ATCH 02 - DD254.pdf

CLASSIFICATION (When filled in): Unclassified

PREVIOUS EDITION IS OBSOLETE. Page 1 of 10

AEM LiveCycle Designer DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE. Page 1 of 10

AEM LiveCycle Designer

DD FORM 254, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED (See Instructions)

Top Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

Secret

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

a. NAME, ADDRESS, AND ZIP CODE

N/A

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

a. LOCATION(S) (For actual performance, see instructions.)

4th Space Operations Squadron (4 SOPS) 300 O'Malley Ave, Suite #53 Schriever AFB, CO 80912-4047 See Attachment Reference Block 8

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

P-S GAR/IP (Schriever) 210 Falcon Parkway, Ste 2101, Schriever AFB CO 80912-2101 719-567-5698

a. LOCATION(S) (For actual performance, see instructions.)

Peterson AFB 1050 E. Stewart Avenue, Bldg 2025 Peterson AFB, CO 80914-2902

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

P-S GAR/IP (Peterson) 135 Dover Street, Ste. 1055 Peterson AFB, CO 80914-1159 719-556-4670

PREVIOUS EDITION IS OBSOLETE. Page 2 of 10

AEM LiveCycle Designer DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE. Page 2 of 10

AEM LiveCycle Designer

DD FORM 254, APR 2018

a. LOCATION(S) (For actual performance, see instructions.)

Vandenberg Tracking Station (BSOC-V) Bishop Road, Bldg 23229, Room 1 Vandenberg, Air Force Base, CA 93437

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

Industrial Security Representative 30th Space Wing 11777 California Blvd Vandenberg AFB, CA 93437

a. LOCATION(S) (For actual performance, see instructions.)

Schriever AFB, Bldg 400 400 Discovered St.

Schriever AFB CO, 80912-3062

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

P-S GAR/IP (Schriever) 210 Falcon Parkway, Ste 2101, Schriever AFB CO 80912-2101 719-567-5698

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

Command and Control System – Consolidated (CCS-C) Sustainment and Resiliency (C-SAR)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA

g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.)

h. FOREIGN GOVERMENT INFORMATION

d. FORMERLY RESTRICTED DATA

i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

Contractor to be in compliance with Public Key Infrastructure

(2) Non-SCI (PKI)

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

See Block 13

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

PREVIOUS EDITION IS OBSOLETE. Page 3 of 10

AEM LiveCycle Designer DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE. Page 3 of 10

AEM LiveCycle Designer

DD FORM 254, APR 2018

DIRECT THROUGH (Specify below)

Information requiring AF/DoD-level reviews will be forwarded by the entry level public affairs office thru MAJCOM/DRU PA Office

Public Release Authority:

SECAF, Office of Public Affairs, Security & Review Division (SAF/PAX),1670 Air Force Pentagon, Washington DC 20330-1670

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

Ref. 10a: If the contractor is authorized to receive Government furnished cryptographic equipment, the guidance will state that fact. Access to classified COMSEC information requires a final U.S. Government clearance at the appropriate level. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires approval of the GCA. Non-accountable COMSEC information, though not tracked in the COMSEC material control system, may still require a level of control within a document control system. Refer to NSA/CSS Manual 3-16, “Control of Communications Security Material,” and the Committee on National Security Systems Instruction (CNSSI) 4001, “Controlled Cryptographic Blocks,” for guidance. If access to COMSEC information is required at Government facilities, or the material is under Government control, contractor personnel will follow the security requirements of the host government activity. AFMAN 17-1302-0, Communications Security (COMSEC) Operations, 2 Apr 20 and MPTO 00-33B-5001, AF Accounting COMSEC Procedures.

Ref 10b: Access to RESTRICTED DATA requires a final U.S. Government clearance at the appropriate level.

Ref. 10c: GCA approval is required prior to granting CNWDI access to a subcontractor. Special briefings and procedures are also required.

Access to CNWDI requires a final U.S. Government clearance at the appropriate level.

Ref. 10e(l) Sensitive Compartmented Information (SCI): See SCI Addendum. See SCI Addendum.

Ref. 10e(2) Non-SCI

The contractor shall handle Non-SCI or "collateral" intelligence information IA W Chapter 9, Section 3 of NISPOM and CUI DoDI

5200.48 Information Security Program. Particular emphasis is placed on the contractor(s) correctly understanding and heeding intelligence portion markings. As classified material, the contractor shall afford collateral intelligence information the same protections, safeguards, and precautions required by any classified material required by CUI DoDI 5200.48, unless special intelligence related handling instructions are specifically imposed. The Contractor shall neither disclose nor release intelligence derived information, whether its status is collateral or SCI, without the prior consent of SMC/IN.

Ref 10e (1)&(2): This contract requires access to Sensitive Compartmented Information (SCI). Per listed guidance below provides the necessary guidance for physical, personnel, information and information systems security measures and is part of the SCI security specifications for the contract.

1. Name, organization, telephone number and address of the Contract Officer Representative (COR) for the SCI portion of this contract will be appointed in writing in a separate memorandum.

2 All DD Form 254s prepared for subcontracts involving access to SCI under this contract must be forwarded to the COR for approval and then to SMC/AC INS SSO for review and concurrence prior to award of the contract. Inquiries pertaining to classification guidance on SCI will be directed to the COR listed in para. 2 above. SCI security management issues shall be directed to SMC/AC INS SSO, Com: (310) 4805/4528/4532/4512/4122, smc.ins.sso@us.af.mil

3. SCI access is subject to U.S. Government review and approval as outlined in the aforementioned SCI security guidance. Upon completion or cancellation of the contract, the SSO/CSSO will debrief all personnel not required for contract closeout and those positions will be disestablished.

4. Names of contractor personnel requiring access to SCI and justification for SCI access will be submitted for coordination and action to SMC/AC INS SSO after the COR’s approval/concurrence. Upon receipt of written approval from the COR, the Facility Security Officer (FSO) and/or Contractor Special Security Officer (CSSO) may submit the necessary forms to the Defense Counterintelligence and Security Agency (DCSA) for a Tier 5 (T5) or Tier 5R (T5R) investigation for those personnel nominated for SCI in accordance with the National Industrial Security Program Operating Manual (NISPOM).

5. The SSO/CSSO can grant access to only those who possess the necessary security clearance and who are actually providing services under the contract. Further dissemination to other contractors, sub-contractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the releasing agency.

6. SCI materials furnished in support of this contract remains the property of the DoD department or command that released it. Upon completion or cancellation of the contract, all SCI materials furnished will be returned to the direct custody of the originator of the materials.

7. Classified foreign intelligence materials must not be released to foreign nationals or immigrant aliens whether or not they are also

PREVIOUS EDITION IS OBSOLETE. Page 4 of 10

AEM LiveCycle Designer

DD FORM 254, APR 2018

consultants, U.S. contractors, or employees of the contractor regardless of the level of their security clearance, except with advance written permission from the originator.

8. Contractor personnel must maintain accountability for all intelligence (to include foreign intelligence) materials released to their custody.

9. Contractor personnel must not reproduce classified foreign intelligence without advance approval of the releasing agency. If permission is granted, each copy will be controlled in the same manner as the original. The CSSO must not destroy any classified foreign intelligence without advance approval of the releasing agency.

10. Visits. The contractor will submit the written request for SCI visit certifications through the COR for approval of the visit. The certification must arrive at SMC/AC INS SSO at least five working days prior to the visit.

11. Information assurance and electronic processing; information security (computer) and network connectivity require accreditation of the equipment connectivity.

Ref 10g: "Special briefing are required for access to NATO IAW AFI 16-1404, Air Force Information Security Program. Prior approval of the contracting activity is required for subcontracting. Access to classified NATO information requires a final U.S. Government clearance at the appropriate level."

Ref. l0j: Controlled Unclassified Information (CUI) provided under this contract shall be managed and safeguarded IAW DoDI 5200.48, Controlled Unclassified Information (CUI).

