Attachment 11 - