Attachment 0008 DD Form 254 DoD Contract Security Classification Specification.pdf

(Updated 20250815) CLASSIFICATION (When filled in): Unclassified

CLASSIFICATION (When filled in): Unclassified PREVIOUS EDITION IS OBSOLETE. Page 1 of 10DD FORM 254, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

August 31, 2028

The public reporting burden for this collection of information, 0704-0567, is estimated to average 36 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED

(See Instructions)

Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

Secret

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER

W58RGZ-26-R-0004

DUE DATE (YYYYMMDD)

20251031

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

20250909

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.W58RGZ-22-C-0053

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE Longbow LLC 5600 Sand Lake Road Orlando, FL 32819-8907

b. CAGE CODE

04WF2

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional) Defense Counterintelligence and Security Agency

(IOFSM)

7341 Office Park Place, Suite 203 Melbourne, FL 32940

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor) Add Row Remove Last Row Delete All Rows

a. NAME, ADDRESS, AND ZIP CODE

FOR BIDDING PURPOSES ONLY. NOT VALID FOR

ACTUAL CONTRACT. UPON AWARD, SUBMIT

CONTRACT AWARD DD254 THROUGH

APPROPRIATE SECURITY CHANNELS FOR

CERTIFICATION.

b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.) Add Row Remove Last Row Delete All Rows

a. LOCATION(S) (For actual performance, see instructions.)

Longbow LLC 5600 Sand Lake Road Orlando, FL 32819-8907

See item 13.

b. CAGE CODE (If applicable, see Instructions.)

04WF2

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional) Defense Counterintelligence and Security Agency

(IOFSM)

7341 Office Park Place, Suite 203 Melbourne, FL 32940

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

Fire Control Radar (FCR) Life Cycle Contractor Support (LCCS) in support of the AH-64D/E Apache Helicopter. The contractor will provide repair of components., Items for the repair will come from the field to the repair facilities. Includes deliveries to US Forces to home base and deployed locations.

PREVIOUS EDITION IS OBSOLETE. Page 2 of 10DD FORM 254, APR 2018

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.) h. FOREIGN GOVERNMENT INFORMATION

d. FORMERLY RESTRICTED DATA i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

See Item 13.

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDI 5200.48, only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

See Item 13 & 14.

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

PEO Aviation, SFAE-AV, Redstone Arsenal, Al., Apache Attack Helicopter Project Office approval is required prior to release.

Public Release Authority:

PEO Aviation, SFAE-AV, Redstone Arsenal, Al., Apache Attack Helicopter Project Office approval is required prior to release.

13. SECURITY GUIDANCE Add Signature Remove Last Signature Delete All Signatures

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable

PDF.)

Item 1b. Classified information will not be transmitted to contractor facilities shown in item 6 and 8 until the appropriate safeguarding has been approved by and verified with the Defense Counterintelligence and Security Agency (DCSA).

Item 8a. Work shall also be performed on a TDY status at Government installations and other CONUS and OCONUS locations as required to support the requirements of this contract as validated by the Apache Project Office Technical Point of Contact (POC) and/or the Statement of Work/Performance Work Statement.

CONUS work locations include the following:

Name, Address and Zip Code:

Lockheed Martin Corporation - Missiles and Fire Control 5600 Sand lake Road

PREVIOUS EDITION IS OBSOLETE. Page 3 of 10DD FORM 254, APR 2018

Orlando, FL 32819-8907 Cage Code: 04939

Cognizant Security Office:

Defense Security Service (IOFSM) 7341 Office Park Place, Ste. 203 Melbourne, FL 32940

Name, Address and Zip Code:

Northrop Grumman Systems Corporations 1580-A West Nursery Road Linthicum, MD 21090 Cage Code: 15055

Cognizant Security Office:

Defense Security Service (IOFCL1) 7556 Teague Road, Ste. 580 Hanover, MD 21076

10j. And 11l. Controlled Unclassified Information generated and/or provided under this contract shall be marked, safeguarded and protected in accordance with DoDI 5200.48 Contractor will be provided with and will abide by DoD Regulation 5400.7, DoD Freedom of Information Act Program, and DoD 5200.01- M, Information Security Program.

Contractors are required to ensure all personnel receive and complete Initial and Annual Refresher CUI education and training and maintain documentation of this training for audit purposes.

Information designated as Controlled Unclassified Information (CUI), generated or provided under this contract shall be controlled, handled, stored, marked, safeguarded, transmitted, and destroyed IAW DoDI 5200.48, AR 380-5, AR 25-55, and AR 25-2. The contractor shall report the unauthorized disclosure of CUI to the Contracting Officer’s Representative. Electronically transmitted CUI shall be sent via

1) encrypted e-mail, 2) password protected/encrypted document, 3) Safe Access File Exchange at https://safe.apps.mil,or 4) an accredited information system with proper security controls.

DoD contracts must require contractors to monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information. DoD contracts shall require contractors to report the potential classification of aggregated or compiled CUI to a DoD representative.

DoD personnel and contractors, pursuant to mandatory DoD contract provisions, will submit unclassified DoD information for review and approval for release in accordance with the standard DoD Component processes and DoDI 5230.09.

All CUI records must follow the approved mandatory disposition authorities whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and this issuance.

Controlled Unclassified information as defined in DoDI 5200.48, Controlled Unclassified Information (CUI), may be disclosed to U.S.

persons who are employed by the prime contractor or subcontractors or to such employees who are foreign persons when requirements of export control and other laws are met. The contractor is responsible for compliance with all applicable laws and regulations governing access to Classified Information or Controlled Unclassified Information.

10k. For SIPRNET access: The contractor shall not access, download or further disseminate any special access data (i.e. intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the KO. Additionally, contractor will be required to complete Derivative Classification training along with a NATO briefing prior to access to the SIPRNET.

The Contractor shall not release to anyone outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless—• The Contracting Officer has given prior written approval; or The information is otherwise in the public domain before the date of release.

Requests for approval shall identify the specific information to be released, the medium to be used, and the purpose for the release. The Contractor shall submit its request to the Contracting Officer at least 45 days before the proposed date for release. The Contractor agrees to include a similar requirement in each subcontract under this contract. Subcontractors shall submit requests for authorization to release

PREVIOUS EDITION IS OBSOLETE. Page 4 of 10DD FORM 254, APR 2018 through the prime contractor to the Contracting Officer.

Contractor is authorized access to and an email account to the SECRET Internet Protocol Router Network (SIRPNet) at US Government facilities only. Contractor access to SIPRNet is restricted to sites directly related to meeting the requirements of this contract as validated by the Contracting Officer (KO)/Contracting Officer Representative (COR) and the Scope of Work. The contractor will not access INTELLINK-S, while on SIPRNet without formal access authorization of the COR. If subcontracting is permitted, the contractor *may* be authorized to subcontract access to SIPRNet at US Government facilities to subcontractors *Only* with an approved subcontracting plan and Government Contracting Officer written approval. Contractor shall not access, download, or further disseminate any information or data that falls outside the scope of execution of the defined contract requirements.

Classified AIS processing at the SECRET-level and below (collateral level) required at contractor locations identified in DD form 254, Block 6a, 7a, and 8a. Classified processing will be in accordance with 32 CFR Part 117 NISPOM Rule Section 18.

The Contractor shall adhere to IA regulations and security policies including the Federal Information Security Management Act (FISMA);

AR 25-1 Army Information Technology; AR 25-2 IA; Army BBPs; Any applicable DoD 8500 series Directives and/or Instructions and their associated references (Cyber security); National Institute of Standards and Technology (NIST) SP 800 series Special Publications (SP) and their associated references; CNSSI No. 1253 Security Categorization and Control Selection for National Security Systems; Chairman of the Joint Chiefs of Staff Instruction (CJCSI) and Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6000 Series; National Security Agency (NSA) Guides; Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs).

Contractor access to SIPRNET via government accounts is restricted to only sites directly related to meeting the requirements of this contract as validated by the COR and/or the Statement of Work (SOW). The contractor will not access INTELLINK-S while on the SIPRNET without formal access authorization of the COR and AMSAM-ISI. SIPRNET access via government accounts may not be subcontracted without prior written authorization of the Contracting Officer, COR and AMSAM-IS in accordance with 32 CFR Part 117 NISPOM Rule.

Contractor personnel working on-site at a government location may require access to the SIPRNET at the government location. The contractor shall not access, download, or further disseminate any special caveated data) i.e., intelligence, COMSEC, etc.) Outside the execution of the defined contract requirements and without the guidance and written permission of the contracting officer. In the event that access to any caveated information is required, the contracting officer must modify the requirements for the DD form 254. Individuals having access to SIPRNET require a NATO Awareness Briefing. Contractors requiring access to government information systems at government or contractor facilities will comply with AR 25-2 guidance.

11c. The contractor requires access to classified information up to and including (SECRET) in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the provided classification guidance, Classified processing is authorized at the (SECRET) level and must be accredited and monitored by DCSA.

All classified information, for the duration of the classification, received or generated under this contract is subject to the requirements of the 32 CFR Part 117 NISPOM Rule and is owned by, produced by or for, or is under control of the United States Government. Any employees derivatively classifying information will have training on how to properly do so annually. Information generated under this contract as of the effective date of this revision/new DD 254 will be marked IAW source documents.

Appropriate distribution statement will be added to newly generated documents.

UNLESS OTHERWISE APPROVED BY THE PROJECT OFFICE, ALL PRINTED AND DIGITAL TECHNICAL DOCUMENTS, SOFTWARE AND COST DATA SHALL BE SUBJECT TO EXPORT RESTRICTIONS AS FOLLOWS:

This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et. Seq.) or the Export Administration Act of 1979, as amended, Title 50, U.S.C., App. 2401 et. Seq. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DOD Directive 5230.25.

The below listed security classification guides (SCGs) apply to this specification. Contact the Government Contracting Officer’s Representative (COR) (as identified in the contract) for copies of the below identified SCGs. In the event that a security classification guide is superseded or replaced, it is the responsibility of the COTR to provide such guides to the contractor. The contractor will adhere to any/all changes IAW 32 CFR Part 117 NISPOM Rule. These guides may be released for subcontractor activities; however, they shall not be released to other activities without prior approval of the Contracting Officer:

THE AH-64 APACHE ATTACK HELICOPTER (AAH) SECURITY CLASSIFICATION GUIDE

(SCG) Dated 27 July 2022

PREVIOUS EDITION IS OBSOLETE. Page 5 of 10DD FORM 254, APR 2018

Anti-Tamper, dated 17 March 2010.

Anti-Tamper Security Classification Guide Change 1, dated 18 April 2011.

Anti-Tamper Security Classification Guide Change 2, dated 19 May 2014.

11d. During the performance of this contract it may be necessary for your company to store classified hardware. Due to the nature, size, or unique characteristics, it may not fit in an approved security container. Your company may have to establish approved restricted or closed area(s) IAW the 32 CFR Part 117 NISPOM Rule. Contractor must provide adequate storage at their facility for classified material up to and including SECRET. All classified material must be accounted for on a DA Form 3964 or contract equivalent form throughout each phase of the contract. At the termination or expiration of this contract, the U.S. Government shall be contacted for proper disposition instructions.

All classified information mailed to the UAS Project Office should be mailed to the address in block 17c below.

11f. Any classified information obtained, generated, or modified outside the United States will be given the same level of protection as stated within this document. Countries will only include those required and approved by the Apache Project Management Office.

11i. TEMPEST Information is not releasable to contractor employees who have not received a FINAL Clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting.

