ACASS DD254 REV 8 APR 26.pdf

(Updated 20250815) CLASSIFICATION (When filled in): CUI

CLASSIFICATION (When filled in): CUI PREVIOUS EDITION IS OBSOLETE. Page 1 of 4DD FORM 254, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

August 31, 2028

The public reporting burden for this collection of information, 0704-0567, is estimated to average 36 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED

(See Instructions)

Top Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

None (See instructions)

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER

FA70222-26-R-0003

DUE DATE (YYYYMMDD)

20260501

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

20260304

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

TBD

b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

TBD

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor) Add Row Remove Last Row Delete All Rows

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.) Add Row Remove Last Row Delete All Rows

a. LOCATION(S) (For actual performance, see instructions.)

AFTAC/HQ, Building 10989 1020 South Patrick Drive Patrick SFB, FL 32925-3516

b. CAGE CODE (If applicable, see Instructions.)

N/A

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional) SSO PATRICK, Building 10989 1020 South Patrick Drive Patrick SFB, FL 32925-3516 louis.dellaverson@us.af.mil 321-494-1414

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

The AFTAC Contract Administration Support Services (ACASS) contractor shall provide professional federal contracting support services at AFTAC in collaboration with AMIC contracting officers. Services include acquisition planning, market research, acquisition strategy development, acquisition and contract document development. Services also include cost/price analysis, preparation of determinations and justifications, synopsis, solicitations, price negotiation memorandum, and the contractor shall provide assistance with and document proposal evaluations and will receive AFTAC technical evaluations as well as contractor submitted technical/cost proposals for review and use in the contract formation process. The contractor will professionally execute contract administration duties and will maintain contract writing, filing, and tracking systems/tools and will accurately document, file (to include electronic filing), and maintain contract documents. The contractor will develop and adhere to acquisition milestones.

PREVIOUS EDITION IS OBSOLETE. Page 2 of 4DD FORM 254, APR 2018

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.) h. FOREIGN GOVERNMENT INFORMATION

d. FORMERLY RESTRICTED DATA i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDI 5200.48, only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

AFTAC/OPSEC, 1020 South Patrick Drive, Patrick SFB, FL 32940

Public Release Authority:

Contractor is to submit requests through the contracting officer for OPSEC program manager review and public release authorization.

13. SECURITY GUIDANCE Add Signature Remove Last Signature Delete All Signatures

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable

PDF.)

AFTAC SCG Dated: 14 Jun 2024, and applicable revisions only Level of Access Required: SCI Attachments:

Atch 1 Protecting Controlled Unclassified Information Atch 2 Release of Non-Sensitive Compartmented Information Atch 3 Contractor Incident Reporting Policy Atch 4 Block 13 DD 254_Addendum Atch 5 Access to Sensitive Compartmented Information

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form) Hide Attachment Bar

PREVIOUS EDITION IS OBSOLETE. Page 3 of 4DD FORM 254, APR 2018

AFTAC/SOP

1020 South Patrick Drive, Bldg. 10989 Patrick SFB, FL 32925-3516

NAME & TITLE OF REVIEWING OFFICIAL

Louis A. Dellaverson Security Specialist

SIGNATURE

SSO Patrick 1020 South Patrick Drive, Bldg. 10989 Patrick SFB, FL 32925-3516

NAME & TITLE OF REVIEWING OFFICIAL

Patrick L. Reagan Special Security Officer

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

Prior approval of the contracting activity is required for subcontracting. All DD FMs 254 prepared for a subcontract by the prime contract will be forwarded to the government contracting monitor and SSO Patrick for signature prior to award of the subcontract. Access to intelligence information will require special briefings and final U.S. Government Top Secret eligibility clearance with ICD 704 eligibility.

Report adverse information as required by 32 CFR part 117.8.

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

While operating on an Air Force installations, Industrial Security Reviews for collateral classified information will be conducted by the responsible unit security specialist or assistant. SSO Patrick has exclusive security responsibility for all sensitive compartmented information and material under this contract and held at the government facility.

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

Kyle Roberts, AFTAC/SDA

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

FA7022

c. ADDRESS (Include ZIP Code)

AFTAC SDA

1020 South Patrick Drive, Bldg. 10989 Patrick SFB, FL 32925-3516

d. POC NAME Roberts, Kyle S.

e. POC TELEPHONE (Include Area Code)

+1 (321) 494-9472

f. EMAIL ADDRESS (See Instructions) kyle.roberts@us.af.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

Austin, Danny, D

b. TITLE

Contracting Officer

c. ADDRESS (Include ZIP Code) AMIC Det 2 OL/PKA (Patrick SFB) 1020 South Patrick Drive, Bldg. 10989 Patrick SFB, FL 32925-3516

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

FA7022

e. CAGE CODE OF THE PRIME CONTRACTOR

(See Instructions.)

