Attachment 0003 Contract Security Classification (DD Form 254).pdf

(Updated 20250815) CLASSIFICATION (When filled in): Unclassified

CLASSIFICATION (When filled in): Unclassified PREVIOUS EDITION IS OBSOLETE. Page 1 of 10DD FORM 254, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

August 31, 2028

The public reporting burden for this collection of information, 0704-0567, is estimated to average 36 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED

(See Instructions)

Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

Secret

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

20251125

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

LOCKHEED MARTIN CORPORATION

5600 W SAND LAKE RD

ORLANDO, FL 32819-8907, USA

b. CAGE CODE

04939

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

E-MLB

7341 OFFICE PARK PLACE

MELBOURNE, FL 32940

(321) 610-9870

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor) Add Row Remove Last Row Delete All Rows

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.) Add Row Remove Last Row Delete All Rows

a. LOCATION(S) (For actual performance, see instructions.)

Apache Project Management Office Attn: SFAE-AVN-H Bldg 5307 Martin Road Redstone Arsenal, AL 35898

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional) PEO Aviation, PM Apache Attn: SFAE-AVN-H Bldg 5307 Martin Road Redstone Arsenal, AL 35898

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

This requirement is for a Lockheed Martin Contractor Field Service Representative (CFSR) to provide hardware and software support for the Apache Sensors portfolio, consisting of the Modernized Target Acquisition Designation Sight/Pilot Night Vision Sensor and Fire Control Radar systems.

PREVIOUS EDITION IS OBSOLETE. Page 2 of 10DD FORM 254, APR 2018

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.) h. FOREIGN GOVERNMENT INFORMATION

d. FORMERLY RESTRICTED DATA i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

See Item 13.

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDI 5200.48, only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

See Item 13.

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

PEO Aviation, SFAE-AV, Redstone Arsenal, Al., Apache Attack Helicopter Project Office approval is required prior to release.

Public Release Authority:

PEO Aviation, SFAE-AV, Redstone Arsenal, Al., Apache Attack Helicopter Project Office approval is required prior to release.

13. SECURITY GUIDANCE Add Signature Remove Last Signature Delete All Signatures

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable

PDF.)

10a. Classified COMSEC material is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. COMSEC access shall be IAW the 32 CFR 117 and AR 380-40. When access is required at Government facilities, contractor personnel will adhere to COMSEC rules and regulations as mandated by Command policy and procedures. Written concurrence of the KO is required prior to subcontracting. In addition, the prime contractor must notify the National Security Agency Central Office of Record before negotiating or awarding subcontracts.

The contractor shall maintain a valid U.S. COMSEC account throughout the period of performance of this contract.

All COMSEC/CCI equipment shall be controlled, and chain of custody maintained through a Standard Form 153. The contractor shall be responsible for the protection of COMSEC equipment from the time of receipt of the equipment until transferred via the completion of an SF-153, inventory, confirmation of end item (COMSEC) and serial numbers on the SF-153 with signatures.

PREVIOUS EDITION IS OBSOLETE. Page 3 of 10DD FORM 254, APR 2018

National Security Agency (NSA) Central Security Service (CSS), NSA/CSS Policy Manual No. 3-16 Control of Communication Security (COMSEC) Material.

10j. And 11l. Controlled Unclassified Information generated and/or provided under this contract is identified as (CUI) and shall be marked, safeguarded and protected in accordance with DoDI 5200.48.

Contractor will be provided with and will abide by DoD Regulation 5400.7, DoD Freedom of Information Act Program, and DoD 5200.01- M, Information Security Program.

Contractors are required to ensure all personnel receive and complete Initial and Annual Refresher CUI education and training and maintain documentation of this training for audit purposes.

Information designated as Controlled Unclassified Information (CUI), generated or provided under this contract shall be controlled, handled, stored, marked, safeguarded, transmitted, and destroyed IAW DoDI 5200.48, AR 380-5, AR 25-55, and AR 25-2. The contractor shall report the unauthorized disclosure of CUI to the Contracting Officer’s Representative. Electronically transmitted CUI shall be sent via

1) encrypted e-mail, 2) password protected/encrypted document, 3) Safe Access File Exchange at https://safe.apps.mil,or 4) an accredited information system with proper security controls.

DoD contracts must require contractors to monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information. DoD contracts shall require contractors to report the potential classification of aggregated or compiled CUI to a DoD representative.