Per AR 389-27, Paragraph 2-6, A TEMPEST Countermeasures Review (TCR) will be conducted by an Army Certified TEMPEST Technical Authority (CTTA). TCR will be requested by the GCA via secure e-mail address 902d310thTEMPEST@mi.army.smil.mil) upon award of the contract. The TCR will be conducted at the contractor’s facility where classified information or material is to be received, generated or stored electronically. Results of the TCR will be provided to the contractor who will ensure that all applicable AR 380-27 requirements are implemented. Prime contractors cannot impose TEMPEST countermeasures upon subcontractors without GCA or CSA approval.

11j. IF REQUIRED TO COMPLY WITH GCA OPSEC PLAN: Contractor is required to comply with the GCA OPSEC Plan which will be provided upon award of the contract, and the AT/OPSEC requirements stipulated in this document. GCA approval is required prior to imposing OPSEC requirements on a subcontractor

The contractor will comply with all security and OPSEC policies, directives, instructions or mandates as directed. OPSEC and other security guidance issued to the Prime Contractor shall also apply to subcontractors working on this effort.

The contractor will ensure compliance with the Agency’s OPSEC Policy Statement, Critical Information List (CIL), and unclassified document destruction procedures. Items of critical information are those facts, which individually, or in the aggregate, reveal sensitive details about the mission, operation, etc., and thus require protection from adversarial collection or exploitation.

Include OPSEC as part of the security awareness program. The contractor shall be familiar with OPSEC and will be required to take government furnished initial and annual refresher OPSEC training and will be reminded of their continued responsibility to protect sensitive information as directed by DoDM 5205.02. Sensitive unclassified information includes, but is not limited to, agency identified critical information, legacy For Official Use Only (FOUO), Controlled Unclassified Information (CUI), Privacy Act of 1974, Personally Identifiable Information (PII), Department of Defense Unclassified Controlled Nuclear Information (DoD UCNI) and company proprietary information.

11l. SAME AS 10J

11m.

Co-located/embedded contractor personnel will be required to take the following training annually: Security Refresher, Cyber Awareness Challenge (Information Assurance), Operation Security (OPSEC), Anti Terrorism Level I Training and Counterintelligence Awareness and Reporting (CIAR). All training is provided on site by the Government. No delivery is required. Training is offered by the Government so no delivery will be required. Training verification/certifications will be provided to the COR or the FSO. Training certificates will be made available ot the Government upon request.

IAW AR 381-12, Counterintelligence Awareness and Reporting (CIAR), Contractors will report threat-related incidents, behavioral indicators and other matters of Counter Intelligence (CI) interest specified in Chapter 3, to the Facility Security Officer (FSO), the nearest military CI office, the FBI, or the DCSA.

12. Public Release of SCI information is not authorized.

Within the DA, the public release of official U.S. Army information regarding Project Office will be IAW the provisions of AR 360-1. The contractor is not authorized to release any information, record, or data obtained to any one not associated with this contract without written

PREVIOUS EDITION IS OBSOLETE. Page 6 of 10DD FORM 254, APR 2018 consent of the Contracting Officer. Additionally, the contractor is not authorized to release any data to foreign nationals or foreign representative without an approved export license. The PEO Aviation Foreign Disclosure Officer must review all data prior to actual release. The submissions shall include a letter of transmittal certifying the review by the FSO that the material has been reviewed and it contains no classified information. The letter of transmittal shall include the contract number. A minimum of 15 Government working days are required to process and review the request. Information or material will not be released until approval is granted.

13 Additional security guidance.

The DD 254 will be housed within the NCCS through the life of the contract. The Contractor shall be registered within NCCS at time of award to gain access to the DD 254. It is incumbent upon the Contractor to ensure that the necessary security paperwork is submitted in sufficient time to enable each individual to be cleared prior to beginning work on this contract. In the event that the NCCS is superseded by another System of Record, the same requirements apply.

a. Facility Security Clearance: The Contractor shall possess and maintain a facility clearance granted by the Defense Counterintelligence and Security Agency (DCSA). The Contractor's employees, performing work in support of this contract (not technicians as stated below) will require security clearance/eligibility determination based on a favorably adjudicated T3 or T3R with Secret eligibility; be within investigation scope and/or currently enrolled in Continuous Evaluation (CE) / Continuous Vetting (CV) at the time of contract award and throughout the life of the contract to include all potential option years identified in this PWS. The Contracting Officer will maintain the DD254 in the Official Contracts Records.

