Atch 7 - DD Form 254 Guidance.pdf

CONTINUATION PAGES, DD Form 254, From Attachment 4

ATTACHMENT 7

CONTINUATION – DD FORM 254

ITEM 13: Security Guidance Remarks:

The contractor requires access to classified source data up to and including TOP SECRET in support of the work effort.

Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of Multiple sources on the classified by line necessitates compliance with the NISPOM (or DoD 5200.1-R, Amendments identified in SECDEF Memo dated 16 April 2004, “Interim Information Security Guidance” addressing changes made by Executive Order 12958, “Classified National Security Information, and AFI 16-1404, Air Force Information Security Program, 29 May 2016, (if operating on an Air Force installation), and use of bibliography.

Applicable Security Classification Guides include the following (as amended):

DoD 5220.22-M, National Industrial Security Program Operating Manual DoDD 5220.22-R, Industrial Security Regulation DoD 5220.22-S, COMSEC supplement to the Industrial Security Manual DoDD 5230.9 Clearance of DOD Information for Public Release DODI S-3600.2 Information Operation Security Classification Guidance DoD 5105.21-M-1, Sensitive Compartmented Information Administrative Security Manual, Aug 1998 DoDD 5200.1, Information Security Program, Jan 1997 DoDD 5200.2, Personnel Security Program, Jan 1987 DoDD 5240.1, DoD Intelligence Activities, 25 Apr 1988 DoDD 5240.2, DoD Counter Intelligence (CI), 22 May 1997 DoDI 5240.6, Counterintelligence (CI) Awareness and Briefing Program, 16 Jul 1996 DoDI S-5240.9, Support to DoD Offensive Counterintelligence Operations (OFCO), 28 Nov 89 DoDI 5240.10, DoD Counterintelligence Support to Unified and Specified Commands, 18 May 1990 w/Change #1, 8 Apr 1992 DoDD 5105.67, DoD Counterintelligence Field Activity, 19 Feb 2002 DoDD O-8530.1, Computer Network Defense (CND), 8 Jan 2001 DoDI O-8530.2, Support to Computer Network Defense (CND), 9 Mar 2001 CJCS Notice 5114, Implementation of E.O. 12958 – Classified National Security Information CJCS Notice 5121, Implementation of E.O. 13142 – Amendment to E.O. 12958 – Classified National

Security Information CJCSI 3170.01B, Requirements Generation System, 15 Apr 2001 CJCSM 3213.02A, Joint Staff Focal Point Communications Procedures Manual, 31 Jan 97, CH 1 08 Aug

EAP CJCS Volume I, Appendix (Security Classification Guide), 1 Sep 04 CCJCSM 5222.01B, 28 Feb 2005, National Military Command System (NMCS) Security Classification

Manual CJCSI 3231.01A, 7 Jan 00, Safeguarding the Single Integrated Operational Plan (SIOP), OPR JS-J3 Air Force Instruction (AFI) 14-303, Release of Collateral Intelligence to U.S. Contractors AFI 10-701 Operation Security (OPSEC) AFI 16-1406, Air Force Industrial Security Program, 25 Aug 2015 Air Force Handbook (AFH) 31-602, Industrial Security Program, 1 Feb 97 DCID 1/7, Security Controls on the Dissemination of Intelligence Information, 30 Jun 1998 DCID 6/1, Security Policy for Sensitive Compartmented Information and Security Policy Manual DCID 6/4, Personnel Security Standards and Procedures for Governing Eligibility for Access to Sensitive

Compartmented Information (SCI), 13 Oct 1999, including Annexes A-F DCID 6/3, Protecting Sensitive Compartmented Information within Information Systems, 5 Jun 1999 DCID 6/5, Policy for protection of certain non-SCI Sources And Methods Information (SAMI), 12 Feb 2001

Executive Order 12333, United States Intelligence Activities, 4 Dec 1981, as amended 24 Jan 2003 Executive Order 12958, Classified National Security Information, 17 Apr 1995, as amended 25 Mar 2003 Executive Order 12968, Access to Classified Information, 4 Aug 1995 Executive Order 12972, Amendment to EO 12958, 19 Sep 1995 Executive Order 13231, Critical Infrastructure Protection in the Information Age, 16 Oct 2001 PDD-62, Combating Terrorism, 22 May 1998 PDD-63, Protecting America’s Critical Infrastructure, 22 May 1998 National Security Strategy National Military Strategy National Response Plan Defense Planning Guidance Unified Command Plan, 1 Oct 2002 Joint Planning Document Homeland Security Presidential Directive/HSPD-5, Management of Domestic Incidents, 28 Feb 2003 USA Patriot Act, 24 Oct 2001 National Strategy for the Physical Protection of Critical Infrastructure and Key Assets, Feb 2003 SECDEF message, DoD Intelligence and Law Enforcement Policy to Support the War on Terrorism and