DoD personnel and contractors, pursuant to mandatory DoD contract provisions, will submit unclassified DoD information for review and approval for release in accordance with the standard DoD Component processes and DoDI 5230.09.

All CUI records must follow the approved mandatory disposition authorities whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and this issuance.

Controlled Unclassified information as defined in DoDI 5200.48, Controlled Unclassified Information (CUI), may be disclosed to U.S.

persons who are employed by the prime contractor or subcontractors or to such employees who are foreign persons when requirements of export control and other laws are met. The contractor is responsible for compliance with all applicable laws and regulations governing access to Classified Information or Controlled Unclassified Information.

10k. For SIPRNET access: The contractor shall not access, download or further disseminate any special access data (i.e. intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the KO. Additionally, contractor will be required to complete Derivative Classification training along with a NATO briefing prior to access to the SIPRNET.

The Contractor shall not release to anyone outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless—• The Contracting Officer has given prior written approval; or The information is otherwise in the public domain before the date of release.

Requests for approval shall identify the specific information to be released, the medium to be used, and the purpose for the release. The Contractor shall submit its request to the Contracting Officer at least 45 days before the proposed date for release. The Contractor agrees to include a similar requirement in each subcontract under this contract. Subcontractors shall submit requests for authorization to release through the prime contractor to the Contracting Officer.

Contractor is authorized access to and an email account to the SECRET Internet Protocol Router Network (SIRPNet) at US Government facilities only. Contractor access to SIPRNet is restricted to sites directly related to meeting the requirements of this contract as validated by the Contracting Officer (KO)/Contracting Officer Representative (COR) and the Scope of Work. The contractor will not access INTELLINK-S, while on SIPRNet without formal access authorization of the COR. If subcontracting is permitted, the contractor *may* be authorized to subcontract access to SIPRNet at US Government facilities to subcontractors *Only* with an approved subcontracting plan and Government Contracting Officer written approval. Contractor shall not access, download, or further disseminate any information or data that falls outside the scope of execution of the defined contract requirements.

IF CLASSIFIED COMPUTER PROCESSING IS REQUIRED AT PRIME CONTRACTOR FACILITY: Classified AIS processing at the SECRET-level and below (collateral level) required at contractor locations identified in DD form 254, Block 6a. Classified processing will be in accordance with 32 CFR Part 117 NISPOM Rule Section 18.

IF ACCESS TO GOVERNMENT INFORMATION SYSTEMS IS REQUIRED: The Contractor shall adhere to IA regulations and security

PREVIOUS EDITION IS OBSOLETE. Page 4 of 10DD FORM 254, APR 2018 policies including the Federal Information Security Management Act (FISMA); AR 25-1 Army Information Technology; AR 25-2 IA;

Army BBPs; Any applicable DoD 8500 series Directives and/or Instructions and their associated references (Cyber security); National Institute of Standards and Technology (NIST) SP 800 series Special Publications (SP) and their associated references; CNSSI No. 1253 Security Categorization and Control Selection for National Security Systems; Chairman of the Joint Chiefs of Staff Instruction (CJCSI) and Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6000 Series; National Security Agency (NSA) Guides; Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs).

FOR CONTRACTOR PERSONNEL ACCESSING SIPRNET AT A CONTRACTOR FACILITY: Contractor access to SIPRNET via government accounts is restricted to only sites directly related to meeting the requirements of this contract as validated by the COR and/or the Statement of Work (SOW). The contractor will not access INTELLINK-S while on the SIPRNET without formal access authorization of the COR and AMSAM-ISI. SIPRNET access via government accounts may not be subcontracted without prior written authorization of the Contracting Officer, COR and AMSAM-IS in accordance with 32 CFR Part 117 NISPOM Rule.

FOR CONTRACTOR PERSONNEL ACCESSING SIPRNET AT A GOVERNMENT FACILITY: Contractor personnel working on-site at a government location may require access to the SIPRNET at the government location. The contractor shall not access, download, or further disseminate any special caveated data) i.e., intelligence, COMSEC, etc.) Outside the execution of the defined contract requirements and without the guidance and written permission of the contracting officer. In the event that access to any caveated information is required, the contracting officer must modify the requirements for the DD form 254. Individuals having access to SIPRNET require a NATO Awareness Briefing. Contractors requiring access to government information systems at government or contractor facilities will comply with AR 25-2 guidance.