TBD

f. TELEPHONE (Include Area Code)

+1 (321) 494-8133

g. EMAIL ADDRESS (See Instructions) danny.austin.3@us.af.mil

h. SIGNATURE

i. DATE SIGNED (See Instructions)

PREVIOUS EDITION IS OBSOLETE. Page 4 of 4DD FORM 254, APR 2018

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

AFTAC Security/SOP

CUI

DDEPARTMENTT OFF THEE AIRR FORCEE

AIRR FORCEE TECHNICALL APPLICATIONSS CENTERR

SPECIALL SECURITYY OFFICE

CUI

21 October 2024

MEMORANDUM FOR AFTAC CLEARED CONTRACTORS

THROUGH: AFTAC CORS

FROM: AFTAC SPECIAL SECURITY OFFICE

1020 SOUTH PATRICK DRIVE

PATRICK, AFB FL, 32925

SUBJECT: Incident Reports, Counter Insider Threat Reporting And Access Verification in Defense Information System for Security

1. As required by 32 CFR, part 117.8, contractors are required to report all adverse information meeting Security Executive Agent Directive (SEAD) 3 or 4 concerning any of their cleared employees. To ensure communication between Air Force Technical Applications Center (AFTAC) and our industry partners, we must ensure this requirement and AFTAC’s expectations for reporting adverse information are clear. In that vein, the following actions concerning the notification of adverse information to AFTAC must be taken for any contractor employees working on an AFTAC contract with access to classified information. All contracting companies who hold a contract with AFTAC with a requirement for access to classified information or AFTAC facilities must notify AFTAC Personnel Security Office (AFTAC/SOP) of all adverse information or subsequent incident reports within 24 hours of the contractor being aware of such information. Send all notifications to aftac.personnelsecurity@us.af.mil.

AFTAC/SOP will then notify the AFTAC Industrial Security Office and Contracting Officer’s Representative for that effort.

2. Additionally, contractors must report any incidents that meet thresholds in the attached DITMAC Threshold Desk Reference Guide. Such incidents must be reported directly to the AFTAC Counter Insider Threat Liaisons via email address aftac.InTLiaison.mailbox@us.af.mil within 20 days of discovery. This includes adverse information, security violations, personnel security issues, and suspicious contacts.

3. These requirements are to ensure timely notifications to the government authorities granting access to information and facilities, enabling access determinations.

4. Direct any questions you may have to the AFTAC Personnel Security Office at 321-494-6149.

PATRICK L. REAGAN, GG-14, DAF

Special Security Officer

The information herein is FOR OFFICIAL USE ONLY (FOUO) information which must be protected under the Freedom of Information Act (5 U.S.C. 552) and/or Privacy Act of 1974 (5 U.S.C. 552a). Unauthorized disclosure of misuse of this

PERSONAL INFORMATION may result in disciplinary action, criminal, and/or civil penalties.

REAGAN.PATRICK.LE

E.1146160863

Digitally signed by

REAGAN.PATRICK.LEE.1146160863

Date: 2024.10.21 09:22:15 -04'00'

CONTROLLED UNCLASSIFIED INFORMATION

DoD Insider Threat & Management Analysis Center

REPORTING THRESHOLDS

DESK REFERENCE GUIDE

Introduction

In December 2016, the Undersecretary of Defense for Intelligence USD(I) published the list of the 13 DITMAC Reporting Thresholds. These thresholds, which all 44 DoD components previously validated, are a guide for insider threat professionals working at the component programs to determine which Insider Threat events merit enterprise level awareness and analysis.

While the thresholds are fairly comprehensive, as with any threshold list, component insider threat programs cannot anticipate every possible situation they may face. There will always be a subset of events that fall neither clearly above nor clearly below the threshold, and sometimes a single event meets multiple thresholds. In those cases, the DITMAC relies on the good judgment of component program leadership and the expertise of the insider threat staff to make the determination. The DITMAC stands ready to assist any component program with determining whether an issue should be reported. When reporting an incident, it is imperative that component programs submit all available information and documentation related to the reported incident to ensure the DITMAC is able to appropriately triage, analyze, and provide mitigation recommendations for each case after analyzing all pertinent information available.

