Atch 4 Continuation DD Form 254 2023.docx CUI.pdf

DD Form 254 – Item 13 Continuation Page Solicitation Number:

Contract Number:

Current Version Date: 20221101 Page 1 of 13

All item checked "YES", will apply to this effort. Add any additional requirements may be added in the "Remarks" section if necessary. Items that are checked "NO", add the statement, "NOT APPLICABLE TO THIS EFFORT".

YES NO Requirements

YES NO

4. Follow-on contract. The classified portion of work has been completed on the contract cited in this item. The processing of classified will no longer be done under this contract. All classified material/information associated with this contract is authorized to be transferred to the contract number cited in Item 2a.

Remarks:

YES NO

8. Actual Places of Performance. Reference Item 8 of the DD FORM 254 for actual places of performance. Specific remarks regarding those locations are found below and/or places of performance are duplicated.

Remarks:

YES NO

10a. Communication Security (COMSEC) Information. Access to COMSEC material is required in the performance of this contract. Access to COMSEC requires a final clearance. The contractor may be authorized to receive government furnished cryptographic equipment, if a COMSEC account is required and if Item 11h of this DD Form 254 is checked. Contractor personnel are subject to The Department of Army Cryptographic Access Program (DACAP), IAW AR 380-40. The contractor shall comply with NSA/CSA Manual 3- 16, AR 380-40, and the Committee of National Security Systems Instructions (CNSSI) 4001, “Control of Communications Security Material,” or other guidance provided by the central office of record. If access to COMSEC information is required at Government facilities, contractor shall adhere to the government COMSEC plan or guidance. Approval by the KO/COR is required prior to transporting or carrying classified COMSEC material on a cleared commercial carrier or passenger aircraft. The government project manager shall designate the number of personnel requiring cryptographic (CRYPTO) access. Approval by the KO is required prior to the flow down of COMSEC requirements to any subcontractor.

Remarks:

YES NO

10b. Restricted Data. Contractor requires access to Restricted Data per the PWS. Refer to 10 CFR 1045 “Nuclear Classification and Declassification” and Atomic Energy Act of 1954, as amended, for further information. Approval by the KO is required prior to the flow down of Restricted Data requirements to any subcontractor.

Remarks:

Contract Number:

Current Version Date: 20221101 Page 2 of 13

YES NO Requirements

YES NO

10c. Critical Nuclear Weapon Design Information (CNWDI). Contractor requires access to Critical Nuclear Weapons Design Information. Special briefings and procedures are required.

Approval by the KO is required prior to the flow down of CNWDI requirements to any subcontractor.

Remarks:

YES NO

10d. Formerly Restricted Data. Contractor requires access to Formerly Restricted Data (FRD) per the PWS, SOW, or SOO.

Remarks:

YES NO

10e(1). Sensitive Compartmented Information (SCI).

Access to Intelligence information that is Sensitive Compartmented Information (SCI) may be required in the performance of this contract. Refer to the SCI Addendum for additional guidance.

Contractors are required to complete SCI training requirements through COR approved appropriate training systems/databases (e.g., Total Employee Development (TED), Security Training, Education and Professionalization Portal (STEPP) https://cdse.usalearning.gov/enroll/index.php?id=350.

Only those personnel that require access to SCI information to complete their job duties will be provided SCI access. Approval by the KO is required prior to the flow down of SCI requirements to any subcontractor.

Remarks:

YES NO

10e(2). Non-Sensitive Compartmented Information (Non-SCI). Access to Intelligence information that is Non-SCI may be required in the performance of this contract. Approval by the KO is required prior to the flow down of Non-SCI requirements to any subcontractor.

Remarks:

susan.m.honeyman Cross-Out

Contract Number:

Current Version Date: 20221101 Page 3 of 13

YES NO Requirements

YES NO

10f. Special Access Programs (SAP). Contractor requires access to SAP. Information per the PWS, SOW, or SOO. Contractor will comply with DoDM 5205.07 (Volumes 1-4), AR 380-381, and requirements and directions provided by the Program Security Officer (PSO), name and contact information found below, or successor. Approval by the KO is required prior to the flow down of SAP requirements to any subcontractor. Requiring Activity’s (RA) PSO is required to provide the SAP Security Plan to contractors for adherence.

PSO Name (must be completed if 10f is checked YES:

PSO Contact Information (Phone and DISA Email):

Remarks

YES NO

10g. North Atlantic Treaty Organization (NATO). Contractor requires access to NATO Information per the PWS requires a final clearance. If contractor personnel require access to Secret Internet Protocol Router Network (SIPRNet) or Joint Worldwide Intelligence Communications Systems (JWICS), they must also be cleared at the NATO SECRET level. Approval by the KO is required prior to the flow down of NATO requirements to any subcontractor. Refer to item 13e for NATO training guidance.

