Att. 2 ACT DD254 17 Mar 2021.pdf

CLASSIFICATION (When filled in): Unclassified

PREVIOUS EDITION IS OBSOLETE. Page 1 of 12

AEM LiveCycle Designer

DD FORM 254, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED

(See Instructions)

Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

None (See instructions)

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER

TBD

DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

20220201

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.W900KK-17-C-0015

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

PLANNING PURPOSES ONLY

b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional) Defense Counterintelligence and Security Agency

(IOFSS) (TX)

1777 NE Loop 410, Suite 801 San Antonio, TX 78217

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor) Add Row Remove last Row Delete All Rows

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.) Add Row Remove last Row Delete All Rows

a. LOCATION(S) (For actual performance, see instructions.)

See item 13 11a

b. CAGE CODE

(If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional) Defense Counterintelligence and Security Agency

(IOFSS) (TX)

1777 NE Loop 410, Suite 801 San Antonio, TX 78217

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

The US Army Program Executive Office for Simulation, Training, and Instrumentation (PEO STRI) has a roll-over requirement to provide labor, materials, consumables, tools, and test equipment, supply support, maintenance and repair activities, installation/de-installation, engineering modification and development, production,operation, transportation, and relocation necessary to maintain previously fielded Artillery and Chemical Training Aids, Devices,Simulations, and Simulators (TADSS) and Material Support Packages (MSPs) in a fully operational condition throughout CONUS and OCONUS.

***Period of Performance: 1 February 2022 to 31 January 2027*** ***COR: Brittney M. Johnson, (407) 384-3712, brittney.m.johnson12.civ@mail.mil***

PREVIOUS EDITION IS OBSOLETE. Page 2 of 12

AEM LiveCycle Designer

DD FORM 254, APR 2018

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.) h. FOREIGN GOVERMENT INFORMATION

d. FORMERLY RESTRICTED DATA i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

Dual Citizens, Foreign and FOCI companies are not allowed to work on the contract.

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

ACC Orlando, 12211 Science Dr Orlando, FL 32826

Public Release Authority:

PL TADSS Support, OPSEC Off, 12211 Science Dr Orlando, FL PEO STRI PAO, 12211 Science Dr Orlando, FL 32826

13. SECURITY GUIDANCE Add Signature Remove last Signature Delete All Signatures

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

"The undersigned has reviewed this Security Specification and understands the provisions herein. The undersigned will ensure compliance with the provisions within the limits of his/her responsibility. Furthermore the undersigned will report any security incidents to the supporting Security Manager, ISS and KO".

ITEM 13 SECURITY GUIDANCE:

The following items apply to this contract.

GENERAL GUIDANCE:

1. The vendor/contractor and sub-vendor/contractor(s) shall comply with the Security Agreement (DD Form 441) and following Security Regulations (DoDM 5200.01 Volumes 1 thru 3), DoD Information Security Program, (DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM), DoDM 5220.22, Vol 2 National Industrial Security Program: Industrial Security

PREVIOUS EDITION IS OBSOLETE. Page 3 of 12

AEM LiveCycle Designer

DD FORM 254, APR 2018

Procedures for Government Activates, DoDI 5200.48 Controlled Unclassified Information (CUI), AR 25-2 Information Assurance, AR 380-5 Information Security, AR 380-49 Industrial Security, AR 380-10 current versions and affiliated regulations.

2. This DD254 only supports the base IDIQ contract! All other contract or delivery orders outside the scope of this contract and in support of other service components, government agencies and external organizations to PEO STRI must have their requiring activity security office develop their specific DD254 to support their contract effort.

3. The vendor/contractor and sub-vendor/contractor employees requiring access to DoD government or DoD vendor/contractor's facilities where proof of a security clearance is required, shall meet the security access requirements specified by the host and/or owner of those facilities.

4. Any prime Vendor/Contractors to include sub-vendors/contractors that are USA Foreign Owned, Controlled and Influenced (FOCI) company who poses a valid FCL issued by the Defense Counterintelligence Security Agency (DCSA) under a Special Security Agreement (SSA) are not allowed to work on this contract.

5. The vendor/contractor is not authorized to disclose or release collateral Classified Military Information (CMI) information to the public.

a. The vendor/contractor is not authorized to disclose or release Controlled Unclassified Information (CUI) pertaining to this agreement/ contract to the public without prior review and approval from the Requiring Activity OPSEC Officer, Legal and Public Affairs Officer.

Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 12.

b. The vendor/contractor is not authorized to disclose or release any program Classified Military Information (CMI) Controlled Unclassified Information (CUI) Technical Data, Information pertaining to this contract to any Foreign Nationals or Foreign Representatives without prior review and approval from the Requiring Activity Cognizant Security Office, Foreign Disclosure Officer (FDO). Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 17a of the DD254.

6. The Vendor/Contractor shall only issue security clearances to those employees who meet the personal security requirements stated in the NISPOM and who require access to classified information based on a Need-to-Know.

a. For collateral security clearances and access the vendor/contractor shall follow the Security guidelines established in DoD 5220.22M and the Defense Counterintelligence Security Agency (DCSA) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/ index.php

b. Vendor/Contractors who do not require a security clearance but require a government Common Access Card (CAC) must have a Tier 1 security investigation and follow the credentialing requirements of this contract!

7. The vendor/contractor and sub-vendor/contractors shall ensure that all Classified information, Controlled Unclassified Information (CUI), Controlled Technical Information (CTI) documents, data and or export controlled information; is marked, handled and safeguarded with the appropriate security classification, distribution statement(s) and export control warning statement in accordance with DoDD 5230.24, DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM) DoDI 5200.48, and DoDM

5200.01 Vol 1, 2 and 3.

a. The vendor/contractor and sub-vendor/contractors shall NOT ACCEPT any Documents, data or information from any source including the government requiring activity unless the documents, data or information is marked as stated in paragraph 7!

8. The prime vendor/contractor is responsible for vetting all sub-vendor/contractors for eligibility, suitability prior to issuing a sub-vendor/ contractor DD Form 254 per chapter 7 of current version of DoD 5220.22M and AR 380-49. The prime vendor/contractor shall issue the PEO STRI vendor vetting process letter to all sub-vendor/contractors to fill out and respond to.

a. The prime vendor/contractor shall follow DCSA sponsorship procedures (if required) only to those not cleared Sub-vendor/contractor for a FCL who require access to classified data/information for this agreement/contract. The government nor the prime vendor/contractor shall incur any cost in this process.

b. The prime vendor/contractor shall not issue a DD254 to a USA FOCI Company Without written approval from the requiring activity security office and DCSA.

c. The prime vendor/contractor FSO will provide the AO/KO and/or AOR/COR with a copy of all sub-vendor/contract DD Form 254s to be attached to the prime agreement/contract. The AO/KO and/or AOR/COR or AO and/or AOR will provide a copy of all sub-agreement/ contract DD Form 254’s to the ISS and DCSA.

PREVIOUS EDITION IS OBSOLETE. Page 4 of 12

AEM LiveCycle Designer

DD FORM 254, APR 2018

9. Contractor shall comply with FAR 52.204-2 “Security Requirements”. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret”. The Contractor shall comply with (1) Security Agreement (DoD Form 441), including the National Industrial Security Program Operating Manual (DOD 5220.22-M) and (2) any revisions to DOD 5220.22-M.

10. This agreement/contract has no security classification guides (SCGs) which are directly applicable to this effort. If, during this effort, it becomes necessary to create a security classification Reference (SCR) the contractor shall notify the contract officer representative who will seek the assistance and appropriate guidance from the local government ISSM, PM and Requiring Activity Cognizant Security Office.

11. Vendors/Contractors who work in a DoD or Vendor/Contractor cleared facility on DA installations and or government leased facilities and who are embedded or integrated within a DA program or activity, shall report all adverse information, suspicious contacts, and other reportable incidents to the local security office.

12. The Vendor/contractor and their sub-vendor/contractors shall immediately report any loss, compromise, suspected compromise of classified information or any security violations which occur on this contract per DoD 5220.22–M with current changes, to their Facility Security Manager (FSO) and local DCSA office. The vendor/contractor shall also inform the AO/KO, AOR/COR, and the ISS.