To determine if an event should be reported to the DITMAC, component program personnel should consider two key factors. First, is the behavior directly or potentially threatening to DoD personnel, resources or capabilities? Second, is the behavior aberrant to the culture and context in which it occurred? Generally speaking, those behaviors that are low threat and not unusual for the context in which they occur are typically best managed at the component level and would not merit DITMAC reporting.

Recognizing there will always be some questions about the application of the reporting thresholds to events and activity, the DITMAC created this guide to assist component programs in the threshold selection decision making process which occurs during the course of entering an insider threat event into the DITMAC System of Systems (DSoS). Should questions arise during the threshold selection process, component programs are encouraged to contact the DITMAC at 571-357- 6850 or SIPRNet email: dcsa.ncr.dcsa-ci.mbx.ditmac-ops@mail.smil.mil. Lastly, as a reminder, the DoD component hubs still have the option of submitting a Request for (continued)

Controlled by: DCSA Controlled by: DITMAC CUI Category(ies): OPSEC Limited Dissemination Control: N/A POC: Delice Bernhard, (571) 357-6872

Information (RFI) to the DITMAC via the DSoS for those matters they assess do not yet meet a reporting threshold, but DITMAC assistance may still be needed. When submitting an RFI, reporters must identify the incident, insider threat indicators, and/or observed concerning behavior(s) and specify what information DITMAC may be able to provide to assist in further identifying this potential insider threat-related activity.

This Guide does not replace or modify the approved and published DITMAC Reporting Thresholds.

This Guide and the DITMAC Reporting Thresholds are applicable to all persons/populations identified in DoDD 5205.16, as well as to any member of the International Military Student (IMS) population, and their accompanying family members, who are assigned to a CONUS or OCONUS DoD installation or training facility as part of a formal training program.

Cross-Threshold Topics

Domestic Violence/Stalking

- The attempt to intimidate, cause harm, or create fear of harm to a family member, spouse, or significant other. (Typically reportable under Thresholds 5, potentially 6.)

- Efforts to control, dominate, or remove freedom of will and/or action from a family member, spouse, or significant other. Instances of this behavior could manifest through the limitation of access to: communication, finances, social contacts, family, free movement. (Typically reportable under Threshold 4, potentially 6.)

- A pattern of unsolicited, inappropriate, or unwanted attempts to develop/maintain a real or perceived relationship with another individual. (Typically reportable under Threshold 4, potentially 6.)

- Violations of another individual’s privacy, sense of safety, or other personal boundary.

(Typically reportable under Threshold 4, potentially 6.)

Violent Extremism

- Clear identification with or support for violent extremist or violent hate-based ideology through behavior or outward expression including, but not limited to: verbal statements or body modification. (Typically reportable under Thresholds 2, 4, potentially 12.)

- Making or attempting to make contact with violent extremist groups, or other individuals espousing violent extremist ideology (i.e. via email, social media, attending rallies, visiting compounds, etc.). (Typically reportable under Thresholds 2, 4, 12, potentially 10.)

- The procurement, possession, or distribution of violent extremist literature or paraphernalia. (Typically reportable under Thresholds 2, 4, 11, potentially 12.)

- Threatening, intimidating, harassing, or harming another individual consistent with violent extremist or violent hate-based ideology. (Typically reportable under Thresholds 1, 2, 4, 6, 11, potentially 12.)

Financial Considerations

- Significant financial criminal activity such as: racketeering, identity theft, bribery, extortion, forgery, debarments due to fraudulent activity. (Typically reportable under Threshold 4, potentially 12.)

- Suspicious international financial transactions (i.e. associated with unreported foreign assets/businesses/contacts). (Typically reportable under Threshold 4, potentially 3.)

- Instances in which delinquent finances are associated with other behaviors of concern (i.e. gambling, fraud waste and abuse, egregious financial mismanagement). (Typically reportable under Threshold 4, potentially 5.)

Guidance Specific to International Military Student (IMS)

- Component InT programs must submit a case (or RFI if applicable) to DITMAC when:

An IMS exceeds/attempts to exceed the level of physical and/or logical access they were granted by DoD. (Typically reportable under Threshold 4 or 5) If, by biometric or biographic verification, or by other means, the Component discovers that the person who arrived in the U.S. and is granted physical or logical access to DoD installations or systems as an IMS, is not in fact the same individual who was previously vetted for IMS participation. (Reportable under Threshold 4 or 5)

An IMS goes Absent Without Leave (AWOL). (Reportable under Threshold 8) An IMS is suspected of, or found to be involved in, any serious criminal activity or terrorism matters. (Reportable under Threshold 6, 11, potentially 12) During authorized installation vehicle, personal item, or facility searches, an IMS is found to have unauthorized items (i.e.: drugs, weapons, ammunition, stolen property).