Remarks:

YES NO

10h. Foreign Government Information (FGI). Contractor requires access to Foreign Government Information per the PWS, SOW, or SOO. FGI is classified information provide to the U.S. by a foreign government(s). Access to FGI requires final clearance.

Remarks:

YES NO

10i. Alternative Compensatory Control Measures (ACCM). Contractor requires access to ACCM Information.

Contract Number:

Current Version Date: 20221101 Page 4 of 13

YES NO Requirements

YES NO

10j. Controlled Unclassified Information (CUI). Access to CUI is required in the performance of this contract. Information designated as CUI, generated or provided under this contract shall be controlled, handled, stored, marked, safeguarded, transmitted, and destroyed IAW DoDI 5200.48, AR 380-5. Contractor and sub-contractor employees shall complete annual CUI training.

Remarks:

YES NO

10k. Security Classification Guides (SCG). SCGs associated with this effort are listed below by title, date, and office of primary responsibility per AR 380-49. Contractor will require access to all SCGs listed below:

Remarks:

1. ARCYBER SCG FOR CYBERSPACE OPERATIONS AND SECURITY, DATED 19 MAY 2016,

U.S. ARMY CYBER COMMAND AND SECOND ARMY, or most current SCG.

YES NO

10k. Secured Internet Protocol Network (SIPRNet). SIPRNet access is required for the performance of the contract. Requests for access will be submitted to COR to facilitate the local vetting and approval process. Contractor must follow appropriate processes for obtaining login credentials to SIPRNet. Contractor personnel must be cleared at the NATO SECRET level in order to obtain access to SIPRNet. If SIPRNet is required at contractor facility, the FSO shall coordinate with appropriate DCSA representatives. The contractor requires access to the Defense Information Systems Network (DISN) Secret Internet Protocol Routing Network (SIPRNet) security classification guide, dated 01 June 2013, or most current.

Contract Number:

Current Version Date: 20221101 Page 5 of 13

YES NO Requirements

YES NO

10k. JWICS. JWICS access is required for the execution of the contract. Requests for access will be submitted to COR to facilitate the vetting and approval process. Contractor must follow appropriate processes for obtaining login credentials to JWICS. Contractor personnel must be cleared at the NATO SECRET level in to obtain access to JWICS. If JWICS is required at contractor facilities, the contractor shall coordinate with the appropriate Special Security Officer (SSO) and/or Contractor Special Security Officer (CSSO). The Contractor requires access to the JWICS SCG, Defense Intelligence Agency, dated 29 September 2017, or most current.

Remarks:

YES NO

10k. NSANet. NSANet access is required for the execution of the contract. Requests for access will be submitted to COR to facilitate the vetting and approval process. For access to NSANet requires final clearance. Contractor must follow appropriate processes for obtaining login credentials.

Remarks:

YES NO

10k. Other.

Contract Number:

Current Version Date: 20221101 Page 6 of 13

YES NO Requirements

YES NO

11a. Have access to classified information only at another contractor’s facility or at a government activity. The contractor shall have access to classified information only at another contractor’s facility or at a government activity. If this item is checked, than safeguarding of classified is NONE and items 11b, 11c, 11d, 11h, or 11k do not apply to this effort.

Remarks:

YES NO

11b. Receive and store classified documents only. Contractor is authorized to receive classified documents only for purposes named in the remarks below. There will be no generation or derivative classification of material at the contractor facility. Special storage requirements are listed in remarks below. If this checked "YES", then Item 1b would be completed at the appropriate level and Items 11c,11d, 11h, 11i or 11k does not apply to this effort.

Remarks:

YES NO

11c. Receive, store, and generate classified information or material. Contractor is authorized to receive, store, and generate classified material at the contractor’s facility. Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware, reference item 10k. All classified information received or generated will be properly stored and handled according to the markings on the material. If this Item is checked "YES", then Ib would be completed at the appropriate level. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of this contract, the U.S.

Government will be contacted for proper disposition instructions.

Remarks:

YES NO

11d. Fabricate, modify, or store classified hardware. Contractor will fabricate, modify, or store classified hardware at their facility. A description of the area required to store such material and details regarding what the contractor will require, can be found in the remarks below. If this item is checked "YES", the 1b should be completed at the appropriate level.

Contract Number:

Current Version Date: 20221101 Page 7 of 13

YES NO

11e. Perform services only. Contractor will perform services only as described in the remarks below:

Remarks:

YES NO

11f. Have access to U.S. classified information outside the U.S., Puerto Rico, U.S.