b. Contractor personnel performing or assigned under this contract must be U.S. persons.

c. Contractor is not authorized to subcontract on this effort without an approved subcontracting plan with written GCA/COR authorization.

d. The Contractor shall comply with (1) Security Agreement (DD Form 441/DD Form 441-1), including the National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-M and any revisions and (2) 32 CFR, Part 117.Provisions of the Privacy Act apply to all records and reports maintained by the contractors.

e. Prior to granting an employee access to classified information and/or materials, the contractor shall brief employees with regard to their obligation to comply with the NISPOM, to include any changes and/or amendments, and 32 CFR, Part 117. The contractor will be required to have Initial security training and annually thereafter. The contractors employees shall be debriefed when access to the material is no longer needed or is terminated. A list of all employees who have had access to classified information during the period of this contract shall be maintained by the contractor company and be available for Defense Counterintelligence and Security Agency (DCSA) inspection. The contractor will require initial security training and annually thereafter.

f. Access to General Protection/Security Policies and Procedures. All contractor employees, including subcontractor employees stationed or assigned on a US Government facility shall comply with applicable installation, facility access procedures and local security policies (provided by the US Government security personnel). The contractor workforce shall comply with all personal identification verification requirements as directed by local policy. In addition to the changes otherwise authorized by the changes clause in this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the US Government may require changes in the contractor security processes or procedures.

g. Common Access Cards (CACs) are authorized for contractor employees that work on-site at Government facilities. CACs are the property of the US Government and shall be given to the COR or TA upon termination of employment with the company, expiration of the CAC, replacement of a CAC, or upon contract completion. The loss of a CAC shall be reported on the first business day following the discovery of the lost CAC to your chain of command and to the issuing agency. Unauthorized possession of a CAC can be prosecuted criminally under section 701, title 18, United States Code. Photocopying of US Government Identification (CAC) is a violation of Title 18, US Code Part 1, Chapter 33, Section 01 and punishable by both fine and imprisonment.

A CAC is tied to an individual, not a contract number, contract company, or geographic location. Contractors leaving one TASS site ID for another within the same service (Army) must notify their current Trusted Agent (TA) of their pending move so that a transfer of the contractor’s CAC from the losing TA site (identified by 6-digit site ID) to the gaining TA site can be coordinated through the Service Point of Contact (SPOC). Only “issued” and “approved” CAC applications are eligible for transfer between site IDs.

CACs will be considered for contractor employees that are deploying, that work full time on a military installation, and for contractor employees that require frequent access to multiple DoD installations in support of this contract. Justification, to include list of multiple DoD facilities, must be included with each request for a CAC. Contractor employees issued a CAC shall maintain possession of their CAC at all times. The CAC will not be used in temporary badge exchanges. Contractor employees issued a CAC shall not share their CAC PIN with anyone. CAC will not be left unattended in a computer. The Government Security Manager shall return the CAC to the Government Contracting Officer Representative (COR) or to Military Processing Operations (MILPO).

PREVIOUS EDITION IS OBSOLETE. Page 7 of 10DD FORM 254, APR 2018

Photocopying of US Government Identification (CAC) is a violation of Title 18, US Code Part I, Chapter 33, Section 701 and punishable by both fine and imprisonment. Although the asking for military/government identification is totally permissible by commercial establishments, there is a prohibition on duplication of government identification. A state driver license or other form of photo identification should be provided to be photocopied if an establishment insists on a photocopy of the traveler’s identification. Please ensure all employees are aware of this law.

h. All programs and materials developed at government expense during the performance period of this contract are the property of the US Government.

i. Contractors requiring access to US Government Information Technology (IT) systems must adhere to all US Government requirements.