13. The vendor/contractor and their sub-vendor/contractors will designate in writing a U.S. citizen (not a dual citizen) as the Insider Threat program official per paragraph 1-202 of DoD 5220.22M w/change 2. All vendor/contractors with security clearances shall comply with Insider Threat Training requirements per paragraph 3-103 of DoD 5220.22M w/change 2. Additionally the vendor/contractor shall report threat-related incidents, behavioral indicators to the Requiring Activity Cognizant Security Office. Insider Threat training information can be found at the following DCSA site https://www.cdse.edu/

14. The prime vendor/contractor and sub-vendor/contractors shall ensure that all contract employees with security clearances meet the annual security training required by DoD 5220.22M, NISPOM, DoDI 5200.48, AR 380-5 and AR 381-12;

REQUIRED ANNUAL SECURITY TRAINING

The contractor shall read and execute the below listed annual security training requirements for only those employees who have security clearances and access to CUI on this contract;

Threat Awareness Reporting Program (TARP) All contractors and subcontractors with security clearances must receive annual Threat Awareness and Reporting Program (TARP) training per AR 381-12. The training should be provided by a CI agent or other trainer as specified in 2-4b and chapter 3 AR 381-12

The Contractor shall ensure its employees report threat-related incidents, behavioral indicators, and other matters of CI interest specified in the AR 381-12, to their FSO and the PEO STRI G2 Office, the nearest military CI office, the Federal Bureau of Investigation, or the Defense Security Service.

OPSEC Awareness Training.

Per AR 530-1 Operations Security, the contractor employees working on this contract must complete Level I OPSEC Awareness training.

New employees must be trained within 30 calendar days of their start date on this contract and annually thereafter. OPSEC Awareness training information and materials are available at https://www.cdse.edu/catalog/elearning/GS130.html

Insider Threat Training The contractor and their subcontractors will designate in writing a U.S. citizen as the Insider Threat program official per paragraph 1-202 of DoD 5220.22M w/change 2. All contractors shall comply with Insider Threat Training requirements per paragraph 3-103 of DoD 5220.22M w/change 2. Insider threat program information and materials are available at https://www.cdse.edu/catalog/elearning/ INT101.html.

DoD Annual Security Awareness Refresher Training All contractor employees working on this contract with a security clearances must complete the annual security awareness refresher training. New employees must complete the initial security training and the security awareness refresher training annually thereafter. This training refreshes the employees basic understanding of initial security training requirements outlined in DoDM 5200.01 Volume 3, Enclosure 5, the National Industrial Security Program Operating Manual (NISPOM) and other applicable policies and regulations. This training is available at https://www.cdse.edu/catalog/elearning/IF142.html

Controlled Unclassified Information Training This contract / agreement contains CUI, all contractors shall have only those employees who handle CUI take annual CDSE CUI Training required for all DoD and Industrial personnel with access to controlled unclassified information. New employees must complete this

PREVIOUS EDITION IS OBSOLETE. Page 5 of 12

AEM LiveCycle Designer

DD FORM 254, APR 2018

training 30 day from start day of the contract. No CAC or password needed the training website also provides a resource tab which lists regulations, policies and more information on the subject. https://securityhub.usalearning.gov/index.html

Unauthorized Disclosure of Classified Information for DoD and Industry Contractor employees working on this contract with security clearances must complete the annual Unauthorized Disclosure of Classified Information for DoD and Industry training. New employees must complete this training 30 day from start day of the contract. This training provides an overview of what unauthorized disclosure is, including specific types of unauthorized disclosure and some common misconceptions about unauthorized disclosure, the types of damage caused by unauthorized disclosure and the various sanctions one could face if caught engaging in unauthorized disclosure. This training is available at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

The AT level 1 awareness training is only requited for those contractor employees traveling Oconus in support of this contract.

AT Awareness Training for Contractor Personnel Traveling Overseas.

The contractor FSOs and associated subcontractor FSOs will brief and make available government area of responsibility (AOR) specific AT awareness training and information to employees traveling overseas as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact. AT level I awareness training meets this requirement and is available at the following website: https://atlevel1.dtic.mil/at/

DCSA provides the Facility Security Officer (FSO) Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php for training assistance.

15. SELF EMPLOYED CONSULTANTS – The requiring activity security office shall be notified of all consultants who work for or support the Vendor/Contractor (prime and subs) for this effort! The Vendor/Contractor who employs or has consultants on their team shall provide a copy of all consultant certificate/agreements to the requiring activity AOR/COR and security office per paragraph 2-212 of the

NISPOM.

16. TEMPORARY EMPLOYED PERSONNEL (Paid by 1099) – The contractor/vendor is NOT authorized to hire Temporary employees on this contract/agreement.

17. If the contract requires access to the PM ST LT2 portal, only those contractors with a final SECRET clearances and approved by the PM ST LT2 portal administrator for access will be authorized.

