(1) DD Form 254 (2025)-Solicitation-Marine Chemist.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

Source: OPNAVINST N9210.3 (07 JUN 10) Clause Revision: AUG 2013

ATTACHMENT 2

GUIDANCE FOR NNPI

a. Security Agreement for Protection of Naval Nuclear Propulsion Information.

(1) During the performance of this contract Naval Nuclear Propulsion Information (NNPI) may be developed or used. Appropriate safeguards must be proposed by the contractor and provided to the Contracting Officer for Security for the safeguarding from actual, potential or inadvertent release of classified or unclassified NNPI in any form by the contractor or any subcontractor. These safeguards shall ensure that access to NNPI is limited to those governmental and contractor parties, including subcontractors, that have an established need to know, and then only under conditions that assure that the information is properly protected. Access by foreign nationals or representatives of foreign interests is not permitted. In addition, any and all issuances or releases of such information beyond such necessary parties, whether or not ordered through an administrative or judicial tribunal, shall be brought to the attention of the Contracting Officer for Security.

(2) The Contracting Officer for Security shall be immediately notified of any litigation, subpoenas, or requests which either seek or may result in the release of NNPI. In the event that a court or administrative order makes immediate review by the Contracting Officer for Security impracticable, the contractor agrees to take all necessary steps to notify the court or administrative body of the Navy’s interest in controlling the release of such information through review and concurrence in any release.

(3) The Contracting Agency reserves the right to audit contractor facilities for compliance with the above restrictions. Exceptions to these requirements may only be obtained with prior approval from the Commander, Naval Sea Systems Command (SEA 09P).

(4) Definitions applicable to this clause are provided in the base instruction, OPNAV Instruction N9210.3.

b. Security Requirements for Protection of Unclassified Naval Nuclear Propulsion Information (U-NNPI).

(1) The Contractor listed in block 6.a of the attached DD Form 254 hereby agrees that when provided documents (specifications, drawings, etc.) that contain U-NNPI and are marked as containing NOFORN sensitive information that must be controlled pursuant to federal law, the information contained therein and generated as part of the inquiry shall be used only for the purpose stated in the contract and shall in no case be transmitted outside the company (unless such transmittals comply with the detailed guidance of the contract) or to any foreign national within the company. While in use, the documents shall be protected from unauthorized observation and shall be kept secure so as to preclude access by any persons who do not have a legitimate need to view them. The documents shall not be copied unless done in conformance with the detailed guidance provided of the contract. All the documents shall be promptly returned in their entirety, unless authorized for proper disposal or retention, following completion of the contract.

(2) Only U.S. citizens who have a legitimate Need-To-Know (NTK) required to execute the contract shall be allowed access to U-NNPI.

(3) When not in direct control of an authorized individual, U-NNPI must be secured in a locked container (e.g., file cabinet, desk, safe.) Access to the container must be such that only authorized persons can access it, and compromise of the container would be obvious at sight. Containers should have no labels that indicate the contents. If removed from the site, U-NNPI must remain in the personal possession of the individual. At no time should U-NNPI be left unsecured (e.g., in a home or automobile, or unattended in a motel room or sent with baggage.)

(4) U-NNPI documents will have the word NOFORN at the top and bottom of each page. The cover sheet will have the warning statement shown below. Documents originated in the course of work that reproduce, expand or modify marked information shall be marked and controlled in the same way as the original. Media such as video tapes, disks, etc., must be marked and controlled similar to the markings on the original information.

NOFORN: This document is subject to special export controls, and each transmittal to foreign governments or foreign nationals may be made only with the approval of Naval Sea Systems Command.

Source: OPNAVINST N9210.3 (07 JUN 10) Clause Revision: AUG 2013

ATTACHMENT 2

GUIDANCE FOR NNPI

NOTE: This distribution warning statement is for training purposes only.