All contractor employees and any associated subcontractor employees shall annually complete the DoD Information Assurance Training and sign an Acceptable Use Policy (AUP). The training certificate and AUP must be provided to the designated personnel at US Government facilities before issuance of network access and annually thereafter. Contractor personnel will be required to register at the Army Training and Certification Tracking System (https://afc.us.army.mil/iastar/index.php) and upload copies of their signed AUP and training.

j. Contractor shall prepare a Security Plan for Controlling access to US Government Information when Non-US Citizens or Representatives of Foreign Interests are resident in or visitors at the Contractor Facility.

k. Visit Requests: Contractor shall request Visit Authorization Request (VAR) to be sent via Defense Information System for Security (DISS) through PEO AVN Security Manager three days prior to visit. All VARs shall include the Technical POC and their telephone number, receiving SMO Code and name of subject meeting. VAR shall not exceed a one year period or beyond the end of the contract if less than one year.

(SMO: W6DQAA-PEO AVN, PM APA-118).

l. FDO: Concurrence of the Contracting Officer and PEO Aviation Foreign Disclosure Officer will be obtained prior to issue of a Limited Access Authorization to a non-US citizen in compliance with the 32 CFR Part 117 NISPOM. Controlled Unclassified Information as defined in IAW DODI 5200.48, may be disclosed to US persons who are employed by the prime contractor or subcontractor, or to such employees who are foreign persons when requirements of export control and other laws are met. The contractor is responsible for compliance with all applicable laws and federally mandated regulations governing access to Classified Information or Covered Defense Information (CDI). (DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting).

m. Contractor personnel are not authorized to take pictures with any form of camera inside Government facilities or on military installations without prior coordination and approval of the Public Affairs and the Security office.

n. Contractor personnel shall abide all Government Regulations, Policies and Standard Operating Procedures when working or visiting Government facilities.

o. Contractor personnel shall utilize Defense Information Systems Agency (DISA) or company e-mail for transmitting official U.S.

Government business. Official U.S. Government business shall not be transmitted via personal, private, and commercial e-mail accounts, i.e., YAHOO, HOTMAIL, GMAIL, JUNO, etc. US Army information shall NOT be processed or stored on contractor employee’s personal computer or any other personally owned electronic devices.

p. CYBER Security: Any loss, compromise or suspected compromise of classified information, foreign or domestic, shall be reported to Security Manager and Cybersecurity Task Lead, (Robert Dudley, Robert.j.dudley1.civ@army.mil, 256-876-0825).

IAW AR 381-12, Counterintelligence Awareness and Reporting (CIAR). Contractors shall report threat-related incidents, behavioral indicators, and other matters of Counter Intelligence (CI) interest specified in Chapter 3, to the Facility Security Officer (FSO), the nearest military CI office, the Federal Bureau of Investigation, or the Defense Counterintelligence and Security Agency (DCSA). Contractor employees working as an integral part of an Army organization shall complete annual Threat Awareness training in conjunction with Army personnel. Contractor FSOs shall ensure that all applicable AR 381-12 requirements are implemented for personnel who work at contractor facilities.

q. The contractor is not authorized to release any data to foreign nationals or foreign representatives without an approved export license.

r. A copy of all subcontract DD 254’s shall be provided to the Apache PO Security Manager, via US Post Office, ACCS, fax or e-mail.

Questions concerning any aspect of security will be referred to the Apache PO Security Manager, phone 520-725-2073.

s. All compromises or suspected compromises of classified information will be reported within 24 hours to the Apache PO Security Office.

PREVIOUS EDITION IS OBSOLETE. Page 8 of 10DD FORM 254, APR 2018

The ESTIMATED date of completion for this contract is 31 December 2031.

The Technical POC for this contract is Erica Parsons, 520-684-0995, erica.m.parsons.civ@army.mil.

The COR for this contract is Erica Parsons, 520-684-0995, erica.m.parsons.civ@army.mil.

The KO for this contract is Jessica Mangum, 520-674-8310, Jessica.t.mangum.civ@army.mil The Security POC for this contract is Tony Landen Vickery, Apache PO, 520-725-2073, tony.l.vickery.civ@army.mil.

u. If foreign subcontractors are currently performing on this contract with access to U.S. Classified Military Information or Controlled Unclassified Information, the U.S. contractor will provide the Contracting Officer and G-2 (Intelligence and Security) with a list of the foreign subcontractors. The list will also include the country of origin, work being performed, export license number and by name and citizenship of any third party national citizen performing on the subcontract.