(Reportable under Threshold 4, 5, potentially 6)

An IMS travels outside the 250 mile limit of their duty station without authorization.

(Reportable under Threshold 1, 4, potentially 5)

An IMS violates the SECDEF policy prohibiting the Transport, Possession, Storage or Use of Privately Owned Firearms and Non-Official Ammunition. (Reportable under Threshold 1 or 4)

An IMS is involved in any behavior or activities that meet one of the thirteen DITMAC Reporting Thresholds.

- In addition, thresholds not specifically referenced above also pertain to the IMS population and should be reported-When an IMS with an Insider Threat file at one Component InT hub transfers to a command or activity under the responsibility of another Component InT hub, the first hub should refer an InT case to DITMAC and provide all available information on the IMS. The case should be referred under the applicable threshold, or if the actions were sub-threshold, reported under Threshold “Other”. DITMAC will provide all available information to the gaining Component InT hub for its awareness.

Juvenile Behavior

- If the activity occurred within a recent time period or is indicative of a pattern of criminal behavior (i.e. associated with acts of violence, sexual criminal activity, threatening behavior, and/or misuse of weapons). (Typically reportable under Threshold 4 or 6.)

Polygraph Disclosures

- Behavior or activities meeting a DITMAC Reporting Threshold which are disclosed, admitted to, and/or remain unresolved as a result of the polygraph process.

Sexually Explicit Material

- Viewing or the attempt to view sexually explicit material on a government system.

(Typically reportable under Thresholds 4 and 10.)

- Possessing or producing sexually explicit or obscene material in violation of federal law.

(Typically reportable under Threshold 4, potentially 6.)

- Seeking, procuring, storing, displaying, or producing sexually explicit material that is exploitative in nature or features non-consenting partners (i.e. bestiality, children, rape, revenge posting). (Typically reportable under Thresholds 4, 5, 6, 10, 12.)

- Instances in which the use of sexually explicit material is so frequent, or occurs in situations so inappropriate, that it may be reflective of a compulsive process, lack of control, and/or judgement. (Typically reportable under Threshold 5.)

- Instances in which the use of sexually explicit material is associated with other behaviors of concern (i.e. indecent acts/exposure). (Typically reportable under Thresholds 4, 5, potentially 6.)

Substance Abuse, Use, Distribution, or Manufacture

- A pattern of illegal or controlled substance or alcohol related incidents such as:

workplace intoxication. (Typically reportable under Thresholds 4 and 5.)

- The manufacture and/or distribution of significant amounts of illegal or controlled substances. (Typically reportable under Threshold 4.)

- Instances in which substance abuse is associated with other behaviors of concern (i.e.

domestic violence, suicidal ideation, threatening behavior). (Typically reportable under Threshold 4 and 5, potentially 6.)

Threshold 1: SERIOUS THREAT

Definition: “Information pertaining to any serious threat covered persons may pose to DoD and U.S. Government installations, facilities, personnel, missions, or resources. Serious threats are defined as those that present a reasonable risk to life or limb, or have the potential to degrade or destroy a critical intelligence or operational capability of DoD.”

What Is Intended By This Threshold:

a. The threat is targeted toward DoD/USG assets or personnel and the intent is communicated in some form (written, email, verbal, hostile gesture) that would suggest risk of serious harm.

b. Unlike in Threshold 6 (Criminal Conduct), law enforcement involvement is not a necessary element.

c. Threshold 1 (Serious Threat) constitutes a verbal or non-verbal statement of intention which may not necessarily imply violence (such as sabotage or other malicious acts, to include cyber threats), whereas Threshold 6 (Criminal Conduct) involves an act/threat of violence.

Examples of Threshold 1 Reporting:

1. A disgruntled covered person states to a coworker, “If my supervisor only knew what I could do to our agency’s network, he would have selected me for the promotion.” UAM of this employee’s government computer uncovers he has researched how to deploy a malicious code on the agency’s network.

2. A covered person recently had a heated verbal altercation with her supervisor after a poor performance review. A week later, bullet casings inscribed with the supervisor’s name were found on the covered person’s desk.

3. After receiving orders to be deployed to a perceived undesirable location, a U.S. Navy Sailor threatens to degrade a firing system onboard a Navy vessel.