(5) U-NNPI may not be processed on networked computers with outside access unless approved by CNO (N00N). If desired, the company may submit a proposal for processing NNPI on company computer systems. Personally owned computing systems, such as personal computers, laptops, personal digital assistants, and other portable electronic devices are not authorized for processing NNPI. Exceptions require the specific approval of the cognizant Designated Accrediting Authority (DAA) for Information Technology (IT) systems and the Chief of Naval Operations (CNO) (N00N).

(6) U-NNPI may be faxed within the continental United States and Hawaii provided there is an authorized individual waiting to receive the document and properly control it. U-NNPI may not be faxed to facilities outside the continental United States, including military installations, unless encrypted by means approved by CNO (N00N).

(7) U-NNPI may be sent within the continental United States and Hawaii via first class mail in a single opaque envelope that has no markings indicating the nature of the contents.

(8) Documents containing U-NNPI shall be disposed of in the same manner as classified material.

(9) Report any attempts to elicit U-NNPI by unauthorized persons to the appropriate security personnel.

(10) Report any compromises of U-NNPI to the appropriate security personnel. This includes intentional or unintentional public release via such methods as theft, improper disposal (e.g., material not shredded, disks lost), placement on web sites, transmission via email, or violation of the information system containing U-NNPI.

ATTACHMENT 3

Portsmouth Naval Shipyard Operations Security Statement

The Contractor shall adhere to all Navy and Portsmouth Naval Shipyard (PNSY) Operational Security (OPSEC) policies and procedures during the performance of this contract. Relevant policies and procedures are identified primarily within NAVSEA Instruction 3432.1A, Operations Security (22 November 2016), and are summarized below.

OPSEC is the process by which the Navy and its personnel (military, civilian and contractors) denies adversaries access to critical information about Navy sensitive or classified activities, capabilities, and intentions.

Contractor personnel shall not enter NAVSEA spaces (Controlled Industrial Area (CIA), Security Islands (SI), Controlled Nuclear Information Area (CNIA), or Nuclear Work Areas (NWA) or any other restricted area with introduction of personal electronic devices, laptops, tablet PCs, cellular phones, cameras, recording devices, and data recording/storage devices, unless prior authorized. These items may be stored in government-provided security containers, if available, personal vehicles or other locations outside of NAVSEA spaces.

Company issued laptops required for the performance of work must be registered at the Pass & I.D. Office, Building 384 and approved by Code 1120 Physical Security and Code 109 Information Security.

Contractor personnel shall not take photographs or make any recordings (audio, visual digital) while on PNSY, unless that action is authorized by or necessary to perform the contract.

Contractor personnel shall submit all photographs taken and recordings made on PNSY to the OPSEC Program Manager (Code 1123.2) for review and shall obtain approval from that office prior to removing that information from PNSY or otherwise disseminating that information.

Contractor personnel shall not discuss government operations in public or over unprotected or unencrypted communications. The Contractor shall not post to company websites, publications, newsletters or other media, any images, data or information that reveal sensitive government operations, personnel, equipment, and/or classified or controlled unclassified information.

Contractors shall coordinate with and address questions about the content of any proposed disclosures with the Contracting Officer’s Representative (COR) or Technical Point of Contact, as applicable, and the PNS Public Affairs Office (PAO).

Contractor personnel shall not disclose to unauthorized third parties or, post to unofficial sites (including Social Networking sites) any images, data or information, or observed events that reveal sensitive government operations, personnel, equipment, including, but not limited to:

Tactics, techniques and procedures; production or work schedules; any visible or concealed modifications, upgrades, additions to vessels, weapons or equipment; increases, changes, or decreases in work/deployment frequency or government personnel, vehicle, vessel movements;

specialized equipment orders, deliveries, shipments, etc.

The Contractor shall report any unauthorized disclosures of this information or, any attempts to solicit this information from the Contractor by other companies or personnel who do not have an official need to know this information to PNS Security Office (Code 1120) and/or PNS Police Department and the Contracting Officer. Non-Disclosure requirements remain in effect during the duration of this contract and indefinitely thereafter.