CUI DoDI 5200.48 Guidance in accordance with Security Classification Guide's (SCG's).

CUI DoDI 5200.48 information will be handled as follows:

CUI DoDI 5200.48 information provided under this contract shall be managed and safeguarded IAW DoDI 5200.48, Controlled Unclassified Information (CUI) and DoD 5400.7-R, DoD Freedom of Information Act (FOIA).

Ref. 10k: Public Key Infrastructure (PKI)

A PKI enables users of an unsecured public network such as the Internet to securely and privately exchange data through the use of a public and a private cryptographic key pair that is obtained and shared through a trusted authority. The public key infrastructure assumes the use of public key cryptography, which is the most common method on the Internet for authenticating a message sender or encrypting a message.

Ref 11c: Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware. All classified information received or generated will be properly stored and handled according to the markings on the material.

All classified information received or generated is the property of the U.S. government. At the termination or expiration of this contract, the U.S. government will be contacted for proper disposition instructions. The contractor will abide by the following security classification guidance:

A. Security Guidance for this effort is governed by the combined Milstar / Advanced Extremely High Frequency (AEHF) Security Classification/ Declassification Guide (SCG), CUI DoDI 5200.48, Revision A, Dated 14 August 2009, The Wideband Satellite Communications (SATCOM) Security Classification Guide (U)-J661 19 June 2015, Air Force Satellite Control Network (AFSCN), Dated 12 February 2016, CPASC DD254 PCO Delegation Letter, Dated 9 Dec 2020, and Atch 1 Statement of Work. For any conflicts, challenges and/or questions regarding this guidance contact SMC/MC Security, 483 N. Aviation Blvd., El Segundo, CA 90245.

B. The contractor shall protect Critical Program Information (CPI), technologies, and systems, when identified in the AEHF, CCS-C, and WGS Program Protection Plan (PPP). Physical protection level of CPI/CC is referenced in the IAW NISPOM requirements. CPI/CC maintained in electronic or printed form will be protected as CUI unless otherwise directed in the PPP and SCG. The contractor will develop a program protection implementation plan (PPIP).

Ref 11d: At Actual Performance Locations Only The Contractor is required to provide storage to the level of SECRET for classified hardware that, due to size or quantity, cannot otherwise be safeguarded in GSA approved storage containers. Contractor is required to comply with the NISPOM

Ref 11g: The sponsoring GCA must submit the DD Form 1540, “Registration for Scientific and Technical Information Services” to DTIC on behalf of the contractor. For subcontractors, the prime contractor submits the DD Form 2540, “Registration for Scientific and Technical Information Services” with the GCA verifying the need to know.

Ref. 11h: NSA account will be established for and maintained by contractor IAW NSA/CSS Manual 3-16. The Contractor will comply with the additional security requirements and the management of NSA information/material as defined in the manual.

PREVIOUS EDITION IS OBSOLETE. Page 5 of 10

AEM LiveCycle Designer

DD FORM 254, APR 2018

Ref 11j: The contractor shall comply with OPSEC requirements referencing AFI 10-701 Operations Security (OPSEC) and AFI 35-102 Security and Policy Review Process for guidance and/or direction. The contractor shall adhere to OPSEC guidance and be familiar with the organization’s/weapon’s system Critical Information and Indicator List (CIIL) and ensure indicators & vulnerabilities are protected from disclosure per organization’s/weapon’s system countermeasures/measures. The contractor shall complete OPSEC in-processing/initial training to include follow on OPSEC training such as event-driven and annual OPSEC training as required. OPSEC training will be provided by the respective unit OPSEC Program Manager (PM)/Planner/Coordinator. To obtain OPSEC training or ask OPSEC related questions contact the respective unit OPSEC PM/Planner/Coordinator. The AFSPC OPSEC PM/Planner can be reached over respective automated-information systems. The following link contains OPSEC POCs for each unit: https://cs2.eis.af.mil/sites/12638/IO/Lists/AFSPC %20OPSEC%20PMs%20and%20Signature%20Managers/Web%20View.aspx. The contractor is not responsible to develop an OPSEC plan.