ITEM 14

A Program Protection Plan (PPP) and supporting annexes will be provided as Government Furnished Information (GFI), as per DODI 5200.39, dated 28 DEC 2010. The contractor will follow guidance in the PPP and annexes to ensure protection of Critical Program Information (CPI) identified in the PPP. Requests for clarification will be made to the Program Manager (PM) not later than 30 days from receipt of the PPP, its annexes, or updates thereof. Any modifications or deviations to the PPP will be made in writing by the PM. The contractor will, as requested by the government, provide input to updates of the PPP and associated annexes to include participation in the CPI identification process.

The contractor shall ensure that any program with CPI or CTI has the corresponding supplements and associated plan, such as an OPSEC plan, approved and in effect in support of the PPP.

AT/OPSEC: (enter only the items marked as “yes” on the AT/OPSEC coversheet)

1. AT Level I training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I Awareness training within calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within calendar days after completion of training by all employees and subcontractor personnel. AT level I Awareness training is available at the following website: http://jko.jten.mil.

2. Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204‐9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

2a. For contractors requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014‐05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on‐site or remotely; (2) remote access, via logon, to a DoD network using DoD‐ approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non‐DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

3. AT Awareness Training for Contractor Personnel Traveling Overseas. This standard language required US based contractor employees and associated subcontractor employees to make available and to receive Government provided area of responsibility (AOR)-specific AT awareness training as directed by AR 525‐13. Specific AOR training content is directed by the combatant commander, with the unit ATO being the local point of contact.

7. For contracts that require OPSEC Training. Per AR 530‐1, Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

8. For IA/IT training. All contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01‐M and AR 25‐2 within six months of appointment to IA/IT functions.

PREVIOUS EDITION IS OBSOLETE. Page 9 of 10DD FORM 254, APR 2018

10. For contractors authorized to accompany the force. DFARS Clause 252.225‐7040, Contractor Personnel Authorized to Accompany U.S. Armed Forces Deployed Outside the United States, shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre‐deployment requirements, required training (per combatant command guidance), and personnel data required.

11. For Contract Requiring Performance or Delivery in a Foreign Country, DFARS Clause 252.225‐7043, Antiterrorism/Force Protection for Defense Contractors Outside the US . The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non‐contingency support. The key AT requirement is for non‐local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’ compliance with combatant commander and subordinate task force commander policies and directives.

12. For contracts that require handling or access to classified information. Contractor shall comply with FAR 52.204‐2, Security Requirements. This clause involves access to information classified “Confidential”, “Secret”, or “Top Secret” and requires contractors to comply with (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22‐M); (2) any revisions to DOD 5220.22‐M, notice of which has been furnished to the contractor.

12a. Cont. If secure telecommunication requirements apply, include clause 252.239-7016 and follow guidance at 239.74.

13. Controlled Unclassified Information (CUI). Include DFARS clause 252.204-7012, which requires the contractor to comply with NIST 800-171. Also include DFARS provision 252.204-2019 into solicitations. Acquisition officials should follow procedures outlined in DFARS 204.73 and verify vendors have an adequate NIST SP 800-171 summary assessment score within the Supplier Performance Risk System (within PIEE). If the score doesn't show a medium- or high-level assessment with a score of 110 or better (as described in the "NIST SP 800-171 DoD Assessment Methodology"), include clause 252.204-7020 and obtain the vendor's "system security plan" and "plan of action" for NIST SP 800-171 verification and assurance by Army security officials.

14. Counterintelligence Awareness and Reporting. For all contractors with security clearances. Per AR 381-12 Counterintelligence Awareness and Reporting (CIAR), contractor employees must receive annual CIAR training by a CI agent or other trainer as specified in 2-4b.