Government issued badges, identification shall be removed and/or concealed from plain sight when off PNS and shall not be left in vehicles or unprotected. Badges and passes may not be duplicated, copied or loaned to others. Lost or stolen identification badges, vehicle passes, etc., will be immediately reported to PNS Code 1120 Security Office and/or PNS Police Department.

The Contractor should mark all internal production schedules, deliverables, inventories and shortages and identified vulnerabilities related to production of government material with restrictive legends in accordance with the Federal Acquisition Regulation and other applicable guidance. The Contractor shall safeguard that information from disclosure, inadvertent or otherwise, from unauthorized recipients.

All government furnished information must be destroyed or returned to the government, at the government’s discretion, upon completion or termination of the contract.

PORTSMOUTH NAVAL SHIPYARD CONTRACT CLAUSE FOR PROTECTION OF CONTROLLED

UNCLASSIFIED INFORMATION (CUI)

DoDI 5200.48, March 6, 2020

1.2. POLICY.

It is Department of Defense (DoD) policy that:

a. As part of the phased DoD Controlled Unclassified Information (CUI) Program implementation process endorsed by the CUI Executive Agent (EA) pursuant to Information Security Oversight Office (ISOO) Memorandum dated August 21, 2019, the designation, handling, and decontrolling of CUI (including CUI identification, sharing, marking, safeguarding, storage, dissemination, destruction, and records management) will be conducted in accordance with this issuance and Sections 252.204-7008 and 252.204-7012 of the Defense Federal Acquisition Regulation Supplement (DFARS) when applied by a contract to non-DoD systems.

b. All DoD CUI must be controlled until authorized for public release in accordance with DoD Instructions (DoDIs) 5230.09, 5230.29, and 5400.04, or DoD Manual (DoDM) 5400.07. Official DoD information that is not classified or controlled as CUI will also be reviewed prior to public release in accordance with DoDIs 5230.09 or5230.29.

c. Information will not be designated CUI in order to:

(1) Conceal violations of law, inefficiency, or administrative error.

(2) Prevent embarrassment to a person, organization, or agency.

(3) Prevent open competition.

(4) Control information not requiring protection under a law, regulation, or government-wide policy, unless approved by the CUI EA at the National Archives and Records Administration (NARA), through the Under Secretary of Defense for Intelligence and Security (USD(I&S)).

d. In accordance with the DoD phased CUI Program implementation, all documents containing CUI must carry CUI markings in accordance with this issuance.

e. Although DoD Components are not required to use the terms “Basic” or “Specified” to characterize CUI at this time, DoD Components will apply:

(1) At least the minimum safeguards required to protect CUI.

(2) Terms and specific marking requirements will be promulgated by the Under Secretary of Defense for Intelligence and Security (USD(I&S)) in future guidance.

f. Nothing in this issuance alters or supersedes the existing authorities of the Director of National Intelligence (DNI) regarding CUI.

g. Nothing in this issuance will infringe on the Office of Inspector General (OIG) of the DoD’s statutory independence and authority, as articulated in the Inspector General Act of 1978 in the Title 5, United States Code (U.S.C.) Appendix. In the event of any conflict between this instruction and the OIG DoD’s statutory independence and authority, the Inspector General Act of 1978 in the Title 5, U.S.C. Appendix takes precedence.

3.4. MARKING REQUIREMENTS.

This paragraph covers the essential marking requirements for initial phased implementation of the DoD CUI Program.

a. At minimum, CUI markings for unclassified DoD documents will include the acronym “CUI” in the banner and footer of the document.

b. If portion markings are selected, then all document subjects and titles, as well as individual sections, parts, paragraphs, or similar portions of a CUI document known to contain CUI, will be portion marked with “(CUI).”

Use of the unclassified marking “(U)” as a portion marking for unclassified information within CUI documents or materials is required.

(1) There is no requirement to add the “U,” signifying unclassified, to the banner and footer as was required with the old FOUO marking (i.e., U//FOUO).