Possessions, and Trust Territories. The contractor will have access to classified information at OCONUS locations. Refer to item 8a for a listing of OCONUS locations. RA is responsible for identifying security oversight for the OCONUS locations and ensuring compliance with Foreign Clearance Guide (https://www.fcg.pentagon.mil/fcg.cfm).

Remarks:

YES NO

11g. Be authorized to use the services of Defense Technical Information Center (DTIC) or other secondary distribution center. The contractor will prepare DD Form 1540, Registration for Scientific and Technical Information Services and DD Form 2345, Militarily Critical Technical Data Agreement, for authorized access to Defense Technical Information Center DTIC. Completed forms will be provided to the KO/COR for processing and submission to DTIC.

Remarks:

YES NO

11h. Require a COMSEC account. Contractor requires a COMSEC account. Access to COMSEC requires a final clearance. If this item is checked, then item 10a will be checked.

https://www.fcg.pentagon.mil/fcg.cfm

Contract Number:

Current Version Date: 20221101 Page 8 of 13

YES NO Requirements

YES NO

11i. Have a TEMPEST requirement. The contractor shall submit a TEMPEST countermeasure review (TCR) worksheet to the Army certified TEMPEST technical authority (CTTA) and coordinate with their Cognizant Security Agency (CSA) for CTTA TEMPEST countermeasure implementation IAW AR 380-27, paragraph 2-6g.

Remarks:

YES NO

11j. Have Operations Security (OPSEC) Requirements.

Refer to the AT/OPSEC to the PWS, SOO, or SOW for details on OPSEC requirements.

Remarks:

YES NO

11k. Be authorized to use Defense Courier Service (DCS). Contractor is authorized to use DCS.

The KO/COR will obtain written approval from the United States Transportation Command’s (USTRANSCOM) Defense Courier Division (TCJ3-C), Scott AFB, IL 62225-5357. Only certain classified information qualifies for shipment by DCS. If this item is checked "YES", then the item 1b must state something other than "NONE".

Contract Number:

Current Version Date: 20221101 Page 9 of 13

YES NO Requirements

YES NO

11l. Receive, store, or generate CUI. Contractor is authorized to receive, store, or generate CUI in the performance of this contract. Information designated as CUI, generated under this contract shall be controlled, handled, stored, marked, safeguarded, transmitted and destroyed IAW DoDM 5200.48, AR 380-5, and the following guidance:

Electronically transmitted CUI shall be sent via:

Emailing CUI between the Government and a Contractor: Digitally encrypted email can be accessed via DOD CAC or if the Contractor's company has the proper DOD-approved assurance certificates installed. For more details on DOD-approved assurance certificates visit https://public.cyber.mil/eca/.

Government SharePoint: Contractor must have a DOD CAC and access is based on the Government's approval.

DOD Safe (use email certification to enter site) - https://safe.app.mil/.

IntelDocs - https://inteldocs.intelink.gov/inteldocs.

CD/DVD: Save CUI-marked files to a CD/DVD and properly mail to recipient.

Fax: Send CUI-marked documents via facsimile machine to recipient.

The contractor may disseminate CUI information to their employees and subcontractors that have a need-to-know.

The contractor shall report the unauthorized disclosure of CUI to the COR.

Contractor and Sub-contractor employees shall complete annual CUI training at:

https://securityhub.usalearning.gov/index.html.

Remarks:

YES NO

11m. Other/IT sensitive duties required - Refer to Item 13 for IT requirements.

https://inteldocs.intelink.gov/inteldocs

Contract Number:

Current Version Date: 20221101 Page 10 of 13

YES NO Requirements

YES NO

12. Public Release. All requests for public release shall be submitted by the government COR utilizing the CECOM Public Release Approval System (PRAS) at:

https://pras.army.mil/PRAS/default.asp and/or through OPSEC Officer and Public Affairs Office (PAO) identified below:

OPSEC Officer and Contact Information (include phone, email, and mailing address):

PAO (include phone, email, and mailing address):

13a. Base Contract Only. Specific security requirements, e.g., SCG, place of performance, access, etc., are contingent upon each task order and shall be stipulated in the task order’s

DD254.

YES NO

13b. Network Privileged Access. Contractor personnel will hold a security clearance commensurate with the classification level of the Information Technology (IT) system granted access to. The Facility Security Officer will clear contractor personnel if privileged access investigation requirements do not exceed the clearance requirements listed on the DD Form 254, Item 1a. For situations requiring higher clearances than listed on the DD Form 254, item 1a the government security manager will initiate the requisite security investigation required by the Information System Security Manager/Officer. Detailed privileged users access can be referenced in AR 25-2, paragraph 2-38.