11c. The contractor requires access to classified information up to and including (Secret) in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the provided classification guidance, Classified processing is authorized at the (enter classification level) level and must be accredited and monitored by DCSA.

All classified information, for the duration of the classification, received or generated under this contract is subject to the requirements of the 32 CFR Part 117 NISPOM Rule and is owned by, produced by or for, or is under control of the United States Government. Any employees derivatively classifying information will have training on how to properly do so annually. Information generated under this contract as of the effective date of this revision/new DD 254 will be marked IAW source documents.

Appropriate distribution statement will be added to newly generated documents.

UNLESS OTHERWISE APPROVED BY THE PROJECT OFFICE, ALL PRINTED AND DIGITAL TECHNICAL DOCUMENTS, SOFTWARE AND COST DATA SHALL BE SUBJECT TO EXPORT RESTRICTIONS AS FOLLOWS:

This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et. Seq.) or the Export Administration Act of 1979, as amended, Title 50, U.S.C., App. 2401 et. Seq. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DOD Directive 5230.25.

The below listed security classification guides (SCGs) apply to this specification. Contact the Government Contracting Officer’s Representative (COR) (as identified in the contract) for copies of the below identified SCGs. In the event that a security classification guide is superseded or replaced, it is the responsibility of the COTR to provide such guides to the contractor. The contractor will adhere to any/all changes IAW 32 CFR Part 117 NISPOM Rule. These guides may be released for subcontractor activities; however, they shall not be released to other activities without prior approval of the Contracting Officer:

AH-64 Apache Attack Helicopter (AAH) SCG Dated 27 July 2022

11d. During the performance of this contract it may be necessary for your company to store classified hardware. Due to the nature, size, or unique characteristics, it may not fit in an approved security container. Your company may have to establish approved restricted or closed area(s) IAW the 32 CFR Part 117 NISPOM Rule. Contractor must provide adequate storage at their facility for classified material up to and including SECRET. All classified material must be accounted for on a DA Form 3964 or contract equivalent form throughout each phase of the contract. At the termination or expiration of this contract, the U.S. Government shall be contacted for proper disposition instructions.

All classified information mailed to the UAS Project Office should be mailed to the address in block 17c below.

11f. IF THE PHYSICAL ADDRESSES ARE NOT KNOWN: Any classified information obtained, generated, or modified outside the United States will be given the same level of protection as stated within this document. Countries will include: (TBD).

11h. The contractor shall maintain a valid U.S. Communications Security (COMSEC) account throughout the period of performance of

PREVIOUS EDITION IS OBSOLETE. Page 5 of 10DD FORM 254, APR 2018 this contract. All COMSEC/Controlled Cryptographic Items (CCI) equipment shall be controlled and chain of custody maintained through a Standard Form 153. The contractor shall be responsible for the protection of COMSEC equipment from the time of receipt of the equipment until transferred via the completion of an SF-153, inventory, confirmation of end item (COMSEC) and serial numbers on the SF-153 with signatures. Government Contracting Agency (GCA) approval is required prior to granting COMSEC access to a subcontractor, refer to 32 CFR Part 117.21 (COMSEC) NISPOM. NSA/CSS Policy Manual 3-16, “Control of Communications Security (COMSEC) Material”

11i. TEMPEST Information is not releasable to contractor employees who have not received a FINAL Clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting.

Per AR 389-27, Paragraph 2-6, A TEMPEST Countermeasures Review (TCR) will be conducted by an Army Certified TEMPEST Technical Authority (CTTA). TCR will be requested by the GCA via secure e-mail address 902d310thTEMPEST@mi.army.smil.mil upon award of the contract. The TCR will be conducted at the contractor’s facility where classified information or material is to be received, generated or stored electronically. Results of the TCR will be provided to the contractor who will ensure that all applicable AR 380-27 requirements are implemented. Prime contractors cannot impose TEMPEST countermeasures upon subcontractors without GCA or CSA approval.

11j. IF REQUIRED TO COMPLY WITH GCA OPSEC PLAN: Contractor is required to comply with the GCA OPSEC Plan which will be provided upon award of the contract, and the AT/OPSEC requirements stipulated in this document.

GCA approval is required prior to imposing OPSEC requirements on a subcontractor

The contractor will comply with all security and OPSEC policies, directives, instructions or mandates as directed. OPSEC and other security guidance issued to the Prime Contractor shall also apply to subcontractors working on this effort.