(2) Banners, footers, and portion marking will only be marked “Unclassified” or “(U)” for unclassified information in accordance with the June 4, 2019 ISOO letter. If the document also contains CUI, it will be marked in accordance with Paragraph 3.4.a. and additional forthcoming guidance.

c. CUI markings in classified documents will appear in paragraphs or subparagraphs known to contain only CUI and must be portion marked with “(CUI).” “CUI” will not appear in the banner or footer.

(1) There will be an acknowledgement added to the warning box on the first page of multi-page documents to alert readers to the presence of CUI in a classified DoD document, as shown in Figure 1.

Figure 1. CUI Warning Box for Classified Material

(2) Volume 2 of DoDM 5200.01 requires DoD intelligence producers to follow DNI formats for intelligence production under the authority of the DNI. When DoD CUI is incorporated into a Digital Access Policy under the authority of the DNI, the information and the document will follow the Digital Access Policy standards established by the DNI.

d. The dissemination marking “not releasable to foreign nationals (NOFORN or NF)” is an intelligence control marking used to identify intelligence information an originator has determined meets the criteria of Intelligence Community Directive 710 and Intelligence Community Policy Guidance 403.1, which provides guidance for further dissemination control markings. It must be applied to controlled unclassified intelligence information that is properly characterized as CUI with appropriate CUI markings. CUI identified with this marking will not be provided, in any form, to foreign governments (including coalition partners), international organizations, foreign nationals, or other non-U.S. persons without the originator’s approval in accordance with Executive Orders (E.O.s) 13526 and 13556. If originator approval is required for further dissemination, the originator will mark the requirement on the information in accordance with Section 4.1(i)(1) of E.O. 13526.

(1) The application of the control marking “not releasable to foreign nationals” (NOFORN or NF) will only be applied, when warranted, to unclassified intelligence information properly categorized as CUI and reviewed by a Foreign Disclosure Officer to ensure there are no international agreements in place to prohibit its use and prohibiting sharing.

This content is classified at the [insert highest classification level of the source data] level and may contain elements of controlled unclassified information (CUI), unclassified, or information classified at a lower level than the overall classification displayed. This content shall not be used as a source of derivative classification; refer instead to [cite specific reference, where possible, or state “the applicable classification guide(s)”]. It must be reviewed for both Classified National Security Information (CNSI) and CUI in accordance with DoDI 5230.09 prior to public release. [Add a point of contact when needed.]

(2) The control marking NOFORN or NF will be applied to Naval Nuclear Propulsion Information (NNPI), Unclassified Controlled Nuclear Information (UCNI), National Disclosure Policy (NDP-1), and cover and cover support information. When warranted, it can be applied to unclassified information properly categorized as CUI having a licensing or export control requirement. Before marking a document or material as NOFORN or NF, it will be reviewed by the Foreign Disclosure Officer to ensure there are no agreements in place to prohibit its use and sharing.

(3) The application of “Releasable to” (“REL TO”) can only be applied, when warranted and consistent with relevant law, regulation, or government-wide policy or DoD policy, to information properly categorized as CUI with an export control or licensing requirement with a foreign disclosure agreement in place.

(a) Export-controlled CUI transfers to foreign persons must be in accordance with the Arms Export Control Act, International Traffic in Arms Regulations, Export Control Reform Act, Export Administration Regulations, and DoDI 2040.02. In accordance with DoD Directives (DoDDs) 5230.11 and 5230.20, a positive foreign disclosure decision must be made before CUI is released to a foreign entity.

(b) DoD operational CUI (not related to intelligence) may be marked as REL TO.

e. All classified documents, including legacy documents will be reviewed for CUI and properly marked upon changes in the document’s classification level, particularly if the documents are to be completely declassified.

f. The first page or cover of any document or material containing CUI, including a document with commingled classified information, will include a CUI designation indicator, as shown in Figure 2. This CUI designation indicator is similar to the classification-marking block used for classified national security information (CNSI) documents and materials. Documents and materials containing CUI will require a generic “CUI” marking at the top and bottom of each page.

(1) In accordance with Part 2002 of Title 32, Code of Federal Regulations (CFR), the CUI designation indicator must contain, at minimum, the name of the DoD Component determining that the information is CUI. If letterhead or another standard indicator of origination is used, this line may be omitted.