18. Use of Government Owned Computers:

• The contractor shall be provided with government owned computers at government facility(s) for processing CLASSIFIED, UNCLASSIFIED and Controlled Unclassified Information (CUI) information provided, collected, generated and/or developed during the contract’s period of performance. The purpose of the government owned computer is to conduct business as required by this contract. Any other use of the government owned computer by the contractor is prohibited.

• The contractor is not authorized to process any government owned information on any personally owned computers. This is to include any government information provided, collected, generated and/or developed during the contract’s period of performance.

• Contractors requiring access to restricted areas, sensitive information or government equipment and/or unclassified networks (i.e., Enterprise NIPRNet) shall be limited to those contractor individuals who meet the requirements of AR 25-2 and AR 380-67.

• The contractor is only authorized to access the appropriate government network as identified in the DD Form 254, Item 11.l. Secret Internet Protocol Network (SIPRNET) access may be required. Access to SIPRNet may require a NATO Awareness Briefing. The contractor shall not access, download, or further disseminate any special access data (i.e. Intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the COR. Contractor access to SIPRNET via government accounts is restricted to only sites directly related to meeting the requirements of this contract as validated by the COR and authorized IAW the Contract DD254 and/or the Statement of Work (SOW).

ITEM 10:

Ref Item 10.j: CONTROLLED UNCLASSIFIED INFORMATION (CUI) - For Controlled Unclassified Information (CUI) provided under this contract shall be safeguarded and marked as specified in DoDI 5200.48. CUI information that is export controlled shall not be shared with any foreign nationals unless approved by the Requiring Activity security office along with the approved State Department license. (see the CUI attachment)

a. COMPILATION - The contractor shall be aware of certain information that would otherwise be unclassified or CUI when standing

PREVIOUS EDITION IS OBSOLETE. Page 6 of 12

AEM LiveCycle Designer

DD FORM 254, APR 2018

alone may require classification when combined or associated with other unclassified or CUI information. The determination that information requires classification by compilation will be based on specific guidance regarding compilation provided in a Security Classification Guide (SCG) or from the information/data owner. When classification is required to protect a compilation of such information, the overall classification assigned to the compilation shall be conspicuously affixed. The reason for classifying the compilation shall be stated at an appropriate location at or near the beginning of the compilation. Any unclassified or CUI portions will be portion marked (U) or (CUI), while the overall markings will reflect the classification of the compiled information.

ITEM 11:

Ref Item 11.a: ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTORS FACILITY OR A GOVERNMENT ACTIVITY – Vendor/Contractor performance is restricted to the names and address of contractor facility or government activities listed below. Government agency or activity will provide security classification guidance for performance of this agreement/ contract. Submit visit request to the Facility Security Officer (FSO), Security Management Office via JPAS for need-to-know verification and access.

Fort Sill, OK Fort Lee, VA Fort Leonard Wood, MO Fort Bliss, TX Fort Bragg, NC Vilseck, GE Camp Casey, ROK

Ref Item 11.f: ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S - This agreement/contract may require your company to have access to classified information in an overseas area. The specific overseas area(s) will be provided by the Contract Monitor or the Agreement/Contracting Officer. Classified information or materials will remain under the direct control of the US government while in an overseas area unless prior approval is granted by this command. Release of classified information to a foreign entity will be accomplished in accordance with Chapter 10, DoD 5220.22-M w/change 2 and AR 380-10.

Ref Item 11.j: OPERATIONS SECURITY (OPSEC) REQUIREMENTS - The vendor/contractor shall develop, implement, and maintain a facility level OPSEC program to protect classified and/or sensitive unclassified information used at the vendor/contractor, government and other vendor/contractor facilities during the performance of this agreement/contract. The OPSEC requirements may be included in the vendor’s/Contractor’s Standard Practice Procedures (SPP) or Technology Control Plan (TCP), whichever is more applicable.

Ref Item 11.l: RECEIVE, STORE OR GENERATE CONTROLLED UNCLASSIFIED INFORMATION (CUI) – The vendor/contractor and all sub-vendor/contractors personnel must protect CUI material and information in accordance with DoDI 5200.48. CUI information that is export controlled shall not be shared with any foreign nationals unless approved by the Requiring Activity security office along with the approved State Department license and FDO. (see the CUI addendum attached).

a. COMPILATION - The contractor shall be aware of certain information that would otherwise be unclassified or CUI when standing alone may require classification when combined or associated with other unclassified or CUI information. The determination that information requires classification by compilation will be based on specific guidance regarding compilation provided in a Security Classification Guide (SCG) or from the information/data owner. When classification is required to protect a compilation of such information, the overall classification assigned to the compilation shall be conspicuously affixed. The reason for classifying the compilation shall be stated at an appropriate location at or near the beginning of the compilation. Any unclassified or CUI portions will be portion marked (U) or (CUI), while the overall markings will reflect the classification of the compiled information.

