Attachment 10 - Draft DD254 Contract Security Specification.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DD FORM 254 ATTACHMENT 10A

COMMUNICATIONS SECURITY (COMSEC) INFORMATION

UNITED STATES AIR FORCES IN EUROPE

UNITED STATES AIR FORCES AFRICA

GOVERNMENT FACILITY

FOLLOW-ON/PRIME CONTRACT NUMBER:

PRECEDING CONTRACT NUMBER:

CONTRACT EXPIRATION DATE:

Block 13, CONTINUATION:

Ref Block 10, Item a

Access to COMSEC material/information requires a final US security clearance commensurate to the level of material accessed. Contractors are not authorized to receipt for material transferred from CONUS contractor COMSEC accounts; COMSEC material support must come from the servicing base COMSEC manager.

Contractors with access to “Secret Crypto” or higher levels must be briefed into the Cryptographic Access Program via the AFCOMSEC Form 9, Cryptographic Access Certificate, IAW AFI 33-201, Vol. 4. Contractors must be familiar and comply with the following publications--as applicable--AFI 33-201 Vol. 1, Communications Security; Vol. 2, COMSEC User Requirements; Vol. 3, Reporting COMSEC Deviations; Vol. 4, Cryptographic Access Program; Vol. 5, Controlled Cryptographic Information (CCI); Vol. 9, Operational Instruction for Secure Voice Devices, and any applicable AF Systems Security Instructions (AFSSIs) that provide additional guidance for cryptographic equipment/CCIs held/keyed. Current AFSSIs may be obtained from your servicing base COMSEC manager.

Contractors must comply with all instructions provided by the servicing COMSEC manager and must maintain current training to access COMSEC material/information. Additionally, all contractors must immediately report any known or suspected deviations to their COMSEC Responsible Office or COMSEC manager for evaluation and up-channel reporting, if required.

Contact your servicing AF Activity COMSEC manager for additional assistance.

DD FORM 254 ATTACHMENT 10E2

NON-SENSITIVE COMPARTMENTED INTELLIGENCE INFORMATION

(Policy: AFI 14-303, Release of Intelligence to US Contractors, and applicable USAFE Supplements)

CONTRACT EXPIRATION DATE:

BLOCK 13, CONTINUATION:

Ref Block 10, Item e (2):

Special Requirements of Intelligence Information: The contractor will require access to classified intelligence documents in the performance of this contract. In addition to the requirements and controls for classified material in DoDM 5220.22, National Industrial Security Program (NISP), the contractor shall adhere to the following requirements and controls of intelligence, per AFI 14-303 and applicable supplements.

Contact USAFE-AFAFRICA Special Security Officer (SSO) for permission to make extra copies of intelligence data required by the contractor if approval has not previously been stipulated above or been stipulated in the release letter. The Contract Officer Representative (COR) then maintains accountability of copies and ensures all information is returned to the Air Force upon contract termination/expiration.

Maintain a record of all intelligence materials released for use by the contractor, and ensures all data is returned to the COR within 2 years after final delivery of goods and services or after completion or termination of the classified contract, whichever comes first. If retention is required beyond the 2 year period the contractor must request and receive written authority from the COR.

Contractors must agree that all intelligence data shared with them, all reproductions, and other material generated (including authorized reproductions) is the property of the US Government and will be returned upon request of the sponsoring agency or expiration date of the contract, whichever comes first.

Contractor shall not reproduce intelligence without permission from USAFE-AFAFRICA SSO through the COR. If approved, must control each copy in the same manner as the original.

Contractor shall not reproduce intelligence without advance approval from the COR, except for working papers and derivative material produced in the publication process. Working papers and derivative material produced in the publication process do not need destruction approval.

Contractor shall restrict access to those individuals with a valid need-to-know who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, or other government agencies and private individuals or organizations are prohibited unless authorized in writing by the COR with prior approval of the supporting SSO/contracting activity.

Contractor shall not release intelligence data to foreign nationals or immigrant aliens regardless of their security clearance or contract status without advanced written permission from the COR, USAFE-AFAFRICA SSO, Foreign Disclosure Policy Office, and HQ USAFE-AFAFRICA Senior Intelligence Officer (SIO).

Contractor shall ensure the each employee having access to intelligence material is fully aware of the special security requirements for this material and maintains records in a manner that permits the contractor to furnish on demand the names of individuals who have access to the material in their custody.

Releasing authority of intelligence documents is HQ USAFE-AFAFRICA SSO. Any request for intelligence documents will be sent through the COR to the USAFE-AFAFRICA SSO designee for HQ USAFE-AFAFRICA SSO for approval.

HQ USAFE-AFAFRICA/A2S

Unit 3050 Box 80

APO AE 09094

The supporting Special Security Officer (SSO) is:

HQ USAFE-AFAFRICA/A2S

DSN: 314-480-6450

DD FM 254 ATTACHMENT 10G

NORTH ATLANTIC TREATY ORGANIZATION (NATO) INFORMATION

Block 13, CONTINUATION:

Ref Block 10, Item g.

Access. Access to NATO information requires a final US security clearance eligibility commensurate to or exceeding the classification level of the NATO information to be accessed and the appropriate briefing(s). The Individual must meet all requirements for access to US classified information identified in References a-f.

The Air Force grants its contractors access to NATO Classified information via the DD Form 254, block 10g. In addition; if USAFE Secret Internet Protocol Router Network (SIPRNet) access is required, annotate in block 10, Item k.: “Requires SIPRNet Access” and check (X) “YES.” Access to the USAFE SIPRNet requires NATO indoctrination by the AF Activity security manager. The AF Activity security manager will brief the contractor into the appropriate level of NATO.