(2) The second line must identify the office making the determination.

(3) The third line must identify all types of CUI contained in the document.

(4) The fourth line must contain the distribution statement or the dissemination controls applicable to the document.

(5) The fifth line must contain the phone number or office mailbox for the originating DoD Component or authorized CUI holder.

Figure 2. CUI Designation Indicator for All Documents and Material

g. During DoD’s initial phased implementation of the CUI Program, there is no required distinction that must be made between Basic and Specified CUI. All DoD information will be protected in accordance with the requirements under the Basic level of safeguards and dissemination unless specifically identified otherwise in a law, Controlled by: [Name of DoD Component] (Only if not on letterhead) Controlled by: [Name of Office] CUI Category: (List category or categories of CUI) Distribution/Dissemination Control:

POC: [Phone or email address] regulation, or government-wide policy. Forthcoming guidance will address the distinction between the two levels of CUI, including a list of which categories are Basic or Specified, what makes the category one or the other, and the unique requirements, to include markings, for each.

3.6. GENERAL DOD CUI PROCEDURES. DoD CUI is clustered into organizational indexes (e.g., defense, privacy, proprietary) with associated DoD CUI is clustered into organizational indexes (e.g., defense, privacy, proprietary) with associated categories, and is categorized by the DoD according to the specific law, regulation, or government-wide policy requiring control. Unclassified information associated with a law, regulation, or government-wide policy and identified as needing safeguarding is considered CUI. It requires access control, handling, marking, dissemination controls, and other protective measures for safeguarding.

a. The authorized holder of a document or material is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. If so, the authorized holder is responsible for applying CUI markings and dissemination instructions accordingly.

b. In accordance with this issuance, every individual at every level, including DoD civilian and military personnel as well as contractors providing support to the DoD pursuant to contractual requirements, will comply with the requirements in Paragraph 3.6.f of this issuance for initial and annual refresher CUI training.

3.7. GENERAL DOD CUI REQUIREMENTS.

This section specifies initial requirements for implementing, marking, and managing the CUI program. Table 1 contains a sample list of the categories found in the DoD CUI Registry and Defense Index. A complete list of CUI Indexes and Categories can be found on Intelink athttps://intelshare.intelink.gov/sites/ousdi/hcis/sec/icdirect/information/CUI/Forms/AllItems.aspx Some significant points about DoD CUI include:

a. CUI does not include information lawfully and publicly available without restrictions.

b. CUI requires safeguarding measures identified by the CUI Executive Agent (EA) in Part 2002.14 of Title 32, CFR and, as necessary, in the law, regulation, or government-wide policy with which it is associated. DoD CUI may be disseminated to DoD personnel to conduct official DoD and U.S. Government business in accordance with a law, regulation, or government-wide policy.

(1) No individual may have access to CUI information unless it is determined he or she has an authorized, lawful government purpose.

(2) The person with authorized possession, knowledge, or control of CUI will determine whether an individual has an authorized, lawful government purpose to access designated CUI.

(3) CUI information may be disseminated within the DoD Components and between DoD Component officials and DoD contractors, consultants, and grantees to conduct business for the

DoD, provided dissemination is consistent with controls imposed by a distribution statement or limited dissemination controls (LDC).

(4) CUI designated information may be disseminated to a foreign recipient in order to conduct official business for the DoD, provided the dissemination has been approved by a disclosure authority in accordance with Paragraph 3.4.c. and the CUI is appropriately marked as releasable to the intended foreign recipient.

c. Controlled technical information (CTI) compiled or aggregated may become classified. Such classified CTI is subject to the requirements of the National Industrial Security Program, which has different requirements than Section 252.204-7012 of the DFARS for unclassified CTI.

3.10. GENERAL SYSTEM AND NETWORK CUI REQUIREMENTS.

In accordance with DoDIs 8500.01 and 8510.01, security controls for systems and networks are set to the level required by the safeguarding requirements for the data or information being processed, as identified in Federal Information Processing Standards 199 and 200. For DoD CUI, the minimum security level will be moderate confidentiality in accordance with Part 2002 of Title 32, CFR and National Institute of Standards and Technology Special Publication (NIST SP) 800-171.