Threshold 2: ALLEGIANCE TO THE UNITED STATES

Definition: “Information pertaining to any covered person exhibiting questionable allegiance to the U.S. through words or actions to include involvement in, support of, training to commit, or advocacy of any act of sabotage, treason, or sedition against the United States.”

**Note: An allegiance issue arises only when a covered person acts or prepares to act on beliefs in a manner that violates the law. Criticism of the U.S. Government is protected by freedom of speech and the expression of unpopular or antigovernment beliefs does not constitute lack of allegiance for reporting purposes. However, covered persons do not have the right to engage in force or violence, either actual or threatened, in order to further their beliefs.

a. Association with persons who are attempting to commit, or who are committing, any act of sabotage, treason, sedition, or other act whose aim is to overthrow the Government of the United States or alter the form of government by unconstitutional means.

b. Association with persons or organizations that advocate the overthrow of the U.S.

Government, or any state, by force or violence or by other unconstitutional means.

c. Involvement in activities which unlawfully advocate or practice the commission of acts of force or violence to prevent others from exercising their rights under the Constitution or laws of the United States or of any state.

Examples of Threshold 2 Reporting:

1. A covered employee has contacted a foreign military organization and indicated his desire to join it.

2. A covered employee has provided financial contributions to a foreign-based organization that encourages hacking into U.S. government databases.

**Note: Instances involving covered persons who demonstrate, through their words or actions, allegiance to terrorist organizations or individuals associated with terrorist organizations shall be captured under Threshold 11 (Terrorism). Instances involving covered employees who demonstrate allegiance issues via potential or suspected espionage indicators shall be captured under Threshold 3 (Espionage/Foreign Considerations).

Threshold 3: ESPIONAGE/FOREIGN CONSIDERATIONS

Definition:

A. “The investigation, arrest or apprehension by a federal law enforcement agency, Military Department Counterintelligence (CI) Organization (MDCO), and/or DoD Component’s CI element of any covered person for espionage

B. Investigations into and/or judicial or administrative actions taken against any covered person regarding reportable Foreign Intelligence Entity (FIE) contacts, activities, indicators, and behaviors as detailed in DoD Directive 5240.06 (Incorporating Change 1, May 30, 2013 ‘CI Awareness and Reporting’ Table 1).

C. Information pertaining to any covered person suspected to have unauthorized contact with an officer or agent of an FIE, or who fails to report or disclose, when required to do so: Any previous or ongoing relationship or contact with any person from a foreign country; foreign travel; foreign passport or identity card; foreign citizenship or foreign residency; foreign military service; ownership of foreign property; or, undue influence by a foreign interest (e.g. on-going personal or professional foreign contacts; receipt of benefits from a foreign country).”

a. This threshold focuses on covered persons suspected of using their authorized access to DoD facilities, systems or information to commit espionage on behalf of an FIE. Due to the extreme sensitivity of espionage investigations and inquiries, and as explained in paragraph 3 of the Introduction to the DITMAC Reporting Thresholds, limited handling reporting procedures exist for DoD Components to promptly report suspected espionage matters.

b. This threshold includes potential espionage indicators demonstrated by covered persons, including:

• Unreported contact with an individual who has known or suspected associations with a foreign intelligence or security organization, or

• Visits to foreign diplomatic facilities that are unexplained or inconsistent with an individual’s official duties.

c. Unreported foreign travel and unreported foreign contacts by covered persons are also reportable under this threshold, as are issues involving deliberate efforts by covered persons to conceal connections to foreign governments or foreign persons, concealment of dual citizenship, or obtaining or renewing a foreign passport.

**Note: Failure to report or disclose information related to foreign considerations is better captured under this threshold rather than Threshold 4 (Personal Conduct).

Examples of Threshold 3 Reporting:

1. A covered person is being investigated for suspected espionage after information surfaced that he provided classified documents to a FIE. The DoD Component Insider Threat Hub makes a limited distribution report into the DSoS following a request by the Military Department Counterintelligence Organization that is conducting the investigation.

2. A covered person fails to report foreign travel when required to do so.

3. During the course of a personnel security investigation a covered person admits to an unreported co-habitation with a foreign national, indicating he did not report it because of his concern that he would lose his clearance eligibility.

