ATTACH 4 DD254 Scientific and Engineering 2020.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

ATTACHMENT ONE (Continuation of Block 13 of the DD Form 254 for Scientific and Engineering Support Contract To Be Determined)

13. Security Guidance

Item 11a. Contractor performance does require travel beyond the boundaries of APG during the course of the contract for training or work to be accomplished at sites other than APG. The contractor shall have personnel available and ready to travel on the required date. ATC is engaged in remote testing and test support at sites all over the CONUS as well as OCONUS. The contractor shall have the capability to support the remote testing using the personnel that are already supporting ATC’s mission at APG. There will be no access to classified information at the contractor’s facility. Therefore, the contractor will not be required to have any safeguarding capability at their facility. All access to classified information will be at a Government Activity or another contractor’s facility should a contract employee need to accompany a government employee in support of a classified item away from ATC.

Item 11j. The contract requires planning for and application of OPSEC IAW Army Regulation 530-1, Operations Security (OPSEC) and the contract clauses and statement of work. OPSEC guidance will also be provided as applicable for each project or program affected by this support. Individual security classification guides and test plans will be provided as required by this effort. In addition, the ATC Security Manager shall advise the contractor of ATC’s Critical Information (CI), why it needs to be protected, where it is located, who is responsible for it and how to protect it.

ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for Scientific and Engineering Support Contract To Be Determined)

14. Additional Security Requirements.

Facility Clearance. The contractor shall possess or be capable of obtaining a SECRET Facility Clearance as prescribed by this DD Form 254, Contract Security Classification Specification. Request for sponsorship for a facility clearance shall be made in writing to the Contracting Officer or designated representative. The company must apply within 30 days from the award date of the contract to the Defense Security Service (DSS) for a facility clearance. The government will be notified by the company when the facility clearance has been granted by DSS. Verification by the ATC Security and Intelligence Division shall be made to the DSS using the Industrial Security Facilities Database (ISFD) to confirm that the company has an active facility security clearance.

Personnel Security Clearances. All contractor employees that work under this contract on site at ATC shall possess or be capable of acquiring a final SECRET clearance. Additionally, contractor personnel who occupy computer related positions that have been designated Information Technology (IT) 1 will have a Single Scope Background Investigation (SSBI). Contractor personnel shall not report to work until, at a minimum, an interim SECRET clearance is granted. A visit request must be submitted via Joint Personnel Adjudications Systems (JPAS) to the ATC SMO code of W4QUAA by the Facility Security Officer (FSO) or Alternate FSO. If initially JPAS is not available, a visit authorization letter shall be prepared on company letterhead, verified and signed by the FSO or Alternate FSO, and submitted to the ATC Visitor Desk. A visit request must be submitted annually via JPAS to the ATC SMO code of W4QUAA by the FSO or Alternate FSO. If JPAS is not available, the FSO or Alternate FSO will submit a visit authorization letter annually which will be prepared on company letterhead, verified and signed by the FSO or Alternate FSO, and submitted to the ATC Visitor Desk. In addition, the contractor shall prepare a roster of current employees which includes each employee’s name, social security number, and level of security clearance. This roster shall be verified and signed by the FSO or Alternate FSO and submitted to the ATC Security Manager. This roster shall be updated as required to reflect any changes in employee’s status or information. At the conclusion of this contract, the FSO or Alternate FSO, will submit a termination letter to the ATC Visitor Desk and a copy sent to the ATC Security Manager. Contract personnel whose security clearances are suspended shall not be permitted to work under this contract until their security clearance is reinstated.

Information Systems (IS) Access. The contractor shall designate Information Technology (IT) positions for all personnel requiring access to IS in accordance with Army Regulation 25-2, Information Assurance, Army Regulation 25-1, Army Knowledge Management and Information Technology Management, Army Regulation 380-67, Department of the Army Personnel Security Program and Army Regulation 380-5, Department of the Army Information Security Program. The positions under this contract are designated Information Technology (IT) 3. The contractor shall request the appropriate personnel security investigation based upon the IT position designation. The investigations must be favorably completed prior to employees being permitted access to IS and being placed in an IT position. In accordance with Army Regulation 25-1, all

ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for Scientific and Engineering Support Contract To Be Determined) employees requesting access to an IS shall be required to sign an Acceptable Use Policy (AUP) and adhere to the policies outlined in the document regarding acceptable use of Government-owned computer systems and networks. This document will be reviewed and signed annually thereafter. Also, prior to gaining access to a government computer system, all employees must take initial Information Assurance (IA) training and annually thereafter. The contractor shall ensure that all IS used by contractor personnel are protected and accredited in accordance with Army Regulation 25-2 and related supporting directives and AUP guidance published by ATC.

