Attachment 0003 DD254 Security Classification.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

the Huntsville-Decatur, Albertville, and Scottsboro, AL

Ref 10j. CUI information provided by DoD to contractors must be identified as such via the contracting vehicle, in whole or part, with all such documents, material, or media marked in accordance with DoDI 5200.48.

CUI, provided by DoD to, or generated by, non-DoD entities require protective measures and dissemination controls, including those directed by relevant law, regulation, or government-wide policy, and will be articulated in the contract, grant, or other legal agreement, as appropriate.

DoD contracts must require contractors to monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information. DoD contracts shall require contractors to report the potential classification of aggregated or compiled CUI to a DoD representative.

DoD personnel and contractors, pursuant to mandatory DoD contract provisions, will submit unclassified DoD information for review and approval for release in accordance with the standard DoD Component processes and DoDI 5230.09.

All CUI records must follow the approved mandatory disposition authorities whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and this issuance.

Ref 10k. The Contractor shall not release to anyone outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless—

• The Contracting Officer has given prior written approval; or

• The information is otherwise in the public domain before the date of release.

Requests for approval shall identify the specific information to be released, the medium to be used, and the purpose for the release. The Contractor shall submit its request to the Contracting Officer at least 45 days before the proposed date for release.

The Contractor agrees to include a similar requirement in each subcontract under this contract. Subcontractors shall submit requests for authorization to release through the prime contractor to the Contracting Officer.

Classified information processing at contractor facilities will be conducted in accordance with appropriate sections of the 32 CFR Part 117 NISPOM Rule.

Contractors requiring access to government information systems at government or contractor facilities will comply with AR 25-2 guidance.

Contractor access to SIPRNET via government accounts is restricted to sites directly related to meeting the requirements of this contract as validated by the COR and/or the Performance Work Statement/Statement of Work (PWS/SOW).

The contractor will not access INTELINK-S while on the SIPRNET without formal access authorization of the COR and AMAM-IS.

Requests for SIPRNet access will be forwarded to the project COR to facilitate the local vetting and approval process.

SIPRNET access via government accounts may not be subcontracted without prior written authorization of the Contracting Officer, COR and AMAM-IS.

*Prior to SIPRNET access, personnel must receive a NATO awareness briefing and complete Derivative Classification training.

*If SIPRNET is required at contractor facility, contractor shall coordinate with appropriate DSCA representatives. Access via Defense Information Systems Network (DISN) Secret Internet Protocol Routing Network (SIPRNET) dated 01 June 2013, or most current.

Ref 11c. Security Classification Guidance will be further delineated and provided in the subsequently issued Delivery/Task Order (DO/TO) and accompanying order-specific DD Form 254. The contractor shall utilize the most current Major End Item Security Classification Guide (SCG) for classification guidance. The SCG will be mailed under separate cover to the contractor Facility Security Officer (FSO). The contractor is authorized to release the SCG only to their subcontractors on this contract.

Ref 11f. Any classified information obtained, generated, or modified outside the United States will be given the same level of protection as stated within this document.

Ref 11g. Contractor access to DTIC information is restricted to contractual subject matter and PWS performance requirements. The GCA must certify the need-to-know for contractor access via the DD Form 1540.

Ref 11h. 32 CFR Part 117 NISPOM Rule and AR 380-40 apply to this contract.

Ref 11i. Per AR 380-27, Paragraph 2-6, the Government Contracting Activity (GCA) will identify any TEMPEST requirements within the United States to the Cognizant Security Agency (CSA) for approval prior to imposing requirements for TEMPEST countermeasures on contractors. The TEMPEST Countermeasure Review (TCR) will be conducted at the contractor’s facility where classified information or material is to be received, generated or stored electronically. Contractors may not impose TEMPEST countermeasures upon their subcontractors without GCA and CSA approval. In general, Defense Counterintelligence and Security Agency (DCSA) is the CSA, unless the contractor is located on an Army installation and DCSA is carved out, then the CSA will be the security office. The GCA must request a TCR from an Army CTTA (usarmy.meade.usacic.list.tsb-tempest@army.mil) who will provide the TEMPEST countermeasures to the GCA for submission to the CSA for approval. Any Government contractor can obtain necessary TEMPEST documents through their contracting officer representative.

Ref 11j. Contractor is required to develop an OPSEC Plan.

Ref 11m. IAW AR 381-12, Threat Awareness and Reporting Program (TARP), 1 June 2016, Contractors will report threat-related incidents, behavioral indicators and other matters of Counter Intelligence (CI) interest specified in Chapter 3, to the Facility Security Officer (FSO), the nearest military CI office, the FBI, or the DCSA. Contractor employees working as an integral part of the Army organization ARE REQUIRED TO COMPLETE ANNUAL Threat Awareness training. Contractor FSOs will ensure that all applicable AR 381-12 requirements are implemented for personnel who work at contractor facilities.

Concurrence of the Contracting Officer and G-2 (Intelligence and Security) will be obtained prior to issue of a Limited Access Authorization to a non-U.S. citizen in compliance with 32 CFR Part 117 NISPOM Rule. Controlled Unclassified information as defined in DoDI 5200.48, Controlled Unclassified Information (CUI), may be disclosed to U.S. persons who are employed by the prime contractor or subcontractors or to such employees who are foreign persons when requirements of export control and other laws are met. The contractor is responsible for compliance with all applicable laws and regulations governing access to Classified Information or Controlled Unclassified Information.

The contractor is not authorized to release any data to foreign nationals or foreign representatives without an approved export license.

Homeland Security Presidential Directive (HSPD) -12 requires that contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements of installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy.

IAW with DOD 5200.01, Volume 3, at a minimum, all on-site support contractors with access to classified information shall receive annual refresher training that reinforces the policies, principles, and procedures covered in their initial and specialized training. A record of completion shall be provided to the CSA.

Prior to subcontracting with a foreign industry the U.S. contractor will consult with the Contracting Officer and G-2 (Intelligence and Security). Foreign sub-contractors must agree that only citizens of their country or the U.S. will be allowed to perform on the contract. The U.S. contractor is responsible for complying with the regulations outlined in the International Traffic in Arms Regulations (ITAR).

The contracting officer shall not consent to any subcontract with a firm, or a subsidiary of a firm, that is identified by the Secretary of Defense in SAM Exclusions as being owned or controlled by the government of a country that is a state sponsor of terrorism unless the agency head states in writing the compelling reasons for the subcontract. (Reference FAR 209.405-2)

Classified information is, and remains for the duration of the classification, the property of the U.S. Government, regardless of proprietary claims. Contractor is authorized to process classified information via accredited computer system in accordance with 32 CFR Part 117.18.

Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the 32 CFR Part 117.13, and the use of a bibliography. The contractor shall utilize the current Marking Classified National Security Information guide to ensure classified information generated is properly marked. Contractor must provide adequate storage at their facility for classified material up to and including SECRET.

All classified material must be accounted for on a DA Form 3964 or contract equivalent form throughout each phase of the contract.

At the termination or expiration of this contract, the U.S. Government shall be contacted for proper disposition instructions.

Non-US Citizens or Representatives or Foreign Interests shall not have access to US Classified Military Information or Equipment, Network Computers that store or process US Government information, Any Source Codes, COMSEC Information or Equipment.

Electronically transmitted CUI shall be sent via: 1) encrypted email, 2) password protected/encrypted document, 3) Safe Access File Exchange at https://safe.apps.mil,or 4) an accredited information system with proper security controls.

Contractor personnel requiring access to U.S. Army Computer Networks must complete the Cyber Awareness Training, sign the Army IT User Agreement and an Acceptable Use Policy of the installation/facility where the access is required. A copy of the training certificate, user agreement, and AUP must be provided to the designated personnel at the Government facilities.

Co-located/embedded contractor personnel will be required to take the following training annually: Security Refresher, Cyber Awareness Challenge (Information Assurance), Operation Security (OPSEC), Anti-Terrorism Level I Training and Threat Awareness and Reporting Program (TARP). All training is provided on site by the Government. No delivery is required.

Contractor personnel shall abide by all Government Regulations (ARs 380-5, 380-10, 380-40, 381-12, 25-2, 25-55, 190-13, and 530-1) and Standard Operating Procedures when working or visiting Government facilities. Contractor personnel are not authorized to take pictures with any form of camera inside Government facilities or on military installations without prior coordination with the Public and Congressional Affairs Office.

Contractor personnel, with a Government .mil computer account, shall include their company name on the line after their name, in the signature block. This requirement shall be subcontracted down with the subcontractor company name being inserted. Contractor shall ensure all employees are aware of this requirement. Contractor personnel shall utilize company e-mail for transmitting official U.S. Government business. Official U.S. Government business shall NOT be transmitted via personal, private, and commercial e-mail accounts, i.e. YAHOO, HOTMAIL, GMAIL, JUNO, AOL, etc. U.S. Army Cargo Helicopter information shall NOT be processed or stored on contractor employees’ personal computer or any other personally owned electronic devices.

As of 10 August 2017, there is a new CAC SOP. (Department of the Army Trusted Associate Sponsorship System (TASS) Standard Operating Procedure and Army TASS Policy. he Cargo PO holds final determination on the approval for Common Access Cards (CACs). Consideration for a CAC will be addressed on a case-by-case basis. CACs will be considered for contractor employees that are deploying, that work full time on a military installation, and for contractor employees that require frequent access to multiple DOD installations in support of this contract for test. Contractor employees issued a CAC shall maintain possession of their CAC at all times, and shall not share their CAC PIN with anyone. The CAC will not be used in temporary badge exchanges. CACs will not be left unattended in computer. Justification, to include list of multiple DOD facilities, must be included with each request for a CAC.

CACs are the property of the U.S. Government and shall be given to the project or program office Security Manager or Government Trusted Agent (TA) upon termination of employment with the company, or upon contract completion. The loss of a CAC shall be reported, on the first business day following the discovery of the lost CAC, to your chain of command, FSO, COR, and to the issuing agency. Visit the Realtime Automated Personnel Identification System (RAPIDS) site at: http://www/dmdc.osd.mil/rsl/owa/home for issuing agency locations. A CAC is tied to an individual; not a contract number, contract company, or geographic location. Contractors leaving one TASS site ID for another within the same service (Army) must notify their current TA of their pending move so that a transfer of the contractor’s CAC from the losing TA site (identified by 6-digit site ID) to the gaining TA site can be coordinated through the Service Point of Contact (SPOC). Only “issued” and “approved” CAC applications are eligible for transfer between site IDs. It is evident that many contractors often leave without notifying the TA that they are going to another contract position, however some sites/installations have made policy to revoke CACs even when the transfer is known. Sites/organizations should refrain from this practice due to the resulting unnecessary expenditure of time and resources in reissuing a new CAC, as well as the unnecessary downtime for the contractor. Unauthorized possession of a CAC can be prosecuted criminally under section 701, title 18, United States Code. FAR 52.204-9 - Personal Identity Verification of Contractor Personnel (January 2011) applies to this contract.

Photocopying of U.S. Government Identification (CAC) is a violation of Title 18, U.S. Code Part I, Chapter 33, Section 701 and punishable by both fine and imprisonment. Although the asking for military/government identification is totally permissible by commercial establishments, there is a prohibition on duplication of government identification. A state driver license or other form of photo identification should be provided to be photocopied if an establishment insists on a photocopy of the traveler’s identification. Please ensure all employees are aware of this law.

Questions concerning any aspect of security will be referred to G-2 (Intelligence and Security), USAAMCOM for resolution.

Technical POC: Alan.F.Ruzicka.civ@army.mil - 256-313-5973, Alternate Technical POC: William.T.Ferguson.civ@army.mil - 256-842-2646

AT/OPSEC Requirements

1. AT Level I training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: http://jko.jten.mil.

2. AT Awareness Training for Contractor Personnel Traveling Overseas. This standard language requires US based contractor employees and associated subcontractor employees to make available and to receive government provided area or responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

3. iWATCH Training. The contractor and all associated sub‐contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 90 calendar days after contract award.

4. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the IS and then annually.

5. Information assurance (IA)/information technology (IT) training. All contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within 6 months of appointment to IA/IT functions.

6. For information assurance (IA)/information technology (IT) certification. Per DoD 8570.01-M, DFARS 252.239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

7. For contracts that require a formal OPSEC program. The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1. Contractor will also ensure all documents pertaining to this contract are properly marked and controlled IAW DoDI 5200.48

8. For contracts that require OPSEC training. Per AR 530-1, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

9. For contractors authorized to accompany the force. DFARS Clause 252.225-7040, Contractor Personnel Authorized to Accompany U.S. Armed Forces Deployed Outside the United States. The clause shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre-deployment requirements, required training (per combatant command guidance), and personnel data required.

10. For Contracts Requiring Performance of Delivery in a Foreign Country. DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors Outside the US. The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor's compliance with combatant commander and subordinate task force commander policies and directives.

11. Access and general protection/security policy and procedures. Contractor and all associated sub‐contractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204‐9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the government may require changes in contractor security matters or processes.

13. For contractors who do not require CAC, but require access to a DoD facility or installation. Contractor and all associated sub‐contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC‐III) and Terrorist Screening Database (TSDB) (Army Directive 2014‐05/AR 190‐13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

14. Contractor shall comply with FAR 52.204‐2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with— (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22‐M); (2) any revisions to DOD 5220.22‐M, notice of which has been furnished to the contractor.

15. Threat Awareness Reporting Program (TARP). For all contractors with security clearances. Per AR 381-12, Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a Counter Intelligence (CI) agent or other trainer as specified in 2-4b.

Program Manager LSFS-1

Redstone Arsenal, AL 35898 Address: AMCOM G2 5300 Martin Road Redstone Arsenal, AL 35898