Attachment 1 - DD Form 254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, MAY 2019

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

20220531 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification whs.mc-alex.esd.mbx.formswebmaster@mail.mil

WHS

List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

AFC, FCC Sustainment Capabilities Development and Integration Directorate (S-CDID) 2221 Adams Ave, Fort Lee, VA 23801 Office: 804-734-3394 & Cell: 229-412-2531

740 Quarters Road (Building 12408) Fort Lee, VA 23801-2102

AFC, SBL / Fort Lee, VA 23801-2102 PublicAuthority: TRADOC Public Affairs Office 930 Jefferson Avenue, Fort Eustis, VA 23604

REFERENCE BLOCK 10k - OTHER (SIPRNet Access).

1. Secret Internet Protocol Router Network (SIPRNet) and SBL BLCSE access is required to perform on this contract. The contractor is not authorized to access, download or further disseminate any classified information from SIPRNet that is outside the scope of the defined contract requirements unless specifically authorized in writing by the Government Program Manager, COR, and the Contracting Officer (KO).

2. The contractor must complete and forward to the COR or KO, a SIPRNet Access Request form for approval by the Government Requiring Activity SIPRNet Information Assurance Manager (IAM) prior to receiving access. A BLCSE Access Request form for approval by the Government Requiring Activity SIPRNet Information Assurance Manager (IAM) must be received by the COR or KO prior to receiving access. NOTE: a NATO Awareness briefing and acknowledgment are required for all personnel prior to access to the SIPRNet. The briefing and acknowledgment are provided by the Sustainment Battle Lab (SBL) Security Manager. The contractor does not require access to NATO information but SIPRNet contains such information, therefore, personnel must be informed on how to protect it. The contractor will NOT be indoctrinated in JPAS or the Defense Information System For Security (DISS) for NATO Secret access.

REFERENCE BLOCK 11a - HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY.

1. Contractor performance involving classified information is restricted to AFC, S-CDID, SBL, 740 Quarters Road (Building 12408), Fort Lee, VA 23801-2102 or at other AFC, FCC, Battle Lab locations.

2. The contractor's Facility Security Officer (FSO) will submit a visit notification via JPAS/DISS on contractor personnel assigned to Fort Lee and in positions requiring classified access, to the SBL Security Manager SMO: W3U2106 (POC is Mr. Robert A. Lewis Sr., 804-734-3394).

3. Contractor personnel are subject to CONUS TDY travel in accordance with the Performance Work Statement to the Task Order. The COR for this Task Order will coordinate with the appropriate Government Security Manager to send a JPAS/DISS visit notification on contractor personnel in advance of their travel if classified access is required at the TDY site.

REFERENCE BLOCK 11g - BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER.

1. Access to DTIC is required to conduct research and perform analysis and development of requirements in performance of the Task Order.

2. The COR/KO must submit the DD Form 1540, "Registration for Scientific and Technical Information Services" to DTIC on behalf of the contractor.

3. The contractor may also submit the DD Form 2345, "Militarily Critical Technical Data Agreement" (after registration with DTIC) to the Defense Logistics Services Center for access to unclassified, militarily critical technical data from other DoD sources. The COR/KO must certify the need-to-know to DTIC.

REFERENCE BLOCK 13 - SECURITY GUIDANCE.

1. Security Investigations and Security Eligibility. All contractor personnel performing on this Task Order will require Secret access, therefore, must be U.S. citizens and meet the personnel investigative and eligibility requirements for such access while performing under this Task Order IAW AR 380-67, AR 380-49, AR 380-5, and NISPOM. Contractor personnel will have at minimum a valid investigation with Secret eligibility (or Interim Secret eligibility) in place at the start of this Task Order as verified by the Government Requiring Activity's servicing Security Office. All contractor personnel must maintain this eligibility for the duration of the Task Order.

2. Contractor personnel will protect classified information and sensitive unclassified information (also referred to as Controlled Unclassified Information (CUI), for example, For Official Use Only), IAW the NISPOM; DoDM 5200.01, Volume 4, DoD Information Security: Controlled Unclassified Information (CUI); AR 380-5; and AR 380-49. The contractor will also adhere to the security program requirements of the Government Requiring Activity for the protection of classified information and CUI.

3. All classified material/information will be provided by the Government Requiring Activity and shall be maintained and safeguarded at the Government Requiring Activity. Note: this Task Order will not include Critical Program Information (CPI).