Usage of Privately Owned Personal Electronic Devices (PEDs) Within the Restricted Area (RA). A privately owned personal electronic device (PED) is defined as a civilian multifunction cell phone, personal digital assistant, tablet, blackberry, digital inventory devices and electronic recording/storage devices. Contractor personnel shall not use the PED’s photographic/recording capability within the ATC Restricted Area (RA). The contractor shall not install or connect a privately owned PED to any government-owned computer or network system. Also, a PED that has the capability to store data cannot be connected to a government computer for purposes of charging the device’s battery. Contractor employees must use the appropriate wall adapter to charge a privately owned PED. All PEDs (government or personal) are prohibited in any area that contains a Secure Internet Protocol Router Network (SIPRNET) connection; in any area or briefing room where classified material is being discussed; and in any area designated as a Special Access Program (SAP) area. PEDs are authorized for private, non-work related matters. Under no circumstances will a privately owned PED be used to transmit sensitive government information.

Reports of Adverse Information. The contractor shall report to the ATC Security Manager all adverse information on contractor personnel such as security violations, arrests, bankruptcy, wage garnishments and denial, suspension, or revocation of security clearances. The ATC Security Manager may deny employees’ access into APG restricted areas based upon the adverse information.

Installation Access. All contractor personnel will comply with the requirements of

APGR 190-4, Movement Control Within the Installation, for entry, exit, and internal control of personnel, material, and vehicles on APG. To gain access to APG, DA Form 1602, Civilian Identification Card, shall be issued to contractors who do not require computer access or do not travel on official Government business upon written approval from the COR. All vehicles and personnel are subject to search and seizure of contraband and/or unauthorized Government property in accordance with AR 190-13, The Army Physical Security Program.

Access into Restricted Areas. Unescorted access will be permitted into the APG restricted areas provided the contractor employee was issued an interim SECRET clearance. If a contractor employee had a previously favorable National Agency Check (NAC) or a National Agency Check with Local Agency Check and Credit Check (NACLC) or a final SECRET

ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for Scientific and Engineering Support Contract To Be Determined) clearance with no more than 24 months of a break in service since the date of the termination of their security clearance and there is no known adverse information, the contractor employee can have unescorted access. Most areas of ATC are within the restricted areas of APG.

Photographic Security Identification Badges. Photographic security identification badges will only be issued to contractor personnel in accordance with APGR 190-4. Photographic security identification badges shall be approved and issued by ATC Security personnel to contractor personnel upon written request from the COR and after the investigation or security clearance has been verified by the visit authorization letter or a visit request submitted via JPAS. If a contractor employee needs to get additional areas on their photographic security identification badge, their government point of contact must send an email to ATC Security justifying why the individual needs the additional access. Contractor personnel shall wear the photographic security identification badges above the waist at all times when in the restricted areas of APG with the following exceptions: (a) when photography is ongoing and the employee is likely to be in the photograph, and (b) when the employee is actually working with a piece of equipment that could catch the security badge and endanger the safety of the employee. Contractor employees shall complete the IMAP Form 1199 (Badge Application) and the accompanying IMNE Form 1226 acknowledging guidelines for photographic security identification badges in order for a photographic security identification badge to be processed.

Common Access Card. All contractor employees who require computer access or travel on official Government business shall be issued a Department of Defense Common Access Card (CAC) through the Defense Enrollment Eligibility Reporting System (DEERS). CACs are processed in accordance with the guidelines for the Trusted Associate Sponsorship System (TASS). The contractor organization’s security manager gets the upcoming applicant vetted per requirements and forwards that information to the COR who is the Trusted Agent (TA) identified in the TASS. Once the TA receives the required information, it is entered into the TASS. The system generates an ID and new applicant password. The ID and password is forwarded to the applicant who will enter this information into TASS. The system will receive this information and it will notify the applicant with an approval email. Once the TA approves issuance of a CAC to the applicant through the TASS, the applicant can go to the nearest RAPIDS center with the proper Identification and will be processed for a CAC which will be issued to them on the spot.

Foreign Nationals/Immigrant Aliens. Foreign nationals/immigrant aliens cannot be granted unescorted access to the restricted area, and shall not be scheduled to perform work under this contract. However, when foreign nationals/immigrant aliens visit ATC, the contractor shall comply with AR 380-10, Foreign Disclosure and Contacts with Foreign Representatives.