Ref 11l: DFARs clause 252.204-7000, DISCLOSURE OF INFORMATION (OCT 2016)

(a) The Contractor shall not release to anyone outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless—

(1) The Contracting Officer has given prior written approval;

(2) The information is otherwise in the public domain before the date of release; or

(3) The information results from or arises during the performance of a project that involves no covered defense information (as defined in the clause at DFARS 252.204-7012) and has been scoped and negotiated by the contracting activity with the contractor and research performer and determined in writing by the contracting officer to be fundamental research (which by definition cannot involve any covered defense information), in accordance with National Security Decision Directive 189, National Policy on the Transfer of Scientific, Technical and Engineering Information, in effect on the date of contract award and the Under Secretary of Defense (Acquisition, Technology, and Logistics) memoranda on Fundamental Research, dated May 24, 2010, and on Contracted Fundamental Research, dated June 26, 2008 (available at DFARS PGI 204.4).

(b) Requests for approval under paragraph (a)(1) shall identify the specific information to be released, the medium to be used, and the purpose for the release. The Contractor shall submit its request to the Contracting Officer at least 10 business days before the proposed date for release.

(c) The Contractor agrees to include a similar requirement, including this paragraph (c), in each subcontract under this contract.

Subcontractors shall submit requests for authorization to release through the prime contractor to the Contracting Officer.

Ref. 11m (Other): Have access to DoD PKI sites, Restrictions on Personal Electronic Devices and Authorized unclassified Automated Information System processing with DoD unclassified National Security Information. For the contractor to acquire a Secret Internet Protocol Router Network (SIPR), the contractor will comply with all of the following Cyber Security requirements below. Contractor will also follow the NISP SIPRNet Circuit Approval Process (NSCAP). The NSCAP is based upon established policy and guidance for Non- DoD DISN connections as documented in the DISA Connection Process Guide (CPG).

Executive Order 12333 – United States Intelligence Activities (AMENDED by EO 13470, 2008) Executive Order 13526 – Classified National Security Information (2009 December 29) {replaced EO 12958} ICD 503 - Information Technology Systems (2008 September 15) ICD 704 - Personnel Security (2008 October 01) and ICPG 704.2 (2008 October 02) ICD 705 Physical Security (2010 May 26) and ICS/Tech Specs 705 Ver. 1.5 (2020 March 13) DCID 1/20P – Policies for Personnel with Access to SCI (1991 December 29) DCID 6/1 – Security Policy for Sensitive Compartmented Information and Security Policy DCID 6/9 - Physical Security (for facilities accredited under 6/9 standards) DoDM 5105.21 V1, V2, V3 - SCI Administrative Security Manual(s) DoDM 5200.01 V1, V2, V3, V4 – DoD Information Security Manual(s) DoDM 5200.02 - DoD Personnel Security Program (PSP) (2020 September 24) DoDM 5220.22 Volume 2 – National Industrial Security Program (NISP) (2018 August 1) AFMAN 14-403 - Security, Use, and Dissemination of SCI (2019 September 3) AFMAN 16-1405 – Air Force Personnel Security Program (2018 August 31) AFI 16-1404 – Air Force Information Security Program (2020 July 13) AFI 16-1406 – Air Force Industrial Security Program (2017 February 13) SMC/IN SSO Handbook DIAM 50-4 - Defense Intelligence Agency Manual (1980 June 24) NISPOM Supplement NIST 800-53 Rev 4 (April 2013)

(1) For All Unclassified Automated Information Systems (AIS) processing, storing, displaying, or transmitting unclassified Government National Security Information (NSI) supporting SMC/MC, the contractor shall submit to SMC/MCOS a high-level Concept of Operation-

PREVIOUS EDITION IS OBSOLETE. Page 6 of 10

AEM LiveCycle Designer

DD FORM 254, APR 2018

(CONOPS) (1-2 pages) that all due diligence and acceptable industrial security tools and techniques to provide availability of the those AIS and to ensure the integrity and confidentiality of information, and the authentication and non-repudiation of parties in electronic transactions. Contractors must address information safeguards as required in DoDI 8582.0,1 Security of Unclassified DOD Information on Non-DOD Information Systems.