Ref Item 11.M: Dual Citizens The vendor FSO must maintain a list of all dual citizen employees and provide that list upon inspection from DCSA or the cognizant security authority ISS. Vendor employees who are dual citizens and have access to software and technical data must have the appropriate security clearance in accordance with the current version of DoD 5220.22-M w current changes.

“CONTROLLED UNCLASSIFIED INFORMATION (CUI) ” ATTACHMENT

1. GENERAL:

The contractor shall adhere to DoDI 5200.48 CUI and Army Controlled Unclassified Information (CUI) guidance as it relates to controlling, marking, safeguarding, storage and disposal of CUI materials on this contract /agreement.

PREVIOUS EDITION IS OBSOLETE. Page 7 of 12

AEM LiveCycle Designer

DD FORM 254, APR 2018

2. IDENTIFYING CUI.

a. The official CUI Registry approved by the CUI Executive Agent identifies all approved CUI categories; provides general descriptions for each; identifies the basis for controls; establishes markings, and includes guidance on handling procedures. The Contractor shall refer to the CUI Registry’s category listing found at https://www.archives.gov/cui/registry/category-list to determine if information can be designated as CUI. The contractor shall also coordinate with the COR/AOR for support and advice.

b. The authorized holder (originator/owner of the information; the original classification authority or other official (government or contractor) that controls the information) is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. If so, the authorized holder is responsible for applying CUI markings and dissemination instructions accordingly.

c. Only categories listed in the CUI Registry (includes DoD related categories) can be used to identify if the information meets CUI designation.

3. LEGACY MATERIAL.

a. Policy for legacy CUI created and marked under Department of Defense Manual (DoDM) 5200.01, Volume 4 is cancelled. For information on Army legacy material: (Ref: DoDI 5200.48, para 3.2)

(1) Will not be required to be re-marked or redacted while it remains under control or is accessed on line and downloaded for use on the contract. However, when legacy CUI is incorporated into, or cited in, another document or material, it must be reviewed for CUI and marked in accordance with DoDI 5200.48.

(2) Marked and stored on an access-controlled website or database does not need to be remarked as CUI, even if other agencies and contractors are granted access to the websites or databases.

(3) Does not automatically become CUI. It must be reviewed by the owner of the information to determine if it meets or falls under one of the new CUI categories. If it meets the new CUI requirements, it will be marked in accordance with DoDI 5200.48.

b. The original classification authorities (OCAs) are required to review all SCGs under their authority to determine if the information (previously marked as “For Official Use Only” or “FOUO” or other legacy markings) meets the CUI designation. The SCGs must be reissued to ensure clear protection guidance is provided. (Ref: DoDI 5200.48, para 3-7e and 3.8)

4. Marking. The contractor shall ensure that all documents containing CUI carry the CUI markings in accordance with DoDI 5200.48.

Discontinue all use of legacy or other markings is not permitted or included in either the CUI Registry or DoDI 5200.48. Refer to the OUSD(I&S)/DDI(CL&S) Information Security CUI Marking Guidance dated April 2020.

5. Safeguarding and Storage. The contractor shall protect CUI from unauthorized disclosure or access by unauthorized personnel, by ensuring these measures are implemented: (Ref: DoDI 5200.48, para 4.1e)

a. During working hours. Contractor employees working with CUI will be careful not to expose CUI to unauthorized users or others who do not have a lawful government purpose to see the information. Cover sheets (Stand Form 901) can be placed on top of documents to conceal the contents from casual viewing.

b. The contractor shall keep CUI under control at all times or protect it with at least one physical barrier and reasonably ensure that the information is protected from unauthorized access and observation.

c. CUI will not be stored in personal residence, hotel room safes, and automobiles or viewed while on public transportation if allowed to transfer hard-copy (document form) CUI material outside the organization.

