Attach 5a - DD 254 Continuation Sheet.pdf

CONTINUATION OF DD FORM 254 FOR SOLICITATION, FA9451-20-S-0002

Item 12: In order to comply with DFARS 252.204-7000, Disclosure of Information, the items of the information to be released are required at least 45 days prior to the scheduled release date. Per AFI 10-701, all requested released items must have an OPSEC security and policy review prior to a release approval. The Technical Point of Contact will load the requested public release requested document for the Contractor to the AFRL internal review process in the OPSEC Tool application to meet the OPSEC security and policy review requirement. Once approved, the document will receive a Public Affairs release number. Final approval must occur prior to release outside of government channels. Items submitted through the review process must derive from a government representative if being released by a DoD contractor. Unclassified information does not equal publically releasable. Information requiring AF or DoD-level review will be forwarded by the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330- 1690. MAJCOM/DRUs will send information requiring AF or DoD-level review directly to SAF/PAX. NO

PUBLIC RELEASE IS AUTHORIZED FOR NON-SCI.

Item 13. (Continuation):

Contractor shall follow security classification guidance on information, hardware and equipment as provided in the following security classification guides: Directed Energy Weapons (DEWS) Technology Security Classification Guide (SCG) dated 31 January 2018. A revised DD 254 will need to prepared by the Program Manager if the Security Classification Guide changes and will be provided under separate cover. Document classification markings will be done in accordance with E.O. 13526 and DoDM 5200.01, Volume 2, Marking of Classified Information, 24 Feb 2012, and supplements thereto. The contractor must comply with special OPSEC requirements contained in the contract or addendum thereto. The requirements, restrictions and other safeguards prescribed by the National Industrial Security Program Operating Manual (NISPOM), DoD 5200.22- M, Feb 2006 and its supplements apply to all classified performance. The prime contractor must contact AFRL/RDMSC at (505) 846-3310, AFRL Industrial Security Oversight Office for execution of the Visitor Group Security Agreement (VGSA), and submit a company letter identifying on-site key personnel management officials or company representatives and a security focal point of contact for security related matters (normally FSO) prior to on-base operations. Prime contractor is responsible to ensure on-base subcontractors execute a VGSA with AFRL/RDMSC prior to on-base operations. The prime contractor must include a provision in each on-base subcontract requiring subcontractors to contact AFRL/RDMSC and execute a VGSA prior to beginning on-base operations.

Government Project Manager: Mr. Remington Reid, AFRL/RDHP, 3550 Aberdeen SE, Kirtland AFB, NM 87117, 505-846-1032.

BAA’s/Solicitations are only signed by the Contracting officer in Item 17.

AFRL/RDK, Jaclyn Torres, Contracting Officer, 3550 Aberdeen SE, Kirtland, AFB, NM 87117:

______________________________________ Date ___________

AFRL/RDMSC, Industrial Security, 3550 Aberdeen SE, Kirtland AFB, NM 87117:

______________________________________ Date: ___________

AFRL/RDMSC, OPSEC, 3550 Aberdeen SE, Kirtland AFB, NM, 87117:

_____________________________________ Date: ___________

AFRL/RDMI, SIO, 3550 Aberdeen SE, Kirtland AFB, NM 87117:

_____________________________________ Date: ____________

AFRL/RVIC, ISSM/O (IA), 3550 Aberdeen SE, Kirtland AFB, NM 87117:

____________________________________ Date: _____________

AFRL/RDMS, Chief Information Protection (IP), Scott M. Green, 3550 Aberdeen Avenue SE Kirtland AFB, NM 87117:

____________________________________ Date: ______________

10.a.: The contractor will need administrative access to classified COMSEC material. The contractor will not receipt, copy, or generate classified COMSEC material.

10.e. (2): The contractor requires access to NON-SCI intelligence materials. Prior approval of the contracting activity is required for subcontracting. Access to intelligence information requires a final U.S. Government clearance at the appropriate level and will only be done at authorized government facilities. Non-SCI intel can be at the SECRET level.

10.h.: The contractor is permitted access to Foreign Government information. Access to Foreign Government information requires a final U.S. Government clearance at the appropriate level.

10.j.: See DoDM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI), Enclosures 3 & 4 for requirements.

10.k.: Access to SIPRNET is required in performance of this contract. NATO awareness briefing is required prior to having access to the SIPRNet.

11.c.: The contractor requires access to classified source data up to and including TOP SECRET in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, Chap. 4, and use of bibliography, classification, declassification, and markings will be in accordance with EO 13526 and the DoDM 5200.01, Volume 2, Marking of Classified Information, 24 Feb 2012, and supplements thereto.

11.g.: The contractor is authorized to use the services of Defense Technical Information Center (DTIC) and is required to prepare and process a DD Form 1540, Registration for Scientific and Technical Information Services, and DD Form 2345, Military Critical Technical Data Agreement. The contracting activity must be involved in certifying need-to-know to DTIC. If you need help registering or filling out the forms please contact the DTIC Office at 1-800-225-3847.

11.h.: COMSEC material/information may not be released to DOD contractors without approval from the 377 MSG/SCXS COMSEC Office. Contractors must forward requests for COMSEC material/information to the 377 MSG/SCXS COMSEC office. Contact 377 MSG/SCXS, 2000 Wyoming SE, Bldg. 20604, Room B-16, Kirtland AFB, NM 87117-5607 (505)846-1218/6822 for guidance.

