04_Attachment_2_Draft_DD_254_(updated_15_Jul_15).pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

SECRET

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYMMDD)

b. SUBCONTACT NUMBER b. REVISED (Supersedes all previous specs)

REVISION NO. Date (YYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYMMDD)

FA8811-15-R-0001

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under _______________________(Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

TBD – Planning DD254 Only TBD

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

The Evolved Expendable Launch Vehicle (EELV) Phase IA procurement allows the Air Force to procure the necessary equipment and services in order to reliably launch National Security Space (NSS) space vehicles, placing payloads into their appropriate earth orbit.

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION

l. OTHER (Specify).

k. OTHER Specify) Security of Unclassified DoD Information on Non-DoD Information Systems

Visitor Group Security Agreement (VGSA)

DD Form 254, DEC 1999 Previous editions are obsolete

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct

Through (Specify):

SMC/PA

483 North Aviation Blvd El Segundo, CA 90245-2808 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

The contractor shall protect Critical Program Information (CPI/CC), technologies, technical documents and systems as identified in the applicable Program Protection Plan (PPP) as well as identified in the contractor’s Program Protection Implementation Plan (PPIP), as approved by the program office. The prime contractor shall flow-down CPI/CC to any subcontractor with protection requirements as identified in its PPIP. Individual Space Vehicle classification guidance for launch services provided under this effort are contained in the following, all of which have been transmitted to the contractor, and are available in the EELV Program Office:

1. Current NAVSTAR Global Positioning System Protection Guide. Appendices A-E to SPG are not applicable to the EELV contractor – Unclassified/FOUO.

2. Current Protected MILSAT/Advanced Extremely High Frequency (AEHF) Security Classification/Declassification Guide – SECRET/FOUO.

3. Current NRO Launch Information Protection Guide (NRO Launch IPG) – Unclassified/FOUO.

4. Current Wideband Global SATCOM (WGS) Security Classification Guide - Unclassified/FOUO

5. Current Space Based Infrared Systems Wing (SBIRS) Security Classification/Declassification Guide (SCG) – Unclassified/FOUO

6. Current Defense Support Program (DSP) and SBIRS Highly Elliptical Orbit (HEO) Operations SCG – Unclassified/FOUO

7. Current Program Protection Plan (P3) for the SBIRS – Unclassified/FOUO

8. Current EELV PPP & SCG – Unclassified/FOUO.

9. EELV Operations Security (OPSEC) Plan

CONTRACT OFFICE REPRESENTATIVE:________________________

SECURITY OFFICE REPRESENTATIVE: ________________________

CONTRACT EXPIRATION DATE: _________________________ PROGRAM OFFICE REPRESENTATIVE: ________________________

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes

No

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

The Defense Security Service is relieved of security inspection responsibility for contract activities performed on military installations.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

DZUNG P. DOM, GG-13, DAF

b. TITLE

Contracting Officer Launch Systems Directorate

c. TELEPHONE (Include Area Code)

310-653-3696

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

483 North Aviation Blvd Los Angeles Air Force Base El Segundo CA 90245

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY SMC/ENP

FA8811-15-R-0001 DD Form 254

Appendix A

(8) Actual Performance – Additional

(a) Location (b) Cage Code (c) Cognizant Security Office

CONTINUATION – DD FORM 254

Contract # FA8811-15-R-0001

(10a.) Communications Security (COMSEC) lnformation

The contractor shall forward requests for COMSEC material/information to the COMSEC officer through the EELV Program Security Manager (SMC/LRE). COMSEC material/information shall not be released to DoD contractors without Air Force Cryptological Support Center (AFCSC) approval. The contractor is governed by the NSA Industrial COMSEC Manual, NSA Central

Security Service (CSS) Policy Manual No. 3-16, dated 5 Aug 2005, or as applicable, AFI 33-

210, Vol ll, lll, and IX for the control and protection of COMSEC material/information. Access to

COMSEC material by personnel is restricted to U.S. citizens holding final U.S. Government clearances. Such information is not releasable to personnel holding only reciprocal clearances.

The contractor facility does not require a COMSEC account.