6. Transmission Requirements.

a. CUI information may be transmitted electronically (e.g., data, website, or e-mail), via approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure or transport layer security (e.g., https). Avoid wireless telephone transmission of CUI when other options are available. (Ref: DoDI 5200.48, para 4.1e).

b. CUI transmission via facsimile machine is permitted; however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive

PREVIOUS EDITION IS OBSOLETE. Page 8 of 12

AEM LiveCycle Designer

DD FORM 254, APR 2018

CUI; facsimile machine located in a controlled government environment) or an authorized DoD contractor facility.

c. CUI information and material may be transmitted via first class mail, parcel post, FEDEX or, bulk shipments. Do not place CUI markings on the outer envelopes or packaging. Refer to the OUSD(I&S)/DDI(CL&S) Information Security CUI Marking Guidance dated April 2020.

d. The contractor shall not use unofficial or personal (e.g., .net; .com) e-mail accounts, messaging systems, or other non-DoD information systems, except approved or authorized government contractor systems, to conduct official business involving CUI.

7. CUI within Information Systems. (Ref: DoDI 5200.48, para 3-3, 3-10)

a. DoD information systems (IS) processing, storing, or transmitting CUI will be categorized at the moderate impact level, and follow the guidance in DoDI 8500.01 and 8510.01.

b. Non-DoD information systems processing, storing, or transmitting CUI will provide adequate security, and the appropriate requirements must be incorporated into all contracts, grants, and other legal agreements with non-DoD entities in accordance with DoDI

8582.01. The NIST-SP 800-171 identifies the baseline system requirements for processing CUI for industry.

c. For systems, networks, and programs operating on the various domains, a splash screen warning and notice of consent must be employed to alert users of the presence of CUI.

d. When made available by the DoD Chief Information Officer and OUSD(I&S), Army organizations will modify or install classification marking tools on unclassified, Secret and Top Secret network systems to account for CUI information and readily permit inclusion of CUI markings and designator indicators.

8. Dissemination. (Ref DoDI 5200.48, para 4-2)

a. The contractor shall follow CUI access to the extent the access or dissemination: complies with the Law, Regulation, and Government-wide policy (LRGWP) identifying the information as CUI; furthers a lawful government purpose; is not restricted by an authorized Limited Dissemination Controls (LDC); or is not prohibited by any LRGWP.

b. Authorized holders may place limits on disseminating CUI for a lawful government purpose using the approved LDCs and associated marking or methods authorized by a specific LRGWP.

c. The originator may use the LDCs to limit access to those on an accompanying dissemination list, as shown in Table 2 of DoDI

5200.48. LDCs or distribution statements cannot unnecessarily restrict CUI access.

d. When handling other Executive Branch CUI (non-DoD or Army), DA personnel will follow their regulatory guidance for when the application of dissemination controls and its markings are allowed, and by whom, while ensuring the policy is in accordance with Part 2002 of Title 32, CFR.

e. The government CUI designated information may be disseminated to a foreign recipient in order to conduct official business for the Army, provided the dissemination has been approved the foreign disclosure officer in accordance with AR 380-10 and the CUI is marked as releasable to the intended foreign recipient. Refer to DoDI 5200.48, para 3.9 on general release and disclosure requirements.

9. Legacy Distribution Statements.

a. Legacy CUI technical documents and materials requiring export control have used distribution statements in accordance with DoDI

5230.24 in order to address the shared responsibility between the DoD and its contractors to safeguard this information. This was done for legacy CUI creation, transmission, receipt, storage, distribution, decontrol, and approved disposition authorities, including destruction.

(Ref: DoDI 5200.48, para 4.3a)

b. CUI export controlled technical information or other scientific, technical, and engineering information will continue to use distribution statements and must be marked with an export control warning in accordance with DoDI 5230.24, DoDD 5230.25, and Part 250 of Title 32, CFR (Withholding of Unclassified Technical Data from Public Disclosure). However, where other markings are authorized and used in accordance with associated LRGWP (e.g., North Atlantic Treaty Organization markings, REL TO), those markings may be used to further inform distribution decisions. (Ref: DoDI 5200.48, para 4.3b)

c. “REL TO” is authorized for use with foreign nationals once the information distribution is properly coordinated with the requiring activity foreign disclosure office.

10. Destruction. (Ref: DoDI 5200.48, para 4.5)

PREVIOUS EDITION IS OBSOLETE. Page 9 of 12

a. The contractor shall take all CUI documents (Record and Non-record copies) and materials and formally review them in accordance with Chapter 33 of Title 44, United States Code (and AR 25-400-2 before approved disposition authorities are applied, including destruction. Media containing CUI must include decontrolling indicators. (Ref: DoDI 5200.48, para 4.5)

b. The contractor shall ensure that CUI will be destroyed in a manner that makes it unreadable, indecipherable, and irrecoverable. The CUI will be destroyed according to any specific directives regarding the information. If the authority does not specify a destruction method, the contractor shall use one of the following methods: (Ref: DoDI 5200.48, para 4.5a and b)

(1) Any method of destruction approved for classified information.