Enhanced Domestic Force Protection, 4 Apr 2003 DEPSECDEF Memorandum, Collection, Reporting and Analysis of Terrorist Threats to DoD within the U.S., 2 May 2003 DEPSECDEF Memorandum, Implementation Guidance on Restructuring Defense Intelligence-and Related

Matters, 8 May 2003 DCI Memorandum, Homeland Security Information Sharing Memorandum of Understanding, 4 Mar 03 JP 1, Joint Warfare of the Armed Forces of the United States, 14 Nov 2000 JP 2-0, Doctrine for Intelligence Support to Joint Operations, 9 Mar 2000 JP 2-01.2, Joint Doctrine and Tactics, Techniques and Procedures for Counterintelligence Support to

Operations, 7 May 2002 JP 3-0, Doctrine for Joint Operations, 10 Sep 2001 JP 5-0, Doctrine for Planning Joint Operations, 13 Apr 1995 Joint DoDIIS / Cryptologic SCI Information Systems Security Standards, 11 Apr 2003 DIA Manual (DIAM) 50-4, Department of Defense (DoD), Intelligence Information System (DoDIIS), Information Systems Security (INFOSEC) Program, 30 Apr 1997 DIAM 50-24, Security for Using Communications Equipment in a SCIF, 31 Aug 1990 USNORTHCOM Ballistic Missile Defense (BMD) Operations Security Classification Guide (SCG), 1 Jan 05 Missile Defense Agency (MDA) Ground-based Missile Defense (GMD) SCG, 6 Sep 02 Missile Defense Agency (MDA) Ballistic Missile Defense System (BMDS) SCG, 26 Apr 04 USSTRATCOM Global Ballistic Missile Defense (GBMD)SCG, dated 18 Oct 04 NC HOI 10-220,”USNORTHCOM Focal Point Program” USNORTHCOM Mobile Consolidated Command Center (MCCC) SCG, 14 Apr 03 Integrated Tactical Warning System and Attack Assessment (ITW/AA) System SCG, 22 Sep 00. OPR is

NORAD J33

Additional SCG guidance will be provided as required

NORAD and USNORTHCOM SPECIAL SECURITY OFFICE (SSO) - SCI SUPPLEMENT

ITEM 13a: Contract Expiration date (14 March 2022)

ITEM 13b: The SCIFs at HQ NORAD-USNORTHCOM will be used to perform SCI contractual requirements. SCI material released to the contractor under this contract will be separately stored and maintained only in such properly accredited facilities. Non NORAD-USNORTHCOM SCIFs will be used only when covered by a co-utilization Memorandum of Agreement (MOA) between HQ NORAD-USNORTHCOM and the sponsor of the facility. The supporting SSO is HQ NORAD-USNORTHCOM SSO.

ITEM 13c: The following documents with subsequent revisions or changes will be used for specific SCI security classification guidance on this contract:

AFMAN 14-304

DoD 5105.21-M-1 Signals Intelligence Security Regulation (SISR). DCID 6/9, DCID 6/3, DCID 6/4 Joint DoDIIS / Cryptologic SCI Information Systems Security Standards (JDCSISSS)

ITEM 13d: Inquiries pertaining to classification guidance on SCI will be directed to the Contract Monitor.

ITEM 13e: SCI data furnished to or generated by the contractor will require security handling and controls beyond those in the National Industrial Security Program Operating Manual (NISPOM). These supplemental instructions will be furnished and/or made available to the contractor through the Contract Monitor by the User Agency Special Security Office, HQ NORAD and USNORTHCOM SSO.

ITEM 13f: Names of contractor personnel requiring access to SCI will be submitted to the SCI Control Monitor (CM).

The contractor will provide HQ NORAD and USNORTHCOM SSO an SCI manpower list showing job description of each SCI position, levels of access required per position, and statement of work justifying SCI-level clearances through the COR.

ITEM 13g: The contractor will establish and maintain a current access list of those employees (by position) working on this contract. A copy of this list will be provided to the SCI Contract Monitor (CM).

ITEM 13h: The contractor will advise the SCI Contract Monitor (CM) immediately upon reassignment of personnel to other duties not associated with this contract. The COR and unit Security Manager will ensure that HQ NORAD and USNORTHCOM SSO is notified and the individual is debriefed from SCI access by HQ NORAD and USNORTHCOM

SSO.