The contractor will ensure compliance with the Agency’s OPSEC Policy Statement, Critical Information List (CIL), and unclassified document destruction procedures. Items of critical information are those facts, which individually, or in the aggregate, reveal sensitive details about the mission, operation, etc., and thus require protection from adversarial collection or exploitation.

Include OPSEC as part of the security awareness program. The contractor shall be familiar with OPSEC and will be required to take government furnished initial and annual refresher OPSEC training and will be reminded of their continued responsibility to protect sensitive information as directed by DoDM 5205.02. Sensitive unclassified information includes, but is not limited to, agency identified critical information, legacy For Official Use Only (FOUO), Controlled Unclassified Information (CUI), Privacy Act of 1974, Personally Identifiable Information (PII), Department of Defense Unclassified Controlled Nuclear Information (DoD UCNI) and company proprietary information.

11l. SAME AS 10J

11m.

Co-located/embedded contractor personnel will be required to take the following training annually: Security Refresher, Cyber Awareness Challenge (Information Assurance), Operation Security (OPSEC), Anti Terrorism Level I Training and Counterintelligence Awareness and Reporting (CIAR). All training is provided on site by the Government. No delivery is required. Training is offered by the Government so no delivery will be required. Training verification/certifications will be provided to the COR or the FSO. Training certificates will be made available ot the Government upon request.

IAW AR 381-12, Counterintelligence Awareness and Reporting (CIAR), Contractors will report threat-related incidents, behavioral indicators and other matters of Counter Intelligence (CI) interest specified in Chapter 3, to the Facility Security Officer (FSO), the nearest military CI office, the FBI, or the DCSA.

12. Public Release of SCI information is not authorized.

Within the DA, the public release of official U.S. Army information regarding Project Office will be IAW the provisions of AR 360-1. The contractor is not authorized to release any information, record, or data obtained to any one not associated with this contract without written consent of the Contracting Officer. Additionally, the contractor is not authorized to release any data to foreign nationals or foreign representative without an approved export license. The PEO Aviation Foreign Disclosure Officer must review all data prior to actual release. The submissions shall include a letter of transmittal certifying the review by the FSO that the material has been reviewed and it contains no classified information. The letter of transmittal shall include the contract number. A minimum of 15 Government working days are required to process and review the request. Information or material will not be released until approval is granted.

13 Additional security guidance.

FOR Secret contracts: The DD 254 will be housed within the NCCS through the life of the contract. The Contractor shall be registered

PREVIOUS EDITION IS OBSOLETE. Page 6 of 10DD FORM 254, APR 2018 within NCCS at time of award to gain access to the DD 254. It is incumbent upon the Contractor to ensure that the necessary security paperwork is submitted in sufficient time to enable each individual to be cleared prior to beginning work on this contract. In the event that the NCCS is superseded by another System of Record, the same requirements apply.

a. Facility Security Clearance: The Contractor shall possess and maintain a facility clearance granted by the Defense Counterintelligence and Security Agency (DCSA). The Contractor's employees, performing work in support of this contract (not technicians as stated below) will require security clearance/eligibility determination based on a favorably adjudicated T5 or T5R with SCI eligibility; be within investigation scope and/or currently enrolled in Continuous Evaluation (CE) / Continuous Vetting (CV) at the time of contract award and throughout the life of the contract to include all potential option years identified in this PWS. The Contracting Officer will maintain the DD254 in the Official Contracts Records.

b. Contractor personnel performing or assigned under this contract must be U.S. persons.

c. Contractor is not authorized to subcontract on this effort without an approved subcontracting plan with written GCA/COR authorization.

d. The Contractor shall comply with (1) Security Agreement (DD Form 441/DD Form 441-1), including the National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-M and any revisions and (2) 32 CFR, Part 117.Provisions of the Privacy Act apply to all records and reports maintained by the contractors.

e. Prior to granting an employee access to classified information and/or materials, the contractor shall brief employees with regard to their obligation to comply with the NISPOM, to include any changes and/or amendments, and 32 CFR, Part 117. The contractor will be required to have Initial security training and annually thereafter. The contractors employees shall be debriefed when access to the material is no longer needed or is terminated. A list of all employees who have had access to classified information during the period of this contract shall be maintained by the contractor company and be available for Defense Counterintelligence and Security Agency (DCSA) inspection. The contractor will require initial security training and annually thereafter.

