servicing Senior Intelligence Officer (SIO) for approval prior to granting access.

Reference Block 10g - (U) NATO Information: Personnel requiring access to NATO classified information, NATO COSMIC, NATO Secret or access to the NATO accredited terminals, must possess the equivalent FINAL or Interim U.S. Security Clearance based upon the appropriate personnel security investigation required. Personnel with access to NATO ATOMAL information must have the appropriate level FINAL U.S. Security Clearance. The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees are NATO briefed prior to access being granted. The contractor will maintain strict

FA8807-23-R-0005

PREVIOUS EDITION IS OBSOLETE. Page 4 of 7DD FORM 254, APR 2018 compliance in regards to NATO information IAW 32 Code of Federal Regulation (CFR) Part 117, National Industrial Security Program Operating Manual (NISPOM). Prior written approval from the GCA is required for subcontracting.

The contractor shall not access, download, or further disseminate any special access data (i.e. intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the GCA. In the event that any special access is required, the GCA must modify the requirements for the DD Form 254.

Reference Block 10j - Controlled Unclassified Information (CUI): Controlled Unclassified Information (CUI) is the term which collectively refers to For Official Use Only (FOUO), Unclassified Controlled Technical Information (UCTI), Unclassified Controlled Nuclear Information (UCNI) and many other designations. CUI information generated and/or provided under this contract shall be managed and safeguarded IAW DoDI 5200.48, Controlled Unclassified Information, which supersedes DoDM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI). Air Force Guidance Memorandum (AFGM) 2021-16-01 which supplies immediate guidelines aligned with Department of the Air Force (DAF) leadership’s intent to implement DoDI 5200.48 CUI policy, answers any and all security gaps omitted under established policy.

AFGM2021-16-01 supersedes sections of Air Force Instruction (AFI) 16-1404, Air Force Information Security Program, where the designation For Official Use Only (FOUO) is referenced. See Block 11l for Information Systems protection guidance.

DoDI 5200.48, Controlled Unclassified Information (CUI), supersede DoDM 5200.01, Volume 4, DoD Information Security Program:

Controlled Unclassified Information, leaving a gap in Department of the Air Force (DAF) implementation guidance that must be addressed by way of an Air Force Guidance Memorandum. Air Force Guidance Memorandum (AFGM) 2021-16-01 supplies immediate guidelines aligned with DAF leadership’s intent to implement CUI policy established in DoDI 5200.48. AFGM2021-16-01 supersedes sections of Air Force Instruction (AFI) 16-1404, Air Force Information Security Program, where the designation For Official Use Only (FOUO) is referenced.

All CUI must be controlled until authorized for public release in accordance with DoDIs 5230.09, Clearance of DoD Information for Public Release, 5230.29, Security and Policy Review of DoD Information for Public Release, DoDM 5400.07, DoD Freedom of Information Act (FOIA) Program, and DoDM 5205.07-V1, DoD SAP Security Manual: General Procedures.

Support to Controlled Unclassified Information (CUI) portions of work on a lawful government contract may be accomplished by individuals without a security clearance needing to access CUI. No individual may have access to CUI unless it is determined that the individual has an authorized, lawful government purpose. The individual with authorized possession, knowledge, or control of CUI will determine whether an individual has an authorized, lawful government purpose to access designated CUI. CUI does not include information lawfully and publicly available without restrictions. CUI requires safeguarding measures identified by the necessary law, regulation, or government wide policy with which it is associated.

Reference security requirements of NIST SP 800-171, they must use the NIST SP 800-171A procedures to evaluate the effectiveness of the tested controls. NIST SP 800-171A is the primary and authoritative guidance on assessing compliance with NIST SP 800-171.

Reference Block 10k & 11m: In order to perform assigned duties the contractor will need access to various government systems as identified by the GCA. The contractor shall follow overarching, and local requirements for access to these systems. Contractors shall be held accountable for actions they initiate on the network and shall conduct business IAW USSF, USAF, SSC, and host installation instructions and policies. The contractor shall not access, download or further disseminate any information/data (i.e. intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the GCA. In the event that any additional access is required, the GCA must modify the contract requirements, and revise the DD Form 254. Note: Once the GCA has modified the requirements for the generation of a revised DD Form 254, the Contractor must complete the Access Request Form(s), along with the modified DD Form 254, and forward to the GCA prior to receiving access. A NATO awareness brief will also be required for all Contractors prior to access to the NATO accredited terminals. Written concurrence of the GCA is required prior to subcontracting.