Safeguarding Government Information and Property. The contractor shall be responsible for

Safeguarding all Government information and property provided for contractor use. The contractor shall safeguard information and material designated as classified, unclassified

ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for Scientific and Engineering Support Contract To Be Determined) sensitive, For Official Use Only (FOUO), Operations Security (OPSEC) sensitive, and Privacy Act Information in accordance with applicable directives stated in Item 13 (Security Guidance). Contractor personnel who have access to the Army Test and Evaluation Command (ATEC) Decision Support System (ADSS) will not disclose ADSS information to any person or entity without explicit authority. Government-furnished property will be secured in accordance with AR 190-51, Security of Unclassified Army Property (Sensitive and Nonsensitive).

Loss or Possible Compromise of Classified Information. The contractor shall immediately report the loss or possible compromise of classified information or material to the ATC Security Manager or his designee in accordance with ATC Regulation 380-5, Information Security program. In the event that there is a data spillage, the contractor will immediately notify their government supervisor, ATC Security Manager or his designee and the ATC Information Assurance Manager.

Key Control. The contractor shall have access as needed to all Government-furnished facilities in accordance with AR 190-11, Physical Security of Arms, Ammunition and Explosives, AR 190-51, Security of Unclassified Army Property (Sensitive and Nonsensitive), AR 380-5, Department of the Army Information Security Program and ATC Regulation 380-8, Security Key and Lock Control. The contractor shall develop and implement procedures to account for, control and safeguard metal and electronic keys and proximity cards received from the Government in accordance with above regulations.

Security Training. The contractor shall develop and implement a security education program to ensure contractor personnel understand and are familiar with security requirements. The contractor shall conduct security indoctrination for all new employees within 30 days after their arrival and refresher sessions annually thereafter. Upon completion of the security indoctrination, the contractor will have each employee sign the Standard Form (SF) 312 Classified Information Nondisclosure Agreement prior to granting access to classified information. The contractor will maintain the SF 312 on each employee and this document should be available to the government upon request. Contractor personnel may attend ATC’s annual refresher training; however, contractor personnel who are unable to attend the training shall receive the same training from contractor management. This training will include general security education, OPSEC awareness, Information Systems Security, Force Protection, and training on the Threat Awareness Reporting Program (TARP). Designated ATC Security personnel will conduct Anti-Terrorism/Force Protection training for contractor personnel traveling OCONUS. The FSO or the alternate FSO will provide through the COR a record of all contractor employees who have attended annual mandatory training by name and date of attendance to the ATC Security Manager.

ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for Scientific and Engineering Support Contract To Be Determined)

Operations Security. All written (hard copy) and electronic material produced by the contractor which will be disseminated outside of ATC will be subject to an OPSEC and Security review to be performed by the ATC OPSEC Officer prior to release. This includes all written (hardcopy) and electronic materials produced such as organizational press releases and marketing material. All information associated with a program that is indicated as unclassified/sensitive by the COR shall be afforded protection sufficient to preclude disclosure to individuals who do not have a need to know of the material. As a minimum, the following requirements apply:

a. Distribution of information/reports of this contract shall be limited to personnel associated with this contract and applicable Government personnel.

b. Documents/material shall be kept under lock and key when not in use.

c. Documents/material indicated by the COR as unclassified/sensitive which are no longer required shall be destroyed by shredding or by placing information in a box for destruction during a trip to the incinerator.

Disclosure of Proprietary and Intellectual Information. The contractor may be required to access data and information that is proprietary to another government agency, government contractor or of such a nature that its dissemination or use other than as specified would be adverse or contradictory to the government’s interest. The contractor and their employees shall not divulge or release data or information developed or obtained under this contract except to authorized government personnel or upon written approval from the Contracting Officer. The Contractor shall not use, disclose or reproduce proprietary data that bears a restrictive legend. The Contractor shall obtain written permission of the originator prior to releasing any information. Under Title 18, Sections 793 and 798, the Contractor and the Contractor employees are liable for any improper release. The Contractor will direct all inquiries, comments, or complaints arising from matters observed, experienced, or learned as a result of, or in connection with the performance of this contract to the Contracting Officer. The resolution of which may require dissemination of official information. In this case, the Contracting Officer, upon a request from the contractor, will coordinate with the ATC Security Manager or designee for guidance. Inquiries the Contractor receives for information relative to the Freedom of Information Act (FOIA) shall be directed to the Contracting Officer, or COR for evaluation. The Government retains the authority to release or deny access to the information. The Contractor shall be responsible for search and submission of records under the Contractors control upon Government request. All work, including but not limited to intellectual property and data rights, produced under this contract is the sole property of the Government.