(10j) For Official Use Only (FOUO)

Controlled Unclassified Information (CUI) is now the term which collectively refers to FOUO and Unclassified Controlled Nuclear Information (UCNI). CUI information provided under this contract shall be managed and safeguarded IAW DoDM 5200.01, Volume 4, Controlled Unclassified Information (CUI).

Personally Identifiable Information (PII):

Per AFI 33-332, Para 1.1.5.

Personal information is defined by the Department of Defense (DoD) as “information about an individual that identifies, links, relates, or is unique to, or describes him or her, e.g., social security number (SSN); age; military rank; civilian grade; marital status; race; salary;

home/office phone numbers; other demographic, biometric, personnel, medical, and financial information, etc. Such information is also known as personally identifiable information (PII) (i.e., information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date of birth, place of birth, mother's maiden name, or biometric records, including any other PII which is linked or linkable to a specified individual).”

Accomplish the following when transmitting FOUO, which includes PA, over email: (Per AFI 33- 332 and DODM 5200.1 V4)

1. Add "For Official Use Only" ("FOUO") to the beginning of the subject line

2. Add the following statement at the beginning of the e-mail:

"This e-mail contains FOR OFFICIAL USE ONLY (FOUO) information which must be protected under the Freedom of Information Act (5 U.S.C 552) and/or the Privacy Act of 1974 (5 U.S.C.

552a). Unauthorized disclosure or misuse of this PERSONAL INFORMATION may result in disciplinary action, criminal and/or civil penalties. Further distribution is prohibited without the approval of the author of this message unless the recipient has a need to know in the performance of official duties. If you have received this message in error, please notify the sender and delete all copies of this message."

3. Add encryption and digitally sign email

NOTE per AFI 33-332/DODM 5200.1V4:

1. Do not indiscriminately apply this statement to all e-mails. Use it only in situations when you are actually transmitting FOUO information.

2. Add "(FOUO)" at the beginning of each sentence containing FOUO information.

(10k) Security of Unclassified DoD Information on Non-DoD Information Systems

The Contractor must comply with the information safeguards as specified in DoDI 8582.01, Security of Unclassified DOD Information on Non-DOD Information Systems, DoD Commercial Mobile Device (CMD) Interim Policy dated 17 Jan 2012, Use of Commercial Mobile Devices Not Connected to Department of Defense Networks dated 31 Jul 2012, and Air Force (AF) Guidance memorandum to AF Manual 33-282 dated 4 April 2013. The aforementioned policies apply to Government issued, Contractor provided, or personal devices. The Contractor shall immediately notify the EELV Program Security Manager (SMC/LRE) of any instance of a network security breach involving the unauthorized access of DoD information.

Non-enterprise activated CMD is defined as any mobile handheld device that is not connected to any DoD network (wired or wireless) or to a PC that is/will be connected to a DoD network.

The devices can be used for any non-sensitive unclassified DoD tasks and process/store publically released information. Non-enterprise activated commercial mobile devices, regardless of ownership, are prohibited from storing and/or processing classified information, Personally Identifiable Information (PII), Health Insurance Portability and Accountability Act

(HIPAA) information, Controlled Unclassified Information (CUI), For Official Use Only (FOUO) and DoD sensitive information.

Definitions:

Non-Sensitive Information -- Information available in the public domain or DoD information that has been approved for public release

Sensitive Information -- Information, the loss, misuse, or unauthorized access to or modification of, could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of title 5, United States Code, "The Privacy Act" but which has not been specifically authorized under criteria established by Executive order or an Act of Congress to be kept secret in the interest of national defense or foreign policy.

(Section 278g-3 of title 15, United States Code, “The Computer Security Act of 1987").

(11j) Operation Security (OPSEC)

The contractor shall comply with the EELV OPSEC Plan while on military/government installations and implement an OPSEC program in accordance with the EELV OPSEC Plan.

The contractor shall develop and implement government approved OPSEC guidance to protect critical information as indentified in the EELV OPSEC Plan, if not on government installation.

OPSEC shall be part of the ongoing security awareness program conducted in accordance with Chapter 3, Section 1, of the National Industrial Security Program Operating Manual (NISPOM).