Secret Internet Protocol Router Network (SIPRNET) Access: Access to SIPRNET by contractor at government locations will be IAW applicable guidance and policies. Access to SIPRNET will be IAW DODI 8500.01, and Cybersecurity and Risk Management Framework (RFM) for DOD Information Technology.

The terms Cybersecurity, Information Systems, and Information Technology are defined in Committee on National Security Systems Instruction 4009, and Cybersecurity DODI 8500.01.

Unauthorized Disclosure: Government and contractor personnel must act to protect Technical Program design, development, or manufacturing data under their control from unauthorized disclosure to any foreign person or a U.S. person residing in a foreign country.

Government and contractor organizations must inform the U.S. State Department under the provision of the ITAR regarding any unauthorized disclosure.

FA8807-23-R-0005

PREVIOUS EDITION IS OBSOLETE. Page 5 of 7DD FORM 254, APR 2018

Reference Block 11j - Have OPSEC Requirements: The contractor shall accomplish the following minimum requirements in support of the Operations Security (OPSEC) Program.

a. The contractor shall protect activities that warrant OPSEC to include but are not limited to research, development, analysis, test and evaluation; acquisitions; treaty verification; nonproliferation protocols; international agreements; force protection operations; special access programs; and activities that prepare, sustain, or employ Military Services over the range of military operations.

b. The contractor shall protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of military operations performed by the contractor in support of the mission. Sensitive unclassified information is that information marked For Official Use Only (FOUO), Controlled Unclassified Information (CUI), Privacy Act (PA) Of 1974, Company Proprietary, and as identified by the government program office and program manager, and User Agency OPSEC Program Manager. OPSEC is essential to defense activities that may be compromised whenever open sources and detectable activities provide information that when compiled or analyzed is a detriment to U.S. interests.

c. Compliance with security requirements imposed by documents generated in response to DoDI 5200.39, Critical Program Information (CPI) Identification and Protection within Research, Development, Test and Evaluation (RDT&E).

d. The contractor shall comply with the User Agency/Program OPSEC Plan, and apply protective measures therein. Research and Development contractors (off-base) shall develop an OPSEC Plan in accordance with User Agency/Program OPSEC Plan, AFI, DoDM

5205.2 and as identified by the government program office and program manager, and User Agency OPSEC Program Manager. OPSEC shall be a part of ongoing security awareness program conducted in accordance with Chapter 3, Section 1, of the National Industrial Security Program Operating Manual.

e. The contractor shall protect all unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of military operations performed by the contractor in support of the mission. Contractor shall protect controlled unclassified information (CUI) and information identified in the SSC and SSC program office critical information list (CIL).

Disposition of Critical Information and CUI obtained or produced pursuant to this agreement shall be shredded/degaussed to prevent reconstruction.

f. Disposition of Sensitive Information, Critical Information, FOUO, and PA obtained or produced pursuant to this contract shall be shredded/degaussed to prevent reconstruction. Email transmission of Sensitive Information, Critical Information, FOUO, and PA obtained or produced pursuant to this contract will be encrypted or password protected. In addition, email containing FOUO and PA shall be marked in the subject line with (FOUO) or (PA). FOUO shall also be included at the beginning of the email with a non-disclosure statement.

Reference 13 Security Guidance:Public Release of Special Access Program (SAP) related data is not authorized without prior coordination through the Office of Special Investigation (OSI), Office of Special Projects (PJ) Security Director and subsequent approval of the Original Classification Authority (OCA) and the Air Force Special Access Program Central Office (AF SAPCO). Submit all proposed public disclosures related to SAP data to the Government Program Manager (GPM) and the OSI PJ Program Security Officer (PSO).