Departing Employees. The contractor shall ensure all contractor employees return photographic security identification badges and Common Access Cards/ Identification

Cards and all permits issued by the Government at the completion of their employment. The turn in of these items will be completed no later than 24 hours after their departure. The contractor will ensure that all contract employees receive a security debriefing upon their

ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for Scientific and Engineering Support Contract To Be Determined) departure. Following the debriefing, the employee will sign the bottom portion of the SF 312. The contractor will ensure that all employees who maintain a hand receipt do not leave the installation until all items have been accounted for and all equipment under their control has been transferred to the new hand receipt holder. An employment/installation clearance procedure and checklist will be developed and implemented by the contractor to ensure that an employee has turned in all badges, Government property, and keys before leaving employment on the installation and access to the Local Area Network (LAN)/email has been cancelled. This checklist will contain a signature block for the ATC Security and Intelligence Division to initial to ensure all contract employees have cleared all aspects of employment at ATC. Security badges will be returned to the ATC Security and Intelligence Division on the employee’s last day of employment with the government. If departure is after normal business hours, the FSO will collect the badge on the last day of employment and turn the badge in to ATC Security and Intelligence Division the next business day. Keys and proximity cards will be returned to the issuing key custodian prior to the employee departing ATC. In addition, contractor personnel briefed on SAPs shall contact ATC Security personnel to complete a termination briefing prior to termination of employment.

Force Protection. The contractor shall ensure that each contractor employee receives annual Level I Antiterrorism awareness training per Army Regulation 525-13 (Antiterrorism). Contractor personnel may attend ATC’s annual Force Protection training; however, contractor personnel who are unable to attend the training shall receive the same training from contractor management.

ATTACHMENT THREE (FOUO Addendum for DD Form 254)

Contract Number: TBD

PROTECTING “FOR OFFICIAL USE ONLY” (FOUO) INFORMATION

1. GENERAL:

a. The “For Official Use Only” (FOUO) marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking, but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the freedom of Information Act (FOIA).

b. Other non-security markings, such as “Limited Official Use” and “Official Use Only” are used by non-DoD User agencies for the same type of information and should be safeguarded and handled in accordance with instruction received from such agencies.

c. Use of the above markings does not mean that the information cannot be released to the public under FOIA, only that the government must review the information prior to its release to determine whether significant and legitimate government purpose is served by withholding the information or portions thereof.

2. MARKINGS:

a. An unclassified document containing FOUO information will be marked “For Official Use Only” at the bottom of the front cover (if any), on the first page, on each page containing FOUO information, on the back page, and on the outside of the back cover (if any).

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked, “FOUO.”

c. Any “For Official Use Only” information released to a contractor by a DoD User Agency is required to be marked with the following statement prior to transfer.

“This document contains information EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FOIA. Exemptions apply.”

d. Removal of the “For Official Use Only” marking can only be accomplished by the originator or other competent authority. When the “For Official Use Only” status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: Contractors may disseminate “For Official Use Only” information to their employees and subcontractors who have a need for the information in connection with a classified contract. Contractors must ensure employees and subcontractors are aware of the special handling instructions detailed below.

ATTACHMENT THREE (Continuation of FOUO Addendum for DD Form 254)

Contract To Be Determined

4. STORAGE: During working hours, “For Official Use Only” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: “For Official Use Only” Information may be sent via first-class mail or parcel post. Bulky shipments may be sent by fourth-class mail. DoD components, officials of DoD components, and authorized DoD contractors, consultants, and grantees send FOUO information to each other to conduct official DoD business. Tell recipients the status of such information, and send the material in a way that prevents unauthorized public disclosure. Make sure documents that transmit FOUO material call attention to any FOUO attachments. Normally, you may send FOUO records over facsimile equipment. To prevent unauthorized disclosure, consider attaching special cover sheets, the location of sending and receiving machines, and whether authorized personnel are around to receive FOUO information. FOUO information may be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Mark the records “For Official Use Only” and tell the recipient the information is exempt from public disclosure under the FOIA and requires special handling.

6. DISPOSITION: When no longer needed, FOUO information must be shredded.

7. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of “For Official Use Only” information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions and disciplinary action may be taken against those responsible.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification

Aberdeen Proving Ground, MD 21005-5059

See Attachment Two (Continuation of Block 14) See Attachment Three (FOUO Addendum)

4310 Boothby Hill Avenue Aberdeen Proving Ground, MD 21005-3013 Address: Building 324 6867 Colleran Road Aberdeen Proving Ground, Maryland 21005-5059