YES NO

13c. Spillages. Classified and covered defense information, as defined in DFARS 252.204-7012, information, will be protected IAW the NISPOM and DFARS 252.204-7012. All security and cyber incidents involving classified and covered defense information, e.g., spillage, shall be immediately reported to the RA Security Specialist and to their DSS Industrial Security Representative. A spillage occurs whenever or covered defense information is transferred onto an information system not authorized for the appropriate security level or exploited by external/malicious sources. Information will be forwarded to KO/COR and the Program Manager for a program damage assessment to be conducted IAW AR 380-49. Contractors responsible for a willful or negligent spillage of information shall pay enterprise service providers for the associated cleanup costs across the enterprise to restore the affected network or networks to a normal operating configuration.

YES NO

13d. PWS, SOW, or SOO. - The PWS, SOW, or SOO shall be provided to the contractor’s FSO and/or CSSO along with the DD Form 254 and associated Continuation Pages. This is to ensure that the FSO and/or CSSO are aware of all contractual requirements relating to security within the effort.

YES NO

https://pras.army.mil/PRAS/default.asp

Contract Number:

Current Version Date: 20221101 Page 11 of 13

YES NO Requirements

YES NO

13e. NATO Awareness Briefing. - All cleared contractor personnel shall obtain a NATO Security Awareness Briefing from their FSO and/or from their program security specialist.

Briefing can be found at the following CAC enabled link: https://www.dcse.edu.

YES NO

13f. OCONUS Travel. Contractors traveling to OCONUS locations for either official or unofficial travel may require a defensive counterintelligence briefing prior to their departure. Requirement for defensive travel brief will be based on threat and will remain at the discretion of the G2 and/or organization’s security manager.

YES NO

13g. Generation of classified material. - The generation of classified material includes derivatively classified information.

YES NO

13h. Security Trainings/Briefings. Several training requirements exist for contractor personnel per DoD and Army regulation/directives. On-site contractors may receive training briefs from the government appointed Security Manager; however, contracting companies will be required to provide training to off-site contractor employees. Training is tailored to the organization’s requirements as well as local policy and other approved government training. Some examples of Security training provided to integrated/embedded contractors may include, but is not limited to, the following:

Threat Awareness Reporting Program (required for all contractors with security clearances)

- Per AR 381-12 Threat Awareness and Reporting Program (TARP), cleared contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b.

Initial Security Orientation: Online training available on the Army Learning Management System (ALMS) site, reference ALARACT 207-2103 - Initial training

Annual Security Orientation: Online training available on the Army Learning Management System (ALMS) site, reference ALARACT 207-2103 - Annual training requirement

Derivative Classification Training, reference DoD 5200.01-V3- Annual training requirement Foreign travel training, AR 525-13 - Required when traveling abroad Department of the Army (DA), Army Material Command (AMC), and/or commander directed security stand-downs, e.g., ad-hoc refresher trainings.

http://www.cdse.edu/documents/toolkits-fsos/NATO%20Brief.pdf http://www.cdse.edu/documents/toolkits-fsos/NATO%20Brief.pdf

Contract Number:

Current Version Date: 20221101 Page 12 of 13

YES NO Requirements

YES NO

13i. Security Classification Guides. Per AR 380-49, the RA is required to identify by title, functional office of primary responsibility, and approval date, the SCGs applicable to the contract on the DD Form 254 within item 13.The requirement for SCG(s) must also be annotated on DD Form 254, block 10k. Due to the mission and its reimbursable nature, it is impossible to proactively identify all SCGs associated with contract efforts. However, upon identification, the RA shall immediately provide SCGs related to the classified information associated with the execution of this contract.

YES NO

13j. Individual Courier Card. Must have a need to know and approval from the COR prior to

Courier Cards being issued.

YES NO

13k. Additional Remarks not already addressed in items 1a – 13i of this Security Appendix.

Contract Number:

Current Version Date: 20221101 Page 13 of 13

Certification and Signature (ALWAYS REQUIRED - IF SCI CONTRACT, THE SCI CONTRACT, THE SCI CONTRACT MONITOR MUST ALSO SIGN) Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official(s) named below.

Signature block for COR and/or PM required.

COR SIGNATURE (ALWAYS REQUIRED) CM SIGNATURE (REQUIRED ON SCI CONTRACTS)

X X

NAME: NAME:

DATE: DATE:

TITLE: TITLE:

EMAIL: EMAIL:

PHONE: PHONE:

NOT APPLICABLE TO THIS EFFORT".

11 Hap Arnold Blvd.

Tobyhanna Pa 18466