SECTION 4: DISSEMINATION, DECONTROLLING AND DESTRUCTION

OF CUI

4.1. GENERAL.

(1) During working hours, steps will be taken to minimize the risk of access by unauthorized personnel, such as not reading, discussing, or leaving CUI information unattended where unauthorized personnel are present.

After working hours, CUI information will be stored in unlocked containers, desks, or cabinets if the government or government-contract building provides security for continuous monitoring of access. If building security is not provided, the information will be stored in locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas. The concept of a controlled environment means there is sufficient internal security measures in place to prevent or detect unauthorized access to CUI. For DoD, an open storage environment meets these requirements.

(2) CUI information and material may be transmitted via first class mail, parcel post, or, bulk shipments.

When practical, CUI information may be transmitted electronically (e.g., https.). Avoid wireless telephone transmission of CUI when other options are available. CUI transmission via facsimile machine is permitted;

however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive CUI; facsimile machine located in a controlled government environment).

SECTION 5: APPLICATION OF DOD INDUSTRY

5.1. GENERAL.

There is a shared responsibility between the DoD and industry, when established by contract, grants, or other legal agreements or arrangements, in the identification, creation, sharing, marking, safeguarding, storage, dissemination, decontrol, disposition, destruction, and records management of CUI documents and materials. It is essential to identify and apply the general dissemination principles and guidance as prescribed by the CUI EA in accordance with Part 2002 of Title 32, CFR. Contracts containing CUI shared from DoD or generated, or managed, or transmitted by the contractor via their information systems, will be in accordance with this issuance, which will be incorporated into each DoD contract.

a. The NIST SP 800-171 identifies the baseline CUI system security requirements for industry established by Part 2002 of Title 32, CFR. Additionally, Section 252.204-7012 of the DFARS specifies a waiver process for defense contractors in accordance with NIST SP 800-171 for contractor IT or networks.

b. CUI with the potential to impact national security (e.g., information related to critical programs and technology information) may require enhanced protection. These enhanced measures would address both physical and logical procedures. Enhanced protection methods for systems hosting CUI include:

c. Non-DoD IS processing, storing, or transmitting CUI will be safeguarded in accordance with contractual requirements identified for the particular CUI contained in the contract, DoDI 8582.01 and Section 252.04-7012 of the DFARS or their subsequent revision.

d. When established by contract, contractors, sub-contractors, and consultants must comply with safeguarding requirements identified in the contract for all types of CUI.

5.2. MISUSE OR UD OF CUI.

Safeguarding requirements and incident response measures for misuse or UD of CUI must be implemented across the DoD. Senior leaders, contracting officers, commanders, and supervisors at all levels must consider and take appropriate administrative, legal, or other corrective or disciplinary action to address CUI misuse or UD commensurate with the appropriate law, regulation, or government-wide policy.

5.3. REQUIREMENTS FOR DOD CONTRACTORS.

This paragraph highlights requirements for DoD contractors.

a. Whenever DoD provides information to contractors, it must identify whether any of the information is CUI via the contracting vehicle, in whole or part, and mark such documents, material, or media in accordance with this issuance.

b. Whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities, protective measures and dissemination controls, including those directed by relevant law, regulation, or government-wide policy, will be articulated in the contract, grant, or other legal agreement, as appropriate.

c. DoD contracts must require contractors to monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information. DoD contracts shall require contractors to report the potential classification of aggregated or compiled CUI to a DoD representative.

d. DoD personnel and contractors, pursuant to mandatory DoD contract provisions, will submit unclassified DoD information for review and approval for release in accordance with the standard DoD Component processes and DoDI 5230.09.

e. All CUI records must follow the approved mandatory disposition authorities whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and this issuance.