(2) Organizations that require access to DoD website will be required to be Public Key Infrastructure (PKI) compliant. DoD approved commercial certificates for their users requiring access to DoD websites can be obtained from: http://iase.disa.mil/pki/ecalindex.html

(3) The use of personal devices for processing MILSATCOM information is prohibited. No personal computer, PDA, cell phone or other electronic device shall be used to receive, generate or process US Government information belonging to, generated for or otherwise delivered to or incorporated into MILSATCOM information. E.g. Individual has their personal device connected to the contractors internal WAN or LAN to receive or otherwise process email, calendar, documents. If this becomes a necessity SMC/MCO IT and Security must approve. In the event of approval, a written agreement between the FSO, Employee and SMC/MCO IT and Security must be generated outlining the personal device must be surrendered to the GCA/CSA for inspection and up to destruction upon GCA/CSA request.

(4) The trusted download procedure enables the contractor to extract both classified and unclassified information from a data repository classified as SECRET RD. The download procedure must be approved by DSS. As required by DSS, the government accepts the level of risk associated with the use of this procedure.

Ref 12: Contractor is to submit requests through the GCA for OPSEC Program Manager review and public release authorization. The GCA will provide the contractor with written approval/disapproval. Information requiring AF or DoD-level review will be reviewed by the unit’s OPSEC Program Manager or Coordinator who will in-turn forward to the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690.

SMC/PAO

483 N. Aviation Boulevard El Segundo, CA 90245-2808

Ref 13: Review of this DD Form 254 is required biannually.

Responsible Agencies:

SMC/ECPMDC, Peterson AFB, CO 4 SOPS/MA, Schriever AFB, CO

A. Security Guidance for this effort is governed by the combined Milstar / Advanced Extremely High Frequency (AEHF) Security Classification/ Declassification Guide (SCG), CUI DoDI 5200.48, Revision A, Dated 14 August 2009, The Wideband Satellite Communications (SATCOM) Security Classification Guide (U)-J661 19 June 2015, Air Force Satellite Control Network (AFSCN), Dated 12 February 2016, CPASC DD254 PCO Delegation Letter, Dated 9 Dec 2020, and Atch 1 Statement of Work. For any conflicts, challenges and/or questions regarding this guidance contact SMC/MC Security, 483 N. Aviation Blvd., El Segundo, CA 90245.

B. The contractor shall protect Critical Program Information (CPI), technologies, and systems, when identified in the AEHF, CCS-C, and WGS Program Protection Plan (PPP). Physical protection level of CPI/CC is referenced in the IAW NISPOM requirements. CPI/CC maintained in electronic or printed form will be protected unless otherwise directed in the PPP and SCG. The contractor will develop a program protection implementation plan (PPIP).

List of Attachments [2] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

CSAR Draft DD254 Delegation Memo.docx SMC SCI Addendum V5.0 for DD Form 254 7 May 2021 Draft.pdf

NAME & TITLE OF REVIEWING OFFICIAL

Stacy A. Jeffrey, NH-03, DAF Logistics Management Specialist

SIGNATURE

JEFFREY.STAC

Y.A.1289373388

Digitally signed by

JEFFREY.STACY.A.1289373388

Date: 2021.05.21 12:03:29 -06'00'