The contractor shall protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of military operations performed by the contractor in support of the mission. Sensitive unclassified information is that Information marked FOUO, PA, COMPANY PROPRIETARY.

Disposition of Critical Information, FOUO, and PA obtained or produced pursuant to this contract shall be shredded/degaussed to prevent reconstruction.

Email transmission of Critical Information, FOUO, and PA obtained or produced pursuant to this contract shall be encrypted or password protected. In addition, email containing FOUO and PA shall be marked in the subject line. FOUO shall also be included at the beginning and end of the email.

(11l) Visitor Group Security Agreement (VGSA):

For activities at the Air Force installations identified in ITEM 8, the Contractor may be required by the host agency to enter into a VGSA in accordance with Air Force Instruction 31-601, Industrial Security. The VGSA is executed with the Contractor who requires or will have access to classified information or to sensitive unclassified information. The VGSA must address those security requirements and/or procedures that are unique to the installation for which the contractor shall be held contractually liable. VGSAs need only address those areas of security, safeguarding and/or protection that have not been covered elsewhere within the contract, DD Form 254, Statement of Work, Statement of Objectives, Performance-based Work Statement, etc.

(13) Program Protection

The contractor shall protect critical program information (CPI) in compliance with the Program Protection Plan (PPP) and mission critical components. The contractor shall develop a Program Protection Implementation Plan (PPIP), to be approved by the program office that describes the protection measures being implemented by the contractor and sub-contractors for protecting CPI and mission critical components. The prime contractor shall flow-down to any subcontractor protection requirements for implementation as described in the PPIP in compliance with PPP.

The government program office shall conduct Program Protection Surveys at contractor’s locations to assess the effectiveness of the established PPIP.

Additionally, classified national security information, special access and unclassified controlled information as prescribed in applicable Security Classification Guides (SCGs) shall be protected as outlined in the NISPOM.

Personnel Security

Contractor and subcontractor personnel have or may need access to Launch Site Restricted or Controlled areas containing EELV Space Launch Systems and/or Information Systems which directly affect a Launch System. As described in the prime contract, the contractor will have subcontracts with its parent company, who will perform the work.

For purposes of this requirement, any reference to “Contractor” shall include employees of both

Contractor and its parent company.

All contractor personnel performing on this contract and permanently assigned to launch site operations must be a U.S. Person and must be in process for, or possess a favorable National Agency Check Inquiry (NAC-I), an equivalent clearance approval as indicated in the Air Force Space Command Supplement to Air Force Instruction (AFI) 31-101, paragraph 7.2.1.1, or higher government security clearance, in accordance with AFI 31-501 or the NISPOM.

Contractor personnel who are visiting or on a temporary duty assignment at launch site operations and who require access to Launch Site Restricted or Controlled areas containing EELV Space Launch Systems or Information Systems which directly affect a Launch System shall be escorted by authorized personnel, unless the visitor or temporarily assigned individual is a U.S. Person and is in process for or possesses a favorable NAC-I, an equivalent clearance approval, or higher government security clearance.

All subcontractor personnel who require access to Launch Site Restricted or Controlled areas containing EELV Space Launch Systems or Information Systems which directly affect a Launch System shall be escorted by authorized personnel, unless such subcontractor personnel are US Citizens, in process for or possess a favorable NAC-I, an equivalent clearance approval, or higher government security clearance.

International Affairs

The contractor and its subcontractors shall adhere to the current version of the U.S. State Department, International Traffic in Arms Regulations (ITAR), 22 CFR 120 et seq. as relating to export and munitions list controlled items, laws and regulations. Whenever the exchange of unclassified information with a foreign subcontractor or foreign government is required, the information shall be regulated by the ITAR. Visits by a Foreign Person and/or U.S. Person acting as a Representative of a Foreign Interest to facilities and/or locations regulated by the ITAR and/or NISPOM, DoD 5220.22-M, shall comply with applicable visit notifications, information access and escorting requirements. The exchange of classified Foreign Government Information is not permitted by this contract, ref. 10.h. of this specification.