(2) Guidance for destruction outlined in the NIST SP 800-88, and further explained in NARA’s CUI Notice 2019-03.

11. Decontrol of CUI. Decontrol occurs when the information has been removed from the protection of the CUI designation and no longer requires safeguarding or dissemination controls.

a. Decontrolling and releasing CUI records will be executed by the originator of the Information or other authority (e.g., initial Freedom of Information Act (FOIA) denial and appellant authorities) and designated government program office for decontrolling CUI pursuant to the procedures for the review and release of information (see AR 360-1). There are no specific timelines to decontrol CUI unless specifically required in a LRGWP. Decontrol will occur when the CUI no longer requires safeguarding and will follow Army records management procedures (see AR 25-400-2). (Ref: DoDI 5200.48, para 4.4)

b. CUI documents and materials will be formally reviewed by the government program chief engineer, SME before being decontrolled or chief engineer, SME, OPSEC officer, legal and PAO prior to public release.

c. Decontrol will occur when the designating agency decides to release the CUI to the public by making an affirmative, proactive disclosure (for example, FOIA request). Disclosure under FOIA does not automatically constitute CUI decontrol for all purposes.

d. Disclosures under the Privacy Act constitute decontrol only with respect to the limited purpose of disclosure to the individual who requested access to their records maintained in a system of records.

e. When indicated by a decontrol marking specifying a decontrol date or event, CUI is decontrolled without further review by the originator.

f. A designating agency may also decontrol CUI:

(1) In response to a request from an authorized holder to decontrol CUI.

(2) Concurrently with any declassification action under E.O. 13526 or any predecessor or successor order, as long as the information also appropriately qualifies for decontrol as CUI.

(3) In PEO STRI, the government program office in charge of the contract is the local CUI personnel it authorizes to decontrol CUI, consistent with a LRGWP.

(4) Decontrolling CUI for purposes other than FOIA disclosure relieves the requirement to handle the information under the CUI Program but does not constitute authorization for public release.

(5) Personnel must clearly indicate that CUI is no longer controlled when restating, paraphrasing, re-using, releasing to the public, or donating the CUI to a private institution. Otherwise, personnel do not have to mark, review, or take other actions to indicate the CUI is no longer controlled.

g. Once decontrolled, any public release of information that was formerly CUI must be in accordance with AR 360-1.

h. Authorized holders may request that the designating agency decontrol CUI that they believe should be decontrolled. If an authorized holder publicly releases CUI in accordance with the designating agency’s (not Army or DoD) authorized procedures, the release constitutes decontrol of the information.

i. Unauthorized disclosure of CUI does not constitute decontrol.

j. Personnel must not decontrol CUI to conceal, or to otherwise circumvent accountability for, an unauthorized disclosure.

PREVIOUS EDITION IS OBSOLETE. Page 10 of 12

k. When a LRGWP require specific decontrol procedures, personnel must follow such requirements

l. CUI and the Freedom of Information Act (FOIA). FOIA may not be cited as a CUI safeguarding or disseminating control authority for CUI. When determining whether to disclose information in response to a FOIA request, the decision must be based on content of the information and applicability of any FOIA statutory exemptions, regardless of whether or not the information is designated or marked as CUI. (Ref: Title 32 CFR 2002.44(b), Part 2002)

m. CUI and the Privacy Act. Information contained in Privacy Act systems of records may be subject to controls under other CUI categories and may need to be marked as CUI for that reason. In addition, when determining whether certain information must be protected under the Privacy Act or whether the Privacy Act allows an individual the right to access their information maintained in a system of records, the decision to release must be based upon the content of the information as well as Privacy Act criteria, regardless of whether the information is designated or marked as CUI.

n. Decontrol of CUI for the limited purpose of making an individual’s information available to them under the Privacy Act does not result in decontrol. (Ref: CFR 2002.46, Title 32 Part 2002)

12. Challenges to Designation of Information as CUI.

a. The contractor who believes that a designation as CUI is improper or incorrect, or who believe they have received unmarked CUI, should notify the government agency that disseminated the information. When the disseminating agency is not the designating agency of the CUI, it is the responsibility of the disseminator agency to contact the designating agency of the challenge. Challenges may be made anonymously; and challengers cannot be subject to retribution for bringing such challenges. (Ref: CFR 2002.50 Title 32, Part 2002 )

b. If a contractor or government command or organization receives a challenge, the government program office or other designated individual for handling challenges will take the following measures:

(1) Acknowledge receipt of the challenge in writing, providing an expected timeline for response to the challenger,

(2) Review the merits of the challenge with a subject matter expert, offer an opportunity to the challenger to define a rationale for belief that the CUI in question is inappropriately designated,

(3) Notify the challenger of the decision in writing, and provide contact information of the official making the decision in this matter.

c. Until the challenge is resolved, the challenged CUI, including challenges to unmarked CUI, will continue to be safeguarded and disseminated at the appropriate control level indicated in the markings or presumed category. If a challenging party disagrees with the response to a challenge, contact the contract cognizant security office (Information Security Team) for assistance with resolution.

13. Misuse or Unauthorized Disclosure of CUI.

a. The contractor shall report promptly and shall take appropriate action in cases of misuse, mishandling or unauthorized disclosure (UD) of CUI.

b. For UD of CUI, no formal security inquiry or investigation is required unless disciplinary action will be taken against the individual(s) responsible, in such case an inquiry would be appropriate. Incidents involving the UD of CUI will be reported to the COR/AOR and contracting officer.

14. CUI Training. All contractors handling CUI in support to this contract, will execute initial and refresher CUI training as stated in item 13 paragraph 14. CUI training can be taken at the following URL; https://securityhub.usalearning.gov/index.html

15. CUI Requirements in Army Contracts. (Ref: DoDI 5200.48, para 5.3)

a. CUI will be identified by the government program office in all Army contracts to include the applicable security clauses and security standards associated with the CUI in accordance with DoDI 5200.48.

b. Whenever the Army and government program office provides CUI to, or CUI is generated by, non-DoD entities, protective measures and dissemination controls, including those directed by LRGWP, will be articulated in the contract, grant, or other legal agreement, as appropriate.

c. The contractor shall monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to

PREVIOUS EDITION IS OBSOLETE. Page 11 of 12

AEM LiveCycle Designer

DD FORM 254, APR 2018

security classification guidance addressing the accumulation of unclassified data or information.

d. The contractor shall report the potential classification of aggregated or compiled CUI to the Army requiring activity.

e. The contractor shall submit unclassified Army information for review and approval for release in accordance with the standard Army release requirements under AR 360-1.

f. All CUI records must follow the approved mandatory disposition authorities whenever the government requiring activity provides CUI to, or CUI is generated by, non-DoD entities.

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form) Hide Attachment Bar

SEE ATTACHED ADDENDUM NAME & TITLE OF REVIEWING OFFICIAL

Brittney Johnson, COR

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

The Government Project Manager’s/Director’s working in conjunction with the Contracting/Agreement Officer of this effort will coordinate with the cognizant security office for ensuring vendor/contractor compliance with the security terms of the DD 254 blocks 10,11,12,13,14 and addendum sheets. The government PM/PD’s will monitor and verify the vendor/contractor’s security responsibilities during the life of the contract/agreement and the PEO STRI Industrial Security Specialist will coordinate with the KO/AO, COR when conducting site security inspections of the vendor/contractor facility in accordance with AR 380-49, Army Industrial Security.

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

ACC Orlando

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

W900KK

c. ADDRESS (Include ZIP Code) 12211 Science Drive Orlando, FL 32828

d. POC NAME

Keith Adams

e. POC TELEPHONE (Include Area Code)

+1 (407) 346-5329

f. EMAIL ADDRESS (See Instructions) keith.l.adams3.civ@mail.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

Stanley Slupski

b. TITLE

Industrial Security Specialist (ISS)

c. ADDRESS (Include ZIP Code)

PEO STRI G2

12211 Science Dr Orlando, FL 32836

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

W900KK

e. CAGE CODE OF THE PRIME CONTRACTOR

(See Instructions.)

f. TELEPHONE (Include Area Code)

+1 (407) 384-3540

g. EMAIL ADDRESS (See Instructions) stanley.m.slupski.civ@mail.mil

h. SIGNATURE

i. DATE SIGNED (See Instructions)

20210317

PREVIOUS EDITION IS OBSOLETE. Page 12 of 12

AEM…