ITEM 13i: Release of Information. SCI with restrictive caveats (e.g. ORCON, PROPIN, etc.) will be released to contractors only when originator approval has been obtained. The contractor will control SCI which has been originated or obtained under this contract as follows: The contractor may release such material to any contractor employee working against a position under this contract only when need-to-know exists. The contractor will release such material to any Special Security Office personnel assigned to HQ NORAD and USNORTHCOM or DIA upon demand by such personnel. The contractor may release such material to any other personnel, including contractor and subcontractor employees, and employees of any Federal Government agency, only upon prior written approval from the SCI Contract Monitor. An access certification to a NORAD and USNORTHCOM contractor-occupied SCIF does not constitute approval to release NORAD and USNORTHCOM contractual material to these other personnel; Contract Monitor approval is nevertheless required. Contract Monitor approval of a NORAD and USNORTHCOM contractor visit certification or permanent certification to another facility will constitute approval to discuss contractual material at the facility to be visited.

ITEM 13j: Any SCI release to the contractor in support of this contract remains the property of the DoD department, agency, or command that releases it. The contractor will maintain active accountability of all SCI released to his custody, regardless of whether the release is within a contractor or US Government SCIF. Upon completion/cancellation of the contract, the contractor must return all such material to HQ NORAD and USNORTHCOM SSO unless a follow-on contract specifies that material will be transferred to a subsequent contract. SCI inventories will be conducted IAW DIA Manual 50-14.

ITEM 13k: A SCIF at the contractor facility is not required for the NORAD-USNORTHCOM Network Operations and Support Services contract.

ITEM 13l: Defense Courier Service is not required under this contract.

ITEM 13m: Electronic processing of SCI is not permitted.

ITEM 13n: Contractor Special Security Officers (CSSOs) must coordinate with the SCI Contract Monitor, and obtain the concurrence of HQ NORAD-USNORTHCOM SSO prior to subcontracting any portion of SCI efforts involved in this contract.

ITEM 13o: No contractor personnel will be granted access to SCI material under this contract unless they are filling a DoD SCI position. The contractor will coordinate with the SCI Contract Monitor to ensure adequate positions are requested under this contract. Multiple contract employees sponsored by organizations other than HQ NORAD and USNORTHCOM must be certified to HQ NORAD and USNORTHCOM for use on this contract.

ITEM 13p: The contractor will nominate a CSSO to HQ NORAD and USNORTHCOM SSO. HQ NORAD and USNORTHCOM SSO will submit nominations for appointment by HQ NORAD and USNORTHCOM. The contractor will designate a Special Security Point of Contact (POC) to HQ NORAD and USNORTHCOM SSO. The POC will be responsible for all personnel and information security transactions between the contractor and HQ NORAD and

USNORTHCOM SSO.

ITEM 13q: Contractor will not use references to SCI accesses, even by unclassified acronyms, in advertising, promotional efforts, or recruitment for employees.

ITEM 13r: The following activity is designated as the User Agency SSO for SCI requirements IAW DIA Manual 50-14:

HQ NORAD and USNORTHCOM, Special Security Office, Peterson AFB, CO 80914.

Signature Blocks:

SSO: _________________________________________ Contract Monitor: _________________________________

TOM CLARK DOUGLAS NIELSEN

Special Security Office Government Service Owner NORAD and USNORTHCOM/J2 NORAD and USNORTHCOM/J66

Alternate Contract Monitor: _________________________________

KRISTINA ROTH

Alternate Government Service Owner NORAD and USNORTHCOM/J66

OPERATIONS SECURITY (OPSEC)

Addendum to DD Form 254, Item 11.j.

GENERAL:

1. PURPOSE: This section outlines the requirements and procedures necessary to protect Critical Information for Operations Security (OPSEC).

2. MISSION: To maintain a continuing awareness of adversary interest in center actions and adversary intelligence collection capabilities. To understand the need to identify and protect classified and unclassified indicators, which occur, reveal sensitive information. To evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

3. DEFINITION: OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

a. Identify those actions that can be observed by adversary intelligence systems.

b. Determine indicators hostile intelligence systems might obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

c. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

4. OBJECTIVES:

a. To protect planned operational center activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

b. To preserve secrecy concerning specific scenario events and a NORAD response to these events.

c. To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. ACTIONS: The following actions are outlined in the Statement of Work for this effort and at a minimum must include:

a. Provide the organizations Critical Information List to the contractor.

b. Share USNORTHCOM and 21st Space Wing Force Protection Messages with the contractor.

c. Contractor receiving OPSEC training from the sponsoring organization.

d. Contractor apply specific OPSEC countermeasures as needed.