4. The Government Requiring Activity will provide security classification guidance for performance of this Task Order.

5. Hand-carry of Classified Information. Written approval is required in advance by the COR for contractor personnel to hand-carry classified information (no higher than Secret) on Fort Lee (from one building to another). Upon approval and verification of Secret eligibility and access, the SBL Security Manager will issue each individual a DD Form 2501, Courier Authorization (card) (which the individual signs), and provide a Courier briefing on how to hand-carry classified information on Fort Lee (including how to package the material for hand-carry). These briefings are documented by the SBL Security Manager by having the individual sign a briefing certificate. The hand-carry of classified information off-post is discouraged, therefore, will require written approval in advance by the COR for "courier orders" to be coordinated by the SBL Security Manager. The use of SIPRNet is the preferred means by which to transmit classified information.

6. Security Violations. All contractor security violations involving classified information and CUI will be reported to the KO/COR (who must notify the Government Requiring Activity's servicing Industrial Security Program Manager (ISPM), and the Program Office that has responsibility for the subject information). The Government Requiring Activity's servicing ISPM will ensure the appropriate government Security Managers, the prime contractor's FSO, and the DSS Industrial Security Representative are informed. A damage assessment is conducted by the Government.

7. Subcontracting.

a. If subcontracting is authorized, the prime contractor is responsible for issuing a subcontractor DD Form 254 for any classified work or material that the sub-contractor will have access to while working for the prime contractor. The prime contractor FSO is responsible for preparing the subcontractor DD Form 254. NOTE: the FSO will coordinate to have the prepared DD Form 254 reviewed by the COR and the Government Requiring Activity's servicing ISPM before certifying and signing the DD Form 254 at Block 17. The COR and ISPM will sign in Block 13 to document their review.

b. The prime contractor FSO will provide the KO and/or COR with a copy of all subcontractor DD Form 254s to be attached to the prime contract. The KO/COR will provide a copy of all subcontract DD Form 254s to the Government Requiring Activity's security manager and servicing ISPM.

c. The prime contractor is responsible for providing oversight of their subcontracts and must identify and report to the COR any security measures or requirements that are found both to be inadequate or excessive, and request a revision to the DD Form 254.

8. Security Training.

a. AR 380-49 requires a record of security related training of contractors and integrated (imbedded) contractors be available for review.

The COR and the SBL Security Manager will ensure security training is provided and documented on all contractor personnel.

b. Training requirements for contractor personnel as provided by the Government include (but not limited to) – initial Information Security Program training for new personnel via the Army Learning Management System (ALMS); annual Information Security Program refresher training via ALMS; annual Information Assurance; annual Threat Awareness and Reporting Program (TARP);

annual Antiterrorism Level I; and annual Operations Security (OPSEC).

c. All contractor personnel will attend live TARP training at least annually, and will report threat-related incidents, behavioral indicators, and other matters of Counterintelligence (CI) interest, to their FSO, the Defense Security Service, and to the 902d Military Intelligence Group (nearest military CI office). The reporting requirements are covered in Chapter 3, AR 381-12, Threat Awareness and Reporting Program.

d. Derivative Classification Training. 100% contractor personnel who work directly with classified information (i.e., SIPRNet users) complete the Derivative Classification course (IF103.16) and complete the exam (IF103.06) annually. Once training has been completed, the contractor ensures copies of the completed certificate are provided to the COR/Government Requiring Activity's Security Manager. Derivative Classification course can be accessed at the Center for Development of Security Excellence (CDSE) at: https://securityawareness.usalearning.gov/derivative/index.htm.

9. CAC Issuance. The contractor will not be processed for a Common Access Card (CAC) until the Government Requiring Activity's servicing Security Office verifies the individual's eligibility for CAC issuance, and has received the appropriate JPAS or DISS Visit notification.

10. Visitor Group Security Agreement. Contractor personnel requiring Secret access in accordance with this Task Order will read and sign the local Security Form 380-9, Integrated Visitor Group Security Agreement, following the initial security verification of their security requirements by the Government Requiring Activity's servicing Security Office. The SBL Security Manager will ensure contractor personnel read and sign (manually) this form as a condition of classified access.

Contracting Officers Representative

Building 7124 Fort Lee, VA 23801 Address: 2221 Adams Ave

BLDG 5020 RM 1004

Fort Lee, Virginia 23801