11.i.: HAVE TEMPEST REQUIREMENTS: TEMPEST requirements are for off-base contracts.

TEMPEST requirements are in addition to the requirements of the NISPOM (DoD 5220.22-M). Contractors are required to comply with TEMPEST requirements according to AFMAN 17-1302. The government program manager and the contracting official must ensure such requirements are specifically include in the contract or appropriate information entered in Item 13. Classified processing for the purpose of TEMPEST application is defined as SECRET or higher classification. TEMPEST requirements apply to, but are not limited to; electric typewriters with special features such as memory, word processors, facsimile, computers, video displays, video recording/playing devices, and computer peripherals.

SENSITIVE INFORMATION:

Any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled under Section 552a of Title 5, U.S. Code (The Privacy Act), but which has not been specifically authorized under criterions established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy.

NOTE: Within the Air Force, sensitive information includes, but is not limited to, information which could:

(1) Be useful to a hostile agent in developing countermeasures.

(2) Involving new or high technology.

(3) Involve key indicators of operational capabilities which could be used by hostile agents to determine operational capabilities, weaknesses, and wartime missions.

Protecting. The application of government-approved protection equipment, devices, techniques or services to C4 systems over which sensitive information is transmitted.

Government - Approved Protection. Equipment or techniques that have been determined by National Security Agency (NSA) or the National Institute for Standards and Technology (NIST) to meet certain prescribed government security standards for the protection of sensitive information being transmitted over C4 systems.

Securing. Applying NSA-approved COMSEC Equipment, devices, techniques, or services to C4 systems over which classified information is transmitted.

11.l.: See DoDM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI) for requirements.

11.m.: See Section I of the general provisions for the clause titled Notification of Government Security Activity, AF FAR Sup 5352.204-9000 for on base classified processing. Prior to classified AIS processing off base, the contractor will ensure that computer systems comply with Chapter 8 of the NISPOM.

Item 14:

11.i.: For TEMPEST requirements the contractor shall provide countermeasures assessment data to the Contracting Officer (CO), with an informational copy to AFRL/RVIC, ISSM/O (IA), 3550 Aberdeen SE, Kirtland AFB, NM 87117, in the form of a TEMPEST Emission Security Protection Assessment Request

(ESPAR).

11.j.: OPSEC. The contractor shall provide operations security (OPSEC) protection for all sensitive/critical information in accordance with AFI 10-701 and the (RV/RD OPSEC Plan or specific Program OPSEC Plan).

The applicable Critical Information and Indicator List (CIIL) will be provided under separate cover. It is incumbent upon the contractor to request this document via the contracting officer or directly to the OPSEC Program Office. The contractor shall describe the steps necessary to protect sensitive and Critical Program Information (CPI) to their staff and communicate any sensitivity to the government for the work they complete.

The contractor will include OPSEC awareness, Program Protection, and Counter Intelligence education and awareness training to all personnel as part of their standard security program on an annual basis. New contracted employees shall be trained within 90 days. Technology Protection unique security measures may apply. The contractor must also adhere to any Program Protection Plans (PPP) that may cover the protection of sensitive and/or CPI under their respective contract. On-site/on-base contractors will participate in the ongoing efforts and requirements laid out by the PRS OPSEC Program and Program Protection Lead.

Items intended for public release shall be processed through the internal AFRL RD/RV review process (OPSEC Tool). Final approval must occur prior to release outside of government channels. Items submitted to the OPSEC Tool must derive from a government representative if being released by a DoD contractor. Unclassified information does not equal publically releasable. All information deemed FOUO or unclassified must be marked according to the originating office's instructions and AFI 61-201.

FOIA requests for information are to be worked by the government Office of Primary Responsibility (appointed by the 377th FOIA Office) and the AFRL FOIA office. An OPSEC assessment will be completed on all information being released via the FOIA.

In order to comply with DFARS 252.204-7000, Disclosure of Information, the items of the information to be released are required at least 45 days prior to the scheduled release date. Per AFI 10-701, all requested released items must have an OPSEC security and policy review prior to a release approval. The Contracting Officer and or Technical Point of Contact will load the requested public release requested document to the AFRL internal review process in the OPSEC Tool application to meet the OSPEC security and policy review. Once loaded and routed the release will flow to receive a public affairs final approved release number.

Proprietary information must be protected in accordance with non-disclosure and other applicable contractual (if any) agreements.

11.m.: The contractor will provide AFRL/RDMSC, 3550 Aberdeen Ave SE, Kirtland AFB, NM 87117, and the Servicing Security Activity (SSA) with all information required by the Notification of Government Security Activity Clause, and any additional information and/or documentation that is required by that office.

Item 15.:

Defense Counterintelligence and Security Agency (DCSA) is relieved of inspection responsibility for portions performed on Kirtland AFB more than 90 days a year. AFRL/RDMSC has security oversight for collateral work conducted on Kirtland AFB at the Phillips Research Site. The servicing security activity (SSA), AFRL/RDMSC, will maintain oversight, control and supervision of the contractor's work performance at Kirtland AFB, NM.

AFRL/RDMI has inspection oversight for Non-SCI Intelligence Classified.