f. Access to General Protection/Security Policies and Procedures. All contractor employees, including subcontractor employees stationed or assigned on a US Government facility shall comply with applicable installation, facility access procedures and local security policies (provided by the US Government security personnel). The contractor workforce shall comply with all personal identification verification requirements as directed by local policy. In addition to the changes otherwise authorized by the changes clause in this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the US Government may require changes in the contractor security processes or procedures.

g. Common Access Cards (CACs) are authorized for contractor employees that work on-site at Government facilities. CACs are the property of the US Government and shall be given to the COR or TA upon termination of employment with the company, expiration of the CAC, replacement of a CAC, or upon contract completion. The loss of a CAC shall be reported on the first business day following the discovery of the lost CAC to your chain of command and to the issuing agency. Unauthorized possession of a CAC can be prosecuted criminally under section 701, title 18, United States Code. Photocopying of US Government Identification (CAC) is a violation of Title 18, US Code Part 1, Chapter 33, Section 01 and punishable by both fine and imprisonment.

A CAC is tied to an individual, not a contract number, contract company, or geographic location. Contractors leaving one TASS site ID for another within the same service (Army) must notify their current Trusted Agent (TA) of their pending move so that a transfer of the contractor’s CAC from the losing TA site (identified by 6-digit site ID) to the gaining TA site can be coordinated through the Service Point of Contact (SPOC). Only “issued” and “approved” CAC applications are eligible for transfer between site IDs.

CACs will be considered for contractor employees that are deploying, that work full time on a military installation, and for contractor employees that require frequent access to multiple DoD installations in support of this contract. Justification, to include list of multiple DoD facilities, must be included with each request for a CAC. Contractor employees issued a CAC shall maintain possession of their CAC at all times. The CAC will not be used in temporary badge exchanges. Contractor employees issued a CAC shall not share their CAC PIN with anyone. CAC will not be left unattended in a computer. The Government Security Manager shall return the CAC to the Government Contracting Officer Representative (COR) or to Military Processing Operations (MILPO).

Photocopying of US Government Identification (CAC) is a violation of Title 18, US Code Part I, Chapter 33, Section 701 and punishable by both fine and imprisonment. Although the asking for military/government identification is totally permissible by commercial establishments, there is a prohibition on duplication of government identification. A state driver license or other form of photo identification should be provided to be photocopied if an establishment insists on a photocopy of the traveler’s identification. Please ensure all employees are aware of this law.

h. All programs and materials developed at government expense during the performance period of this contract are the property of the US Government.

PREVIOUS EDITION IS OBSOLETE. Page 7 of 10DD FORM 254, APR 2018

i. Contractors requiring access to US Government Information Technology (IT) systems must adhere to all US Government requirements.

All contractor employees and any associated subcontractor employees shall annually complete the DoD Information Assurance Training and sign an Acceptable Use Policy (AUP). The training certificate and AUP must be provided to the designated personnel at US Government facilities before issuance of network access and annually thereafter. Contractor personnel will be required to register at the Army Training and Certification Tracking System (https://afc.us.army.mil/iastar/index.php) and upload copies of their signed AUP and training.

j. Contractor shall prepare a Security Plan for Controlling access to US Government Information when Non-US Citizens or Representatives of Foreign Interests are resident in or visitors at the Contractor Facility.

k. Visit Requests: Contractor shall request Visit Authorization Request (VAR) to be sent via Defense Information System for Security (DISS) through PEO AVN Security Manager three days prior to visit. All VARs shall include the Technical POC and their telephone number, receiving SMO Code and name of subject meeting. VAR shall not exceed a one year period or beyond the end of the contract if less than one year.

(SMO: W6DQAA-PEO AVN, PM APA-118).

l. FDO: Concurrence of the Contracting Officer and PEO Aviation Foreign Disclosure Officer will be obtained prior to issue of a Limited Access Authorization to a non-US citizen in compliance with the 32 CFR Part 117 NISPOM. Controlled Unclassified Information as defined in IAW DODI 5200.48, may be disclosed to US persons who are employed by the prime contractor or subcontractor, or to such employees who are foreign persons when requirements of export control and other laws are met. The contractor is responsible for compliance with all applicable laws and federally mandated regulations governing access to Classified Information or Covered Defense Information (CDI). (DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting).

m. Contractor personnel are not authorized to take pictures with any form of camera inside Government facilities or on military installations without prior coordination and approval of the Public Affairs and the Security office.

n. Contractor personnel shall abide all Government Regulations, Policies and Standard Operating Procedures when working or visiting Government facilities.

o. Contractor personnel shall utilize Defense Information Systems Agency (DISA) or company e-mail for transmitting official U.S.