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form) Show Attachment Bar

NAME & TITLE OF REVIEWING OFFICIAL

Tony Landen Vickery Security Manager, Apache PMO

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

See PEO AVN Policy Memorandum 18-04,OPSEC Plan; See Item 13 for TEMPEST requirements. See Item 13 for TARP requirements. See Item 13 for additional requirements. Any loss, compromise, or suspected compromise of classified information, foreign or domestic, will be report to the PM Apache Security Manager within 2 business days of discovery.

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

Army Contracting Command (Redstone)

PREVIOUS EDITION IS OBSOLETE. Page 10 of 10DD FORM 254, APR 2018

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

W58RGZ

c. ADDRESS (Include ZIP Code) Army Contracting Command (Redstone) 5303 Martin Road Redstone Arsenal, AL 35898

d. POC NAME Jessica Mangum

e. POC TELEPHONE (Include Area Code)

+1 (520) 674-8310

f. EMAIL ADDRESS (See Instructions) jessica.t.mangum.civ@army.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

b. TITLE

c. ADDRESS (Include ZIP Code)

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

e. CAGE CODE OF THE PRIME CONTRACTOR (See Instructions.)

f. TELEPHONE (Include Area Code)

g. EMAIL ADDRESS (See Instructions)

h. SIGNATURE

i. DATE SIGNED (See Instructions)

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

1 of 2 v6.1 (FEB 23)

CONTRACT REQUIREMENTS PACKAGE ANTITERRORISM/

OPERATIONS SECURITY REVIEW COVER SHEET

Requirements Package Title POC DATE W58RGZ-26-R-0004 (Solicitation) Erica Parsons September 26, 2025 Section I.

Purpose of cover sheet: To document the review of the requirements package statement of work statement (SOW) quality assurance surveillance plan and any applicable source selection evaluation criteria for antiterrorism (AT) and other related protection matters to include, but not limited to: AT, operations security (OPSEC), information assurance (IA)/cyber security, physical security, law enforcement, intelligence, foreign disclosure.

Army policy requirement: A signed AT/OPSEC cover sheet is required to be included in all requirements package except for supply contracts under the simplified acquisition level threshold, field ordering officer actions and Government purchase card purchases. Command policy may require this form for supply contracts under the simplified acquisition level threshold.

Mandatory review and signatures: The organizational antiterrorism officer (ATO) must review each requirements package prior to submission to the supporting contracting activity to include coordination with other staff elements for review as appropriate per section II below. If the requiring activity does not have an ATO, the first ATO in the chain of command will review the contract for considerations. An OPSEC officer review is also mandatory.

Section II.

Standard Contract Language Provision/Contract Clause Text Applicability and/or Additional SOW Language.

a. If standard contract or clause language found on page 2 (Section IV) of this form is sufficient to meet specific contract request requirements, check "yes" in block below and include this language in the SOW/PWS.

b. If standard contractual text (provisions or clauses) or clause language does not apply, check "no."

c. If the standard SOW language applies, but is not in of itself sufficient, check "yes" and "SOW/PWS" and include both the standard language and additional contract specific language in the SOW/PWS.

d. If standard contract text or clause language is not desired, but there is related contract specific language in the SOW/PWS, check "no" and "SOW/PWS."

Description Yes No SOW/PWS

1. AT level 1 training (general) ✔

2. Access and general protection policy and procedures ✔

2a. For contractor requiring Common Access Card (CAC) ✔

2b. For contractor not eligible for CAC, but requires access to DoD facility or installation. ✔

3. AT awareness training for US based contractor personnel traveling overseas ✔

4. Locally developed iWATCH Army training ✔

5. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems.

6. For contracts that require a formal OPSEC program. ✔

7. Requirement for OPSEC training ✔ ✔

8. Information assurance/information technology training ✔

9. Information assurance/information technology certification ✔

10. Contractor Authorized to Accompany the Force clause ✔

11. Contract requiring performance or delivery in a foreign country ✔

12. Handling or access to classified information ✔

12a. Cont. "secure telecommunications" at contractor facilities (IAW…