Program Protection Plans (PPP) and Security Classification Guides (SCG): The contractors shall protect critical program information (CPI) and critical components (CC) in compliance with the Program Protection Plan (PPP). Program Security Classification Guides (SCGs) will be provided by the Government program office. Classified national security information, and unclassified controlled information (CUI) shall be protected as outlined in the SCG, NISPOM (i.e., Part 117 of Title 32, CFR),DODM 5200.01 V1-4 and DoDI 5200.48, Controlled Unclassified Information (CUI) .

Research and developmental contractors shall develop a Program Protection Implementation Plan (PPIP) to be approved by the program office. The PPIP shall describe the protection measures being implemented by the contractor and sub-contractors for CPI and CC. The prime contractor shall flow-down to any subcontractor protection requirements for implementation as described in the PPIP in compliance with PPP. The government program office shall conduct Program Protection Surveys at contractor locations to assess the effectiveness of the established PPIP.

This contract requires compliance with the following core security guidance documents:

32 Code of Federal Regulation (CFR) Part 117, National Industrial Security Program Operating Manual (NISPOM) DoD Directive 5205.07, Special Access Program (SAP) Policy, as supplemented, Volumes 1-4 (latest version) SAF/AAZ Memorandum, "Implementation of DoDM 5205.07, DoD SAP Manual, Volumes 1-4" (latest version) DoD Instruction 5205.11, Management, Administration, and Oversight of DoD SAPs, (latest version) DoD Manual 5200.01, DoD Information Security Program: Protection of Classified Information, Volumes 1-3, (latest version) DoD Instruction 5200.48, Controlled Unclassified Information (CUI), (latest version) DoD Instruction (DoDI) 8510.01, Risk Management Framework for DoD Technology (IT), (latest version)

Risk Management Framework (RMF) using the Joint Special Access Program Implementation Guide (JSIG), (latest version) AF Policy Directive (AFPD) 16-7, Special Access Programs, (latest version) AFGM 2020-16-01 Air Force Guidance Memorandum for Controlled Unclassified Information (CUI), dated 22 July 2021

FA8807-23-R-0005

PREVIOUS EDITION IS OBSOLETE. Page 6 of 7DD FORM 254, APR 2018

The following website address for both DoD issuances and e-publishing: DoD issuances: http://www.dtic.mil/whs/directives/; AF e-publishing: http://www.e-publishing.af.mil/

Personnel Security - Contractor employees (to include applicant, temporaries, part-time and replacement employees) under the contract must be US Citizens and shall undergo a security background investigation. At a minimum, contractor personnel shall have a favorable secret security clearance for the performance of this contract. Selected contractor personnel shall hold a favorable security clearance up to the level need in performance of the contract. Applicable guidance regarding Personnel Security may be found in the Air Force Space Command Supplement to Air Force Instruction (AFI) 31-101. Contractor(s) will not be afforded access to sensitive and/or classified information at any level (i.e. Confidential, Secret, or Top Secret) until the Department of Defense Consolidated Adjudications Facility (DoD CAF) grants a final security clearance at the appropriate level. Interim security clearances are authorized only when granted by DCSA and have been entered into Defense Information System for Security (DISS). Contractor(s) must be employed in a position that requires a clearance. Contractor(s) Facility Security Officer (FSO) will submit all investigation requests through Defense Information System for Security (DISS) and ensure individuals complete a clearance application in the Electronic Questionnaires for Investigations Processing (e-QIP). Contractor(s) FSO reviews, approves, and forwards the completed e-QIP to Defense Counterintelligence Security Agency (DCSA) Vetting Risk Operations Center (VROC) for approval, issuance of an interim clearance, and release to Office of Personnel Management (OPM) for investigation. his is also applicable to Subcontractor and Contractor personnel who are visiting or on a temporary and/or escort duties. This requirement is for personnel who have or may need access to restricted or controlled areas.

Any conflict and/or issue regarding classification level between this and any other application guide will be protected at the highest level until the conflict or issue is resolved by the PSO, Corps Security Manager, and INX/INS. Written resolution and/or direction will be provided by the PSO, Corps Security Manager, and INX/INS.