PREVIOUS EDITION IS OBSOLETE. Page 7 of 10

AEM LiveCycle Designer

DD FORM 254, APR 2018

NAME & TITLE OF REVIEWING OFFICIAL

Julie K. Boyatt, GS-11, DAF SMC/EP Security Manager

SIGNATURE

NAME & TITLE OF REVIEWING OFFICIAL

David Callahan GS-12, DAF 21 CS COMSEC Manager

SIGNATURE

NAME & TITLE OF REVIEWING OFFICIAL

Robert C. Larsen Jr., GS-13, DAFC, P-S GAR/IP (Peterson), Chief, Information

Protection

SIGNATURE

NAME & TITLE OF REVIEWING OFFICIAL

Sharon Jones, GG14, DAFC

SMC/AC INS SSO

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

Visitor Group contractors (both prime and subcontractors) performing collateral duties are required to notify the P-S GAR/IP (Peterson) of their presence on the installation and provide all information requested per the Notification of Government Security Activity Clause and Security Agreements Clause - AFFAR 5352.204-9000, and AFMAN 16-1406, Vol 2, National Industrial Security Program: Industrial Security Procedures for Government Activities, to the P-S GAR/IP (Peterson), Phone # (719) 556-4670. Refer to the contract document for these clauses. Visitor group security agreements are no longer required. Shipments of classified or sensitive equipment shall be handled, transported, transmitted and protected IAW NISPOM, DoD 5220.22M and as specified by unit directives.

Provide the information requested by AFFARS 5352.204-9000, Notification of Government Security Activity Clause, and AFI 16-1406, Air Force Industrial Security Program, to the Industrial Security office. Refer to the contract document for these clauses. Shipments of classified or sensitive equipment shall be handled, transported, transmitted and protected IAW NISPOM, DoD 5220.22M and as specified by unit directives.

Contract End Date: This contract requires access to Sensitive Compartmented Information (SCI) facilities at government locations to provide user integration support due to unavoidable proximate access to SCI materials inside SCI facilities. Actual knowledge of, generation, receipt or storage of SCI material is not required at the Contractor's facility. The contractor shall nominate a CSSO to SMC/AC INS SSO, LA AFB, CA. At a minimum, the letter should contain the CSSO name, phone number, email address, mailing address, contract name and number.

This contract requires fifteen (15) SCI billets at government and approved and established contractor facilities. Provide information requested by the Notification of Government Security Activity Clause and Visitor Group Security Agreements, AFFARS 5352.204-9000 to the Information Security Program Manager (ISPM) addressed in block 17 of this form. Refer to the contract document for these clauses. In addition, the contractor shall comply with Air Force Instruction (AFI) 10-1102, dated 15 Jul 02, safeguarding the Single Integrated Operation Plan (SIOP), when access to NC2 at Government facilities is required.

The Contractor shall be debriefed of SCI indoctrination when SCI is no longer required; leaves the Contract prior to the end of the Period of Performance (PoP) or at the contract end date.

No contractor will be granted access to SCI information/material under this contract unless they are filling an SMC/ECPMDC SCI billet assigned under this contract. A billet request letter shall be completed by the contractor and submitted for approval via the government program office sponsoring the contract, who will approve and submit the request. A Letter of Consent (LOC) from the contractor Facility Security Officer (FSO) for each billet nominee must accompany the billet request letter to verify the clearances. The contractor shall establish and maintain a current billet roster indicating access of SCI personnel on this contract.

A copy of this list shall be provided to Milsatcom annually or as changes occur. The contractor shall also advise SMC/ECPMDC immediately upon the reassignment of personnel to duties not associated with this contract, to include termination. All issues regarding the SCI portion of this contract shall be addressed to SMC/ECPMDC.

A VGSA is no longer required, if the organization requires the contractor to follow internal security practices e.g. end of day checks, the organization provides the contractor with the guidance e.g. checklist and operating instruction. Unit security manager/assistant tracks that guidance that is provided.

BOYATT.JULIE.

KAY.1106965745

Digitally signed by

BOYATT.JULIE.KAY.11069657

Date: 2021.05.21 12:29:07 -06'00'

CALLAHAN.DAV

ID.M.1015814329

Digitally signed by

CALLAHAN.DAVID.M.1015814

Date: 2021.05.21 12:37:48 -06'00'

LARSEN.ROBERT.CH

ARLES.JR.1168338887

Digitally signed by

LARSEN.ROBERT.CHARLES.J

R.1168338887 Date: 2021.05.24 08:37:51 -06'00'

JONES.SHARO

N.M.1291971195

Digitally signed by

JONES.SHARON.M.1291971195

Date: 2021.06.01 09:59:50 -07'00'

PREVIOUS EDITION IS OBSOLETE. Page 8 of 10

AEM LiveCycle Designer

DD FORM 254, APR 2018

The contractor may be required to produce or receive SCI data under this contract. However, several of the billets only require access to government facilities to perform their functions; for example, a significant portion of the user integration organizational unit coordination and support executed will be used to perform SCI contractual requirements at properly accredited facilities.

In addition to the previously outlined security guidance for SI and/or TK access the following manuals must be followed for access, handling, and control of Sensitive Compartmented Information:

a. ICD 705, Physical Security (for facilities accredited under 6/9 standards)

b. DoD 5105.21Vl, V2, V3, SCI Administrative Security Manual(s)

c. AFMAN 14-304, Security, Use and Dissemination of SCI

d. ICD 503 - Information Systems

e. ICD and ICPGs 704 - Personnel Security

f. ICD and ICS/Tech Specs 705 - Physical Security

g. JDCSISSS - Joint DoDIIS Cryptologic SCI Information Systems Security Standards

h. DJSIG - Department of Defense Intelligence Information System (DoDIIS) Joint Security Implementation Guide (appendix C & D only)

i. DIAM 50-4 - Defense Intelligence Agency Manual

Names of contractor personnel requiring access to SCI will be submitted to the SCI Contract Monitor. Forms requesting Single Scope Background Investigations will be prepared in accordance with the NISPOM and submitted to Defense Security Service (DSS). The contractor will establish and maintain a current access list of those employees working on this contract. A copy of this list will be furnished to the Contract Monitor. The contractor will advise the SCI Contract Monitor immediately upon reassignment of personnel to other duties not associated with this contract. Inquiries pertaining to classification guidance on SCI will be directed to the Contract Monitor.

Names of contractor personnel requiring access to SCI will be submitted to the Contract Monitor. Forms requesting Special Background Investigations will be prepared in accordance with the NISPOM and submitted to the Defense Security Service (DSS).

The contractor will establish and maintain a current access list of those employees working on this contract. A copy of this list will be furnished to the SCI Contract Monitor. The contractor will advise the SCI Contract Monitor immediately upon reassignment of personnel to other duties not associated on this contract.

Release of Information. SCI with restrictive caveats (e.g., ORCON, PROPIN, etc.) will be released to contractors only when originator approval has been obtained. The contractor will control SCI, which has been originated or obtained under this contract as follows: The contractor may release such material to any contractor employee working against a billet under this contract only when a need-to-know exists. The contractor will release such material to any Special Security Office personnel assigned to HQ AFSPC or DIA upon demand by such personnel. The contractor may release such material to any other personnel including contractor and subcontractor employees, and employees of any Federal Government agency, only upon prior written approval from the SCI Contract Monitor. An access certification to an AFSPC contractor occupied SCIF does not constitute approval to release AFSPC contractual material to these other personnel; Contract Monitor approval is nevertheless required. Contract Monitor approval of an AFSPC contractor visit certification or permanent certification to another facility will constitute approval to discuss contractual material at facility to be visited.

Any SCI released to the contractor in support of this contract remains property of DoD, agency, or command that releases it. The contractor will maintain active accountability of all SCI released to his/her custody, regardless of whether the release is within a contractor or US government SCIF. Upon completion/cancellation of the contract, the contractor must return all such material to the LA AFB SSO unless a follow-on contract specifies that the material will transfer to a subsequent contract. SCI inventories will be conducted IAW DIA Manual 50-5 and AFMAN 14-304.

Contractor Special Security Officers (CSSOs) must coordinate with the SCI Contract Monitor and obtain the concurrence of SSO SMC/AC INS SSO, prior to subcontracting any portion of SCI efforts involved in this contract."

No contractor personnel will be granted access to SCI material under this contract unless they are filling a DoD SCI billet. The contractor will coordinate with SCI Contract Monitor to ensure adequate billets are requested under this contract. Multiple contract employees sponsored by the organizations other than Space Command must be certified to SSO SMC/AC INS for use on the contract."

Contractor will not use references to SCI accesses, even by unclassified acronyms, in advertising, promotional efforts, or recruitment for employees.

The following activity is designated as the User Agency Special Security Office for SCI requirements IAW DoD 5105.21m_ voll/2/3:

1. SMC/AC INS SSO, LA AFB, CA 80914-4311.

2. JFCC Global Strike/J-3, Offutt AFB, NE 68113-2124

PREVIOUS EDITION IS OBSOLETE. Page 9 of 10

AEM LiveCycle Designer

DD FORM 254, APR 2018

In addition, contractors, while on Government/Military installations, will comply with base organizational security and/or protection requirements.

ADDITIONAL CONDITIONS:

COMSEC information not specifically covered by these guidelines must be safeguarded and controlled in accordance with department or agency directives for safeguarding and handling other U.S. Government information of the same classification. Situations, which are not addressed in these guidelines, will be reviewed on a case-by-case basis.

Committee on National Security Systems Instruction (CNSSI) No.4009, National Information Assurance Glossary, dated 26 April 2010.

The National Security Telecommunications and Information Systems Security Instruction, (NSTISSI) No. 4005, Safeguarding COMSEC Facilities and Material, 22 August 2011.

The National Security Telecommunications and Information Systems Security Committee (NSTISSC) 003-98 Subject: Amendment to NSTISSI 4005 Safeguarding COMSEC Facilities and Material.

UIC Security Definition Process (USDP), Section 8, 2.1 and Section 0.3.2 National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-M, 28 February 2006.

National Security Agency Control of Communications Security (COMSEC) Material, NSA/CCS Policy Manual 3-16, August 2005.

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

Defense Counterintelligence and Security Agency (DCSA) is relieved of inspection responsibility for all classified material that is released to or developed by the contractor while on a military installation. DCSA retains inspection responsibility for all non-SCI classified material released to or developed by the contractor and held in the contractor’s facility. The SSO maintains inspection responsibility for all SCI material related to this contract. Peterson-Schriever Garrison Information Protection Staff (Peterson) is designated as a member of the P-S GAR (Peterson) Inspection team and has inspection authority when assigned under P-S Gar IG (Peterson). HQ USSF/A2 retains security cognizance of all Intelligence materials released to the contractor.

Contractors, while on Government / Military installations will comply with Base organizational security and/or protection requirements. The Defense Security Service is relieved of inspection responsibility while on a Government / Military installation, unless requested. Local Information Security assessments while operating on an Air Force installation, shall be conducted by the servicing IPO. See attached SCI addendum V4.0

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

SMC/PKL

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

FA8823

c. ADDRESS (Include ZIP Code)

1050 East Stewart Ave, Bldg 2025 Peterson Air Force Base, CO 80914-2092

d. POC NAME

Crystal L. Price, NH-03

e. POC TELEPHONE (Include Area Code)

+1 (719) 556-2469

f. EMAIL ADDRESS (See Instructions) crystal.price.6@us.af.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

Brackett, Paula C.

b. TITLE

Program Manager

c. ADDRESS (Include ZIP Code)

1050 East Stewart Ave, Bldg 2025 Peterson Air Force Base, CO 80914-2092

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

FA8823

e. CAGE CODE OF THE PRIME CONTRACTOR (See Instructions.)

1TJ01

f. TELEPHONE (Include Area Code)

+1 (719) 556-3101

g. EMAIL ADDRESS (See Instructions) paula.brackett.1@spaceforce.mil

h. SIGNATURE

i. DATE SIGNED (See Instructions)

BRACKET

T.PAULA.

COFFEY.1

005796977

Digitally signed by

BRACKETT.PA

ULA.COFFEY.1

005796977 Date: 2021.06.03 10:56:15 -06'00'

PREVIOUS EDITION IS OBSOLETE. Page 10 of 10

AEM LiveCycle Designer

DD FORM 254, APR 2018

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

P-S GAR/IP (Peterson) P-S GAR/IP (Schriever)

SMC/AC INS SSO, LA AFB, CA