contractors to report the potential classification of aggregated or compiled CUI to a DoD representative.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, "DoD Contract Security Classification Specification" Hide Attachment Bar

Code 1120 Portsmouth, NH 03804-5000 Mr. Jeffrey S. Koenig 207-438-3520

Public Affairs Officer, Code 1160 207-438-1525

2. Performance of work will require access to areas where classified information, material, cannot be reasonably sanitized. All contractor employees performing duties under this contract must have, at a minimum, a final-adjudicated Secret Personnel Security Clearance (PCL) granted prior to being assigned to perform work at this facility. The contractor shall submit visit requests via the Defense Information Security System (DISS) to SMO N424745. The Squadron office, or subordinate command, to be visited or having cognizance over the contract is responsible for ensuring that visitors or contractors are informed of the necessity of forwarding a visit request to CSS-11/CSPRWC (Security Management Office (SMO) code: N424745) utilizing the Defense Information System for Security (DISS) Upon receipt of an incoming visit request, Squadron N6 will verify clearance information and need to know, and will add individuals to the Master Access List. If the necessity for emergent access arise; organization may email the Squadron Command Duty Officer (CDO) using Enclosure (3), who may authorize access with Squadron N6 concurrence. Squadron CDO can be reached at email address: CSS11.OPCON.WATCH.fct@navy.mil. At no time will visitors or contractors be given access to classified information without proper approval from Squadron N6. Visit requests submitted by other means will not be accepted without the Facility Security Officer signed verification as to the level of security clearance granted to each employee listed on the visit request.

The following Security Classification Guide(s) or subsequent revisions apply to this contract. Subsequent revisions shall be provided by the Government contracting Activity (GCA) as Government Furnished (GFI) and shall be executed by the Contractor at no additional cost to the government..

Item: 10(j). All Controlled Unclassified Information (CUI) associated with this contract must be protected per guidance provided for Item 11(l) of this DD254.

Item: 10(b) & (k) 1. (U) Security Controls on the Dissemination of NNPI Received or Generated Under NAVSEA Contracts 12/1/2011.

Item: 10(b) & (k) 2. (U) OPNAVINST, N9210.3 Safeguarding of Naval Nuclear Propulsion Information (NNPI) 6/7/2010.

Item: 10(b) 3. (C-RD) CG-RN-1, REV.3, CHANGES 1-20, DOE-DOD SCG for the NNPI which includes Interpretive Guidance Bulletins 1-19.

Item: 10(b) 4. Access to NNPI RD for this contract requires a final U.S. Government National Security Clearance at the appropriate level and an NNPI RD security briefing from the Facility Security Officer (FSO).

Item: 10(b) & (k) 5. Processing of NNPI on non-federal IT systems requires NAVSEA 08 authorization per OPNAVINST N9210.3, using the procedures identified in NAVSEA ltr 08B/19-03823, dated 2 August 2019.

Item: 10(b) & (k) 6. The contractor must maintain a current Certification of eligibility from the Defense Logistics Agency, Joint Certification Office for access to export-controlled Controlled Unclassified Information (CUI), which includes U-NNPI. DD Form 2345, Militarily Critical Technical Data Agreement, applies.

Item: 10(b) & (k) 7. The Contractor must submit a request for sharing of NNPI RD to sub- contractors in writing to the individual listed in block 17 of this DD-254 and NAVSEA 08 for approval, including a copy of the draft sub-contractor DD254 and justification for access to RD. Sharing of U-NNPI only requires an info-copy DD254 to be sent.

Item: 11.(j). The Contractor shall utilize the NAVSEA Portsmouth Naval Shipyard Critical Information and Indicators List, Ser 1120-347 of November 17, 2021 to help identify and protect critical information associated with this contract.

Item: 11(j). Continued: During the period of this contract, the Contractor may be exposed to, use, or produce, NAVSEA PNS Critical Information (CI) and/or observables and indicators which may lead to discovery of CI. PNS’s CI will not be distributed to unauthorized third parties, including foreign governments, or companies under Foreign Ownership, Control, or Influence (FOCI).

