Attachment_8_DD254_Draft.pdf

Designed using Adobe, DARPA/SSO

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

b. LEVEL OF SAFEGUARD REQUIRED

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

a. ORIGINAL (Complete date in all cases)

DATE (YYYYMMDD)

b. REVISED (Supercedes all previous specs)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases)

DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? YES

NOYES

NO If Yes, complete the following:

If Yes, complete the following:

Classified material received or generated under

In response to the contractor's request dated , retention of the classified material is authorized for the period of

(Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254?

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

8. ACTUAL PERFORMANCE

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code) b. CAGE CODE a. LOCATION

b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

10. CONTRACTOR WILL REQUIRE ACCESS TO: NOYES

i. OTHER (Specify)

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS

AND TRUST TERRITORIES

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. HAVE TEMPEST REQUIREMENTS

h. REQUIRE A COMSEC ACCOUNT

e. PERFORM SERVICES ONLY

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

b. RECEIVE CLASSIFIED DOCUMENTS ONLY

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR'S

FACILITY OR A GOVERNMENT ACTIVITY

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL:

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

d. FORMERLY RESTRICTED DATA

e. INTELLIGENCE INFORMATION

f. SPECIAL ACCESS INFORMATION

g. NATO INFORMATION

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

j. FOR OFFICIAL USE ONLY INFORMATION

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

k. OTHER (Specify)

YES NO

DD Form 254, DEC 1999

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaiing to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the informaiton involved shall be handeled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract.

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirement to the cognizant security office. Use Item 13 if additional space is needed.)

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office.

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

17. REQUIRED DISTRIBUTION

e. SIGNATURE to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

Direct Through (Specify)

Yes No

a. TYPED NAME OF CERTIFYING OFFICIAL

d. ADDRESS (Include Zip Code)

b. TITLE c. TELEPHONE (Include Area Code)

DD Form 254 (Back), DEC 1999

NoYes qholland Highlight

CONTINUATION SHEET FOR DD 254, CONTRACT SECURITY CLASSIFICATION SPECIFICATION

CONTRACT NUMBER

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable)

3. THIS SPECIFICATION IS: (X and complete as applicable)

a. ORIGINAL (Complete date in all cases)

b. REVISED (Supercedes all previous specs)

c. FINAL (Complete Item 5 in all cases)

4. IS THIS A FOLLOW-ON CONTRACT?

If Yes, complete the following:

If Yes, complete the following:

(Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254?

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

8. ACTUAL PERFORMANCE

7. SUBCONTRACTOR

10. CONTRACTOR WILL REQUIRE ACCESS TO:

NO

YES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS

AND TRUST TERRITORIES

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. HAVE TEMPEST REQUIREMENTS

h. REQUIRE A COMSEC ACCOUNT

e. PERFORM SERVICES ONLY

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

b. RECEIVE CLASSIFIED DOCUMENTS ONLY

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR'S

FACILITY OR A GOVERNMENT ACTIVITY

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL:

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

d. FORMERLY RESTRICTED DATA

e. INTELLIGENCE INFORMATION

f. SPECIAL ACCESS INFORMATION

g. NATO INFORMATION

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

j. FOR OFFICIAL USE ONLY INFORMATION

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

YES

NO

DD Form 254, DEC 1999

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaiing to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the informaiton involved shall be handeled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract.

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirement to the cognizant security office. Use Item 13 if additional space is needed.)

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office.

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

17. REQUIRED DISTRIBUTION

e. SIGNATURE to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

DD Form 254 (Back), DEC 1999

CONTINUATION SHEET FOR DD 254, CONTRACT SECURITY CLASSIFICATION SPECIFICATION

10a: Classified COMSEC material is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. COMSEC access shall be IAW DoD 5220.22-M. When access is required at Government facilities, contractor personnel will adhere to COMSEC rules and regulations as mandated by command policy and procedures. Written concurrence of the Contracting Officer is required prior to subcontracting. Contractor is authorized the use of secure telephones (STE’s) with fax.

10e(1): SCI Access required. No public release of information authorized, public disclosure or confirmation of any subject related to the support contract is not authorized without first obtaining written approval from the Contracting Officer. The Director, DIA and Director, DARPA, have exclusive security responsibility for SCI released to the contractor or developed under this contract. Before releasing or providing SCI to contractor personnel, the GCA shall ensure that they are appropriately cleared in accordance with ICD 704, and they agree to follow controls and procedures for the protection, handling, and accountability of SCI. All activities involving SCI (including discussions) shall be conducted in sensitive compartmented information facilities (SCIFs). Physical security standards for SCIFs are contained in ICD 705 must be adhered to.

10e(2): Non-SCI Information is not releasable to contractor employees who have not received a clearance at the appropriate security level. Access to Intelligence information is required for performance. The Director, DARPA, has exclusive security responsibility for Non-SCI released to the contractor or developed under this contract.

All Contractors performing on this contract shall abide by all current and applicable successor governmental guidance. Please contact your FSO, PSO or PSR if any questions arise pertaining to the availability of these guidance documents.

(Tech Office) POCs: PM - ; PSO - Dave Stiffler; PSR - James Persons

675 North Randolph Street Arlington, VA 22203

10j: For Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoD Manual 5200.01 Volume 4, DoD Information Security Program.

11c: The contractor requires access to classified source data up to and including (Top Secret, Secret, Confidential – insert one) in support of the work effort. Classified material generated in support of this contract shall be classified in accordance with the source material used or DARPA security classification guidance, which will be provided by the DARPA Program Security Officer or the Program Security Representative. Automated information systems must be certified and accredited by the cognizant security agency prior to processing classified information for a DARPA program. All personnel performing Information Assurance (IA)/cybersecurity related duties on classified information systems shall meet the requirements set forth in DoD 8570.01-M “Information Assurance Workforce Improvement Program.” All classified information received or generated under this contract is the property of the U.S. Government. At the termination or expiration of this contract, DARPA will be contacted for proper disposition instructions.

11i: TEMPEST Information is not releasable to contractor employees who have not received a FINAL Clearance at the appropriate security level. Written concurrence of the Contracting Officer is required prior to subcontracting. The contractor is subject to TEMPEST counter-measures levied by the DARPA CTTA in accordance with Chapter 11 of the NISPOM. When applicable the contractor will perform a TEMPEST review in accordance with DoDM 5105.21 Vol 2, Enclosure 4, para 3, October 19, 2012. TEMPEST requirements may not be imposed on subcontractors without GCA approval. Only those TEMPEST countermeasures recommended by CTTA and authorized by the program manager or contracting authority should be implemented.

11j: The contractor should consider creating an OPSEC Plan or incorporate into an existing OPSEC Plan.

SAP information systems will require an authorization-to-operate using the Risk Management Framework (RMF) process outlined in the “Joint Special Access Program (SAP) Implementation Guide (JSIG)”, Revision 3, dated October 9, 2013 (or successor document).

When information is controlled by the United States Munitions List (USML), the contractor must abide by the International Traffic Arms Regulation (ITAR) requirements.

Top Secret material may be reproduced only as necessary in the preparation and delivery of a contract deliverable. SECRET and CONFIDENTIAL material may be reproduced as necessary for performance of a prime or subcontract.