Threshold 4: PERSONAL CONDUCT

Definition: “Information, in regard to a covered person, pertaining to deliberate omission, concealment, or falsification of relevant facts from any personnel security investigations, polygraph examinations (including counterintelligence scope and expanded screening scope polygraphs), or a pattern of behavior (two or more incidents closely related in time) that puts the individual’s judgment, trustworthiness, candor, honesty or willingness to comply with applicable laws and regulations into question.”

a. A core element of this threshold is intentional deception in an official process.

b. Deception may result from failing to reveal all relevant facts, altering facts, or simply lying.

c. Deception may also be revealed through a series of intentional integrity related rule violations.

d. Obvious personal gain is not a necessary condition for reporting.

e. A pattern of criminal activity occurring with the use of weapons or threatening behavior, or which would reduce the readiness or significantly impact DoD and its resources.

Examples of Threshold 4 Reporting:

1. A covered employee lists “shoplifting” on the SF-86 when in reality she was part of an armed robbery.

2. A covered person who demonstrates a pattern of submitting false claims to the government [e.g., travel vouchers, time cards]

3. During the course of a counterintelligence-scope polygraph, a covered employee makes an admission that he deliberately omitted reportable information on his SF-86 for fear the information would adversely impact his security clearance.

Threshold 5: BEHAVIORAL CONSIDERATIONS

Definition: “Information pertaining to a covered person who exhibits behaviors that cast doubts on their judgment, reliability, or trustworthiness. Such behaviors include, but are not limited to, emotionally unstable, irresponsible, dysfunctional, violent, paranoid, bizarre, anti-social, or aggressive behavior (see ‘Violence in the Federal Workplace: A Guide for Prevention and Response,’ for additional information about these behaviors of concern). This also includes information derived from User Activity Monitoring (UAM), human resources information, military and civilian performance evaluations, and reports of criminal or family law proceedings that indicate a person cleared by DoD is a threat to him or herself. Seeking mental health counselling is not by itself a reporting threshold.”

a. This threshold is a broad category incorporating irresponsible, uncontrolled or generally concerning behavior.

b. The concerning behavior may or may not be intentional in nature.

c. The concerning behavior may be perceived as threatening or violent without necessarily having an identified target or an intention to harm.

d. The concerning behavior may or may not result from mental illness (including substance abuse), extreme stress, or emotional disturbance.

e. This threshold additionally encompasses suicidal and/or homicidal behaviors or ideation.

**Note: Seeking mental health counselling should be viewed positively and may serve as a mitigating factor.

Examples of Threshold 5 Reporting:

1. A covered employee reveals on UAM, “I am at the end of my rope. I don’t care if I make it or not, but there will be consequences.”

2. A covered employee reports that the Russians are trying to kidnap him. He is convinced he is being followed and that they have planted cameras throughout his house. As a result he has begun sleeping in his office and regularly checks for “bugs.”

3. A covered employee is told that he will not be included in a presentation that he helped develop. He quietly walks back to his cube, picks up his chair and throws it across the office.

4. A covered employee is reported by their supervisor for continuously contacting a coworker via phone and email despite being told repeatedly to cease communication.

Threshold 6: CRIMINAL CONDUCT

Definition: “The investigation, arrest or apprehension by a federal, state, or local, law enforcement agency, or the conviction, indictment, or charging by a federal, state or local jurisdiction of any covered person involving: the loss of life; actual or suspected acts of violence or threats of violence (including sexual assault); the illegal possession or transfer of weapons of mass destruction; any criminal offenses involving the use of weapons or explosives.”

a. The reported incident must include implied or actual violent actions.

b. Law enforcement/judicial involvement is a required element.

Examples of Threshold 6 Reporting:

1. A covered person was cited by DoD component police for unlawful possession of a knife in her purse.

2. A law enforcement investigation into a covered person led to the discovery of evidence of an improvised explosive device being constructed in the basement of the covered person’s home.

3. A covered person is being investigated for allegations of a sexual assault.

Threshold 7: UNAUTHORIZED DISCLOSURE

Definition: “Information that indicates a covered person is knowingly involved in unauthorized disclosure, theft, loss, or compromise of classified or protected information to a foreign power, an agent of foreign power, the media, or any unauthorized recipient. Reportable unauthorized disclosures include unauthorized publication of classified or controlled unclassified information present in books, articles, or other written, online, or broadcast media sources determined to have been written or otherwise provided by current or former cleared DoD-affiliated officials.”

a. The compromised information is protected, non-public information (e.g., controlled unclassified information or classified information.

b. An unauthorized recipient(s) must be involved.

c. The unauthorized disclosure was done deliberately, or with such reckless disregard for security requirements that the action is tantamount to deliberate disclosure.".

d. A pattern of 2 or more unauthorized disclosures over the course of 6 months – demonstrating an inability to follow security rules and/or regulations.

**Note: Disclosure under an applicable whistleblower protection statute would not be reportable.

Examples of Threshold 7 Reporting:

1. A covered person publishes a book which includes business proprietary blueprints of warfighter technology.

2. A covered person sends classified information to a media outlet because she believes the public has a right to know.

3. A covered employee’s notebook containing several classified documents is found at a local restaurant by employees of the establishment.

4. A covered employee scans a classified document to an unclassified network and forwards the document to an unauthorized recipient.

Threshold 8: UNEXPLAINED PERSONNEL DISAPPEARANCE

Definition: “The suspicious death or unexplained disappearance of any covered person.”

a. Reporting indicating a covered person’s unexplained disappearance is the result of an effort to avoid or elude appropriate authority (i.e. command security officials, LE/CI agencies) inquiry and/or investigation into matters associated with the theft, loss or compromise of classified or controlled unclassified information.

b. The unexplained disappearance of a covered person holding a TOP SECRET or TOP SECRET/SCI clearance.

c. Reporting indicating the death of a covered person has occurred under suspicious or unexplained circumstances and articulable facts exist indicating the death has a potential nexus to the decedent’s work for, or affiliation with, the Department of Defense.

Examples of Threshold 8 Reporting:

1. A TS/SCI cleared contractor employee supporting a DoD Component fails to report to work and reasonable efforts to locate the person by command and company officials does not develop a logical explanation for the person’s whereabouts.

2. Via UAM, the DoD Component notes an excessive number of classified documents being downloaded and printed by one of its covered employees. Command Security officials contact the employee and request that he report to the Security Office for an interview.

The employee fails to report for the interview and does not come to work the next day without any explanation. The covered employee is found dead in her home with a single gunshot wound to her head. Police find no note at the scene but do find several Secret and Top Secret documents in the decedent’s home office. (This example could also meet Threshold 9 [Handling Protected Information].)

Threshold 9: HANDLING PROTECTED INFORMATION

Definition: “Information pertaining to a covered person deliberately mishandling protected information, or exhibiting a pattern (two or more incidents closely related in time) of negligent noncompliance with rules, procedures, guidelines, or regulations for protecting classified or controlled unclassified information.”

a. The mishandling of information is deliberate or habitually negligent.

• For a single event to be reported, it has to be a deliberate act.

• Accidental/negligent mishandling must have occurred more than once, and these occurrences must be closely related in time.

b. The incident involves classified or controlled unclassified information.

c. Unlike Threshold 7 (Unauthorized Disclosure), there is no specific intent to disclose or expose the information.

Examples of Threshold 9 Reporting:

1. Information derived from UAM found an anomalous volume of data printed by a particular covered person. This covered person was selected to go through additional security to include a bag check upon departure of the building. Security found an uncharacteristically large amount of sensitive but unclassified documents in his possession.

2. A covered person intentionally disposes of a classified hard drive at the landfill.

3. A covered person takes her notepad containing classified information home to work on the project over the weekend.

Threshold 10: MISUSE OF INFORMATION TECHNOLOGY

Definition: “Information pertaining to a covered person deliberately misusing information technology, or exhibiting a pattern (two or more incidents closely related in time) of negligent noncompliance with rules, procedures, guidelines or regulations pertaining to information technology.”

a. The misuse of information technology is deliberate or habitually negligent.

• For a single event to be reported, it has to be a deliberate act.

• Accidental/negligent misuse must have occurred more than once, and these occurrences must be closely related in time.

b. Threshold includes cleared contractor-issued information technology.

c. Internet usage to commit criminal activity.

Examples of Threshold 10 Reporting:

1. Over the last several months a covered person has had multiple incidents involving deliberate non-compliance with a DoD Component's guidelines regarding downloading prohibited software onto the Component’s network.

2. A covered person disables the UAM software on his work computer.

3. A covered person who works in IT downloads unauthorized software to retrieve users’ passwords.

4. A covered person uploaded numerous sensitive but unclassified documents to/from a cloud server prior to resigning in order to utilize the information in future employment.

Threshold 11: TERRORISM

Definition: “Information pertaining to a covered person providing support to, or who is in contact (to include on-line, email, and social networking) with known or suspected domestic or international terrorist or extremist individuals, organizations, or groups. Any attempt or conspiracy to commit the above shall also be reported.”

a. The unlawful use of violence or threat of violence, often motivated by religious, political, or other ideological beliefs, to instill fear and coerce the United States Government, in pursuit of goals that are usually political.

b. Involvement in, support of, training to commit, or advocacy of any act of terrorism against the United States of America.

c. Association with persons who are attempting to commit, or who are committing, terrorism against the United States of America, and expressions of sympathy or agreement with terrorist acts.

d. Intentional damage or destruction of a critical intelligence or operational capability of DoD in furtherance of political or social objectives.

e. Acts of cyberterrorism committed by covered persons will be reported under this threshold.

Examples of Threshold 11 Reporting:

1. During the course of a Periodic Background Reinvestigation, a witness reports that she had a series of conversations with a covered employee, during which the covered employee confided his financial support to a known domestic or international terrorist organization.

2. Via UAM, a DoD Component learns that one of its covered persons is communicating via email with an individual suspected of being affiliated with a domestic or international terrorist organization.

3. A federal law enforcement investigation into a known domestic or international terrorism organization develops information on a covered person suspected to have associated with and been radicalized by the organization. As noted in paragraph 3 of the introduction to the DITMAC Reporting Thresholds, a DoD Component Insider Threat Hub can make a limited distribution report to the DITMAC following a request from the MDCO or LEA.

4. A covered person throws a brick, covered in the flag associated with a known terrorist organization, into the window of a DoD recruiting center.

Threshold 12: CRIMINAL AFFILIATIONS

Definition: “Information pertaining to a covered person providing support to, or who are in contact (to include on-line, email and social networking) with known or suspected domestic or international criminal organizations, criminal street gangs, or groups engaged in racketeering activities. Any attempt or conspiracy to conduct the above shall also be reported.”

a. Membership in or support provided to criminal enterprises, outlaw motorcycle gangs, organized crime groups, criminal street/drug gangs, or transnational organized crime groups.

b. Included in this threshold are covered persons who associate with persons they know are members and/or affiliates of criminal enterprises, outlaw motorcycle gangs, organized crime groups, criminal street/drug gangs, or transnational organized crime groups.

Examples of Threshold 12 Reporting:

1. During the course of a personnel security investigation, several witnesses report that a covered person confided he is a current member of a Los Angeles-based street gang.

2. Via UAM, a DoD Component uncovers evidence that a covered person is communicating with a known member of an outlaw motorcycle gang regarding the planned theft of military gear.

3. During the course of a law enforcement investigation, information surfaces that a covered person has been providing assistance to a transnational organized crime group involved in human trafficking.

**Note: Affiliation by covered persons with eco-terrorist violent extremist, animal rights violent extremist organizations and sovereign citizen violent extremist groups could also be captured under Threshold 11 (Terrorism).

Threshold 13: ADVERSE CLEARANCE ACTIONS

Current Definition: “The suspension, revocation, or denial of a security clearance for reasons identified in thresholds 1-12.”

a. There has been some documented action taken on the individual’s clearance, eligibility, and/or access.

b. The suspension, revocation, or denial of the security clearance for the relevant incident is logged in security or adjudicative databases.

**Note: Reports that meet this threshold must meet another DITMAC threshold.

Examples of Threshold 13 Reporting:

1. A covered person is arrested by federal authorities after admitting she provided classified information to a media organization, resulting in the DoD Component revoking her eligibility. This matter would merit both Threshold 7 (Unauthorized Disclosure) and Threshold 13 entries.

2. DoD Component decides to suspend the covered person’s logical and physical access and makes an Incident Report in JPAS after a criminal investigation is initiated into the covered person’s involvement in an issue concerning workplace violence.

PROTECTING CONTROLLED UNCLASSIFIED INFORMATION

EXTRACTED FROM DODM 5400.07_AFMAN 33-302 AND DODI 5200.48

1. CONTROLLED UNCLASSIFIED INFORMATION (CUI):

In addition to classified information, certain types of unclassified information also require application of access and distribution controls and protective measures for a variety of reasons.

In accordance with Reference DoDI 5200.48, such information is referred to collectively as CUI.

DoDI 5200.48 identifies the controls and protective measures developed for DoD CUI, Law

Enforcement Sensitive (LES), DoD Unclassified Nuclear Information (DoD UCNI), and Limited

Distribution) as well as some of those developed by other Executive Branch agencies.

2. CUI MARKINGS:

a. The CUI marking is assigned to information at the time of its creation by a DoD User

Agency. It is not authorized as a substitute for a security classification marking, but is used on official government information that may be withheld from the public under exemptions

2 through 9 of the Freedom of Information Act (FOIA) and an agency's Critical Information

Indicators List (CIIL) referred to as OPSEC information.

b. Use of the above markings does not mean that the information cannot be released to the public, only that it must…