Item: 11(j). Continued: Assembled large components/systems being transported to and from testing areas, other production or government facilities (whether or not on public roadways) shall be in an enclosed van trailer or covered flatbed trailer. Component/System outside storage, staging and test areas shall be shielded/obscured from public view wherever physically possible.

Item: 11(j). Continued: NAVSEA PNS CI shall not be publicized in corporate wide newsletters, trade magazines, displays, intranet pages or public facing websites. Media requests related to this project shall be directed to NAVSEA Public Release Authority listed in Item 12 of this DD Form 254.

Item: 11(j). Continued: Any attempt by unauthorized third parties to solicit, obtain, photograph, or record,or incidents of loss/compromise of government Classfied or CI, Business Sensitive and Company Proprietary information related to this contract or other programs must be immediately reported to the Facility Security Officer, DCSA and /or the Naval Criminal Investigative Service, and Code 1120. Questions concerning these requirements shall be directed to NAVSEA PNS OPSEC manager.

Item: 11(j). Continued: Performance under this contract requires the contractor to adhere to OPSEC requirements. OPSEC requirements are additional to the requirements of DoD 5220.22-32 Vol , National Industrial Security Program Manual, therefore, the contractor may not impose OPSEC requirements on its subcontractors unless NAVSEA PNS OPSEC Manager approves the OPSEC requirements.

IItem: 11(l): Legacy information from exisiting documents (e.g. Technical Manuals) marked For Official Use Only or FOUO, that is used to create a new document/correspondence, shall follow the minimum marking requirements of DoDI 5200.48, Section 3, paragraph 3.4.a, and include the acronym “CUI” in the banner and the footer of the document. Nonfederal information systems storing and processing CUI shall be protected per NIST SP-800-171, or subsequent revisions. All transmissions to personal email accounts (AOL,Yahoo, Hotmail, Comcast, etc) and posting on social media websites (Facebook, Instragram, Twitter, LinkedIn, etc.) are prohibited. Destroy all CUI associated with this contract by any of the following approved methods: A cross-cut shredder, a certified commercial destruction vendor, a central destruction facility, incineration, chemical decomposition, pulverizing, disintegration, or methods approved for classified destruction.

Item: 11(l). U-NNPI CUI must be protected in accordance with OPNAVINST N9210.3 and may not be stored or processed on Non-federal AIS without written authorization of NAVSEA 08, Naval Reactors.

3. All classified documents must be destroyed using a National Security Agency (NSA) approved high security crosscut shredder listed on the NSA/CSS evaluated products list (EPL) for high security crosscut paper shredders, or other approved method for destroying classified information.

4. All classified information involved in security incidents shall be retained and provided to the certifying official in Block 17 of this DD254 for classification review. Copies if preliminary inquiry or investigative reports of security incidents involving classified information shall be scanned and forwarded to the certifying official in Block 17.

5. All security related issues, incidents, or requests pertaining to this contract shall be presented in writing by the contractor’s Facility Security Officer (FSO) to the individual identified in Block 17(a) of this DD254. The contractor shall abide by the other reporting requirements outlined in the NISPOM.

6. Classified or unclassified technical papers to be presented at a classified symposium must be approved by the Portsmouth Naval Shipyard Contracting Officer’s Representative (COR) prior to the presentation.

7. The Contractor must submit a request for sharing of classified and other sensitive information between prime contracts in writing to the individual identified in Block 17 of this DD254. Each request must reference contract number ............ to identify the specific information for which approval is being sought, a justification for needing to share the information, the name of the other contractor and its contract number under which the requested information will be shared.

8. Security Classification guides and unclassified limited documents (e. g., FOUO, Distribution Statement Controlled) are not authorized for public release; therefore, they can not be posted on a publicly accessible web server or transmitted over the internet unless appropriately encrypted. Request for public release can not be transmitted via the internet until the contractor receives final approval from NAVSEA PNS Security Office (Code 1120).

9. Personnel designated as derivative classifiers shall receive derivative classification training prior to access from the contractor’s Facility Security Officer (FSO).