Government business. Official U.S. Government business shall not be transmitted via personal, private, and commercial e-mail accounts, i.e., YAHOO, HOTMAIL, GMAIL, JUNO, etc. US Army information shall NOT be processed or stored on contractor employee’s personal computer or any other personally owned electronic devices.

p. CYBER Security: Any loss, compromise or suspected compromise of classified information, foreign or domestic, shall be reported to Security Manager and Cybersecurity Task Lead.

IAW AR 381-12, Counterintelligence Awareness and Reporting (CIAR). Contractors shall report threat-related incidents, behavioral indicators, and other matters of Counter Intelligence (CI) interest specified in Chapter 3, to the Facility Security Officer (FSO), the nearest military CI office, the Federal Bureau of Investigation, or the Defense Counterintelligence and Security Agency (DCSA). Contractor employees working as an integral part of an Army organization shall complete annual Threat Awareness training in conjunction with Army personnel. Contractor FSOs shall ensure that all applicable AR 381-12 requirements are implemented for personnel who work at contractor facilities.

q. The contractor is not authorized to release any data to foreign nationals or foreign representatives without an approved export license.

r. A copy of all subcontract DD 254’s shall be provided to the Apache PO Security Manager, via US Post Office, ACCS, fax or e-mail.

Questions concerning any aspect of security will be referred to the Apache PO Security Manager, phone 520-725-2073.

s. All compromises or suspected compromises of classified information will be reported within 24 hours to the Apache PO Security Office.

The ESTIMATED date of completion for this contract is 31 DEC 2030.

The Technical POC for this contract is Sarah Caldwell, PM Apache, 520-684-1198, sarah.k.caldwell2.civ@army.mil

The COR for this contract is Carl Jonas, PM Apache, 520-684-1488, carl.k.jonas.civ@army.mil

The Security POC for this contract is Tony Landen Vickery, Apache PO, SFAE-AVN-H, 520-725-2073, tony.l.vickery.civ@army.mil.

PREVIOUS EDITION IS OBSOLETE. Page 8 of 10DD FORM 254, APR 2018

t. Prior to subcontracting with a foreign industry the U.S. contractor will consult with the Contracting Officer and G-2 (Intelligence and Security). Foreign sub-contractors must agree that only citizens of their country or the U.S. will be allowed to perform on the contract. The U.S. contractor is responsible for complying with the regulations outlined in the International Traffic in Arms Regulations (ITAR).

The contracting officer shall not consent to any subcontract with a firm, or a subsidiary of a firm, that is identified by the Secretary of Defense in SAM Exclusions as being owned or controlled by the government of a country that is a state sponsor of terrorism unless the agency head states in writing the compelling reasons for the subcontract. (Reference FAR 209.405-2)

ITEM 14

A Program Protection Plan (PPP) and supporting annexes will be provided as Government Furnished Information (GFI), as per DODI 5200.39, dated 28 DEC 2010. The contractor will follow guidance in the PPP and annexes to ensure protection of Critical Program Information (CPI) identified in the PPP. Requests for clarification will be made to the Program Manager (PM) not later than 30 days from receipt of the PPP, its annexes, or updates thereof. Any modifications or deviations to the PPP will be made in writing by the PM. The contractor will, as requested by the government, provide input to updates of the PPP and associated annexes to include participation in the CPI identification process.

The contractor shall ensure that any program with CPI or CTI has the corresponding supplements and associated plan, such as an OPSEC plan, approved and in effect in support of the PPP.

AT/OPSEC:

1. AT Level I training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I Awareness training within calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within calendar days after completion of training by all employees and subcontractor personnel. AT level I Awareness training is available at the following website: http://jko.jten.mil.

2. Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204‐9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

2a. For contractors requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014‐05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on‐site or remotely; (2) remote access, via logon, to a DoD network using DoD‐ approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non‐DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

3. AT Awareness Training for Contractor Personnel Traveling Overseas. This standard language required US based contractor employees and associated subcontractor employees to make available and to receive Government provided area of responsibility (AOR)-specific AT awareness training as directed by AR 525‐13. Specific AOR training content is directed by the combatant commander, with the unit ATO being the local point of contact.