The contractor is responsible for approving access authorization for its employees to include providing initial briefings, re-briefings and debriefings. The sponsoring AF Activity security manager may also conduct these briefings. Initial Indoctrination briefing, and re-briefings are recorded on the AF Form 2583. The AF Form 2583 will be retained by the indoctrinating activity until the individual is debriefed. The individual’s access to NATO will be recorded on the individuals JPAS Person Summary Indoctrination screen.

Upon conclusion of the contract, the individual is debriefed utilizing AF Form 2587 and access removed from the individuals JPAS Person Summary Indoctrination screen. The AF Form 2587 will be retained by the debriefing activity for a period of 2 years.

Under no circumstances will the NATO access from one contract be carried forward to another contract unless it is a “follow-on contract” with no break in service to the same AF Activity.

Interim security clearance is not valid for access to NATO classified information, i.e. CTSA, CTS, NSA, NS, NCA, NC, and NR.

The contractor shall sign a disclosure record sheet for access to ATOMAL information.

Marking and Safeguarding. Mark and safeguard NATO information in accordance with References a-e.

Transmission. Process and transmit NATO information, regardless of classification, on U.S. Government classified information systems. The sender is responsible for ensuring the recipient possesses an appropriate U.S. security clearance, was briefed on NATO security procedures, has a need-to-know, and is hosted by a network accredited for NATO classified information.

For further guidance on handling, marking, and processing of NATO information refer to the AF Activity security manager and References a-e.

References:

a. C-M(68)41(7th revise), Administrative Arrangements to Implement the Agreement between the Parties to the North Atlantic Treaty for Co-Operation Regarding ATOMAL Information (NR)

b. USSAN 1-07, Implementation of North Atlantic Treaty Organization (NATO) Security Requirements

c. DoDM 5200.01 Vol. 1-4, DoD Information Security Program

d. AFI 16-1406, Air Force Information Security Program

e. DoDM 5200.02_AFMAN 16-1405, Personnel Security Program

DD FM 254 ATTACHMENT 10K

SECURE INTERNET PROTOCOL ROUTER NETWORK (SIPRNET)

INFORMATION

Block 13, CONTINUATION:

Ref Block 10, Item k.

At the direction of the Activity or Project Manager, contractor may need access to SIPRNET as needed to render services. At a minimum, access to SIPRNET requires a final U.S. SECRET clearance with NATO briefing and NATO SECRET access.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification

Unit 3300

APO AE 09094

DSN: 314-480-2107

86AW.informationprotectionoffice@us.af.mil

Bldg 201, Room A-214 Ramstein Air Base, Germany

APO AE 09094-3277

86aw.pa@us.af.mil; DSN: 314-480-9196

The National Industrial Security Program Operating Manual (NISPOM), Feb 2006, including Chg 2, 18 May 16, applies.

Ref Item 10a: Contractor is authorized to receive Government -furnished cryptographic equipment. Access to classified COMSEC information requires a final U.S. Government clearance. Refer to NSA/CSS Manual 3-16, "Control of Communications Security Material,," and the Committee on National Security Systems Instructions (CNSSI) 4001, "Controlled Cryptographic Items," for guidance. Contractor will comply with AFMAN 17-1302, Communications Security (COMSEC) Operations, 3 Feb 17.

Contractor personnel will follow the security requirements of the host government activity.

Ref Item 10e(2): Contractor will require access to intelligence information and must comply with directions provided by the COR. In accordance with paragraph 8.9.2.2 of AFMAN 14-304, the COR will identify what intelligence information is required for the contractor to satisfy the contract and will submit that information to the servicing Senior Intelligence Officer (USAFE A2/A2SP) for approval prior to gaining access.

Ref Item 10g: A formal North Atlantic Treaty Organization (NATO) briefing is required prior to granting access to NATO SECRET information. See NIPSOM Chapter 10, Section 7, for details.

Ref Item 10g: Access to Secret Internet Protocol Router Network (SIPRNet) is authorized. SIPRNet users shall receive the Air Force NATO Security Awareness briefing and sign an acknowledgment prior to SIPRNet access. A formal NATO briefing is required when 1) SIPRNet enclave or other classified networks is approved for NATO and no additional security measures are in place to preclude access, or 2) access to NATO information is authorized. Formal NATO briefings shall be accomplished IAW the NISPOM, paragraph 10-706. Access to JWICS is authorized. Users shall be briefed to NATO Secret IAW the NIPSOM, Paragraph 10-706, prior to access.

Ref Item 11a: Contractor will generate classified information. The contractor shall apply derivative classification and markings consistent with source material provided by government program office.

Ref Item 11f: Contractor will access U.S. classified information at Ramstein Air Base, Germany.

Ref Item 11m: Comply with AFFARS 5352.204-9000.

Ref Item 13: Contractor will notify the GCA and Government Security Manager within 48 hours of any incident involving actual or suspected compromise/loss of classified information.

Ref Item 15: HQ Defense Security Service, 27130 Telegraph Road, Quantico VA, 22134.

Ref Item 18f: 86/IPO, Unit 3300, APO AE, 09004 (Ramstein Air Base, Germany) 86aw.informationprotectionoffice@us.af.mil.

Ref Item 18f: Ramstein AB Special Security Office (SSO): USAFE A2/A2SP, 314-480-7221, e-mail: USAFEA2.A2S.SSO@us.af.mil.

Unit 3277

APO AE 09094-3277

Address: 764th Specialized Contracting Squadron/PKA Ramstein Air Base, Germany