Security Incident Reporting: In addition to the reporting requirements directed by the NISPOM (i.e., Part 117 of Title 32, CFR), the contractor shall provide a concurrent report of loss or compromise and/or unauthorized access of CUI and any classified information, materials, hardware, and/or systems to the cognizant Government Contracting Activity (GCA), Government Information System Security Manager (ISSM), Corps Security Manager (CSM), and SSC Information Protection Office (SSC/ZAS), and supporting CSO (DCSA, etc.).

Contractor shall report loss or compromise and/or unauthorized access of CUI, FOUO, and any classified information, materials, hardware, and/or systems to the contractor's cognizant security office identified in Block(s) 6c and 8c.

Upon expiration of this contract, the contractor shall request disposition instruction for all classified and unclassified project material. The contractor may be directed to properly destroy or return material. If the contractor desires to retain classified or unclassified program information, the contractor must provide a request six (6) months in advance of contract completion to transfer project information to follow-on contractor or similar effort, contractor must have written approval from the Government: Program Manager, Contracting Officer and Security Officer. The contractor shall return to the GCA all CACs, security badges, entry passes/vehicle decals issued to contractor personnel. This applies to termination, cancellation and/or expiration contract, and/or of employment and/or suspension of clearance.

Transfer of document to other Independent Research and Development (IRAD) is not permitted.

The undersigned has reviewed the Security Specification, understands the provisions and will ensure that it is complied with within the limits of his/her responsibility, and that any violations are brought to the attention of the GCA.

POC:

The Contracting Officer (CO) is Bryan Boardway, SSC, 619-221-7785, bryan.boardway@spaceforce.mil The Contracting Officer Representative (COR) is LCDR Luke Ozeck, SSC/CGN, 619-508-6566, luke.ozeck@spaceforce.mil.

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

SSC/CGN NAME & TITLE OF REVIEWING OFFICIAL

SHAWN VEEN

Contracting Officer Representative

SIGNATURE

SSC/BZS NAME & TITLE OF REVIEWING OFFICIAL

MANUEL IBARRA

Security Specialist

SIGNATURE

IBARRA.MANUEL.AN

TONIO.JR.1276592102

Digitally signed by

IBARRA.MANUEL.ANTONIO.J

R.1276592102 Date: 2023.02.14 18:26:18 -08'00'

FA8807-23-R-0005

PREVIOUS EDITION IS OBSOLETE. Page 7 of 7DD FORM 254, APR 2018

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

(1) PROGRAM PROTECTION PLANNING: The prime contractor and its subcontractors shall protect Critical Program Information Information (CPI), Critical Components (CC), technologies and systems when identified in appropriate Program Protection Plans (PPP).

(2) for OPSEC requirements (reference Block 13 for details). Contractor will comply with the policies and procedures outlined in the host organization OPSEC Plan in support of this effort. Host organization OPSEC plan will be furnished by the Government upon contract award to ensure compliance with all OPSEC guidelines set forth.

(3) See SSC OPSEC Plan

(4) See attached SCI addendum 5.0

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

See SCI Addendum 5.0 The Defense Counterintelligence and Security Agency (DCSA) is relieved of security inspection responsibility for contract performance conducted on Government installations. the Commander retains cognizance over contracts on the installation. The Information Protection Office (IP) is designated as cognizant/inspection authority.

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

SSC/CGK

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

FA8807

c. ADDRESS (Include ZIP Code)

483 N. Aviation Blvd.

El Segundo, CA 90245

d. POC NAME

Bryan F. Boardway

e. POC TELEPHONE (Include Area Code)

+1 (310) 701-0335

f. EMAIL ADDRESS (See Instructions) bryan.boardway@spaceforce.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

b. TITLE

c. ADDRESS (Include ZIP Code)

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

e. CAGE CODE OF THE PRIME CONTRACTOR (See Instructions.)

f. TELEPHONE (Include Area Code)

g. EMAIL ADDRESS (See Instructions)

h. SIGNATURE

i. DATE SIGNED (See Instructions)

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

SSC/CGN

SSC/CG Security

SSC/BZS

SSC/S2S SSO