4. iWATCH Training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. The contractor and all associated sub‐contractors shall brief all employees on the local iWATCH Army program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within calendar days of contract award and within calendar days of new employees commencing performance with the results reported to the COR NLT calendar days after contract award.

PREVIOUS EDITION IS OBSOLETE. Page 9 of 10DD FORM 254, APR 2018

5. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to a Government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services and must successfully complete the DOD Information Assurance Awareness prior to access to the information system and then annually thereafter.

6. For contracts that require OPSEC Training. Per AR 530‐1, Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

7. For IA/IT training. All contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01‐M and AR 25‐2 within six months of appointment to IA/IT functions.

8. For contractors authorized to accompany the force. DFARS Clause 252.225‐7040, Contractor Personnel Authorized to Accompany U.S.

Armed Forces Deployed Outside the United States, shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre‐deployment requirements, required training (per combatant command guidance), and personnel data required.

9. For Contract Requiring Performance or Delivery in a Foreign Country, DFARS Clause 252.225‐7043, Antiterrorism/Force Protection for Defense Contractors Outside the US . The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non‐contingency support. The key AT requirement is for non‐local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’ compliance with combatant commander and subordinate task force commander policies and directives.

10. For contracts that require handling or access to classified information. Contractor shall comply with FAR 52.204‐2, Security Requirements. This clause involves access to information classified “Confidential”, “Secret”, or “Top Secret” and requires contractors to comply with (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22‐M); (2) any revisions to DOD 5220.22‐M, notice of which has been furnished to the contractor.

11. Controlled Unclassified Information (CUI). Include DFARS clause 252.204-7012, which requires the contractor to comply with NIST 800-171. Also include DFARS provision 252.204-2019 into solicitations. Acquisition officials should follow procedures outlined in DFARS 204.73 and verify vendors have an adequate NIST SP 800-171 summary assessment score within the Supplier Performance Risk System (within PIEE). If the score doesn't show a medium- or high-level assessment with a score of 110 or better (as described in the "NIST SP 800-171 DoD Assessment Methodology"), include clause 252.204-7020 and obtain the vendor's "system security plan" and "plan of action" for NIST SP 800-171 verification and assurance by Army security officials.

12. Counterintelligence Awareness and Reporting. For all contractors with security clearances. Per AR 381-12 Counterintelligence Awareness and Reporting (CIAR), contractor employees must receive annual CIAR training by a CI agent or other trainer as specified in 2-4b.

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form) Show Attachment Bar

I certify the validity of the security requirements in this DD Form 254.

NAME & TITLE OF REVIEWING OFFICIAL

Tony Landen Vickery Superv. Security Specialist, PM Apache

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

See PEO AVN Policy Memorandum 22-02,OPSEC Plan; See Item 13 for TEMPEST requirements. See Item 13 for CIAR requirements. See Item 13 for additional requirements. Any loss, compromise, or suspected compromise of classified information, foreign or domestic, will be report to the PM Apache Security Manager within 2 business days of discovery.

15. INSPECTIONS

PREVIOUS EDITION IS OBSOLETE. Page 10 of 10DD FORM 254, APR 2018

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

ACC - Redstone

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

W58RGZ

c. ADDRESS (Include ZIP Code)

5303 Martin Road Redstone Arsenal AL 35898

d. POC NAME Jessica T. Mangum

e. POC TELEPHONE (Include Area Code)

+1 (520) 674-8310

f. EMAIL ADDRESS (See Instructions) jessica.t.mangum.civ@army.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

Jonas, Carl, K

b. TITLE

Acquisition Analyst (COR)

c. ADDRESS (Include ZIP Code)

5307 Martin Road Redstone Arsenal, AL 35898

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

W58RGZ

e. CAGE CODE OF THE PRIME CONTRACTOR

(See Instructions.)

04939

f. TELEPHONE (Include Area Code)

+1 (520) 684-1488

g. EMAIL ADDRESS (See Instructions) carl.k.jonas.civ@army.mil

h. SIGNATURE

i. DATE SIGNED (See Instructions)

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

(Updated 20250815)

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

August 31, 2028 The public reporting burden for this collection of information, 0704-0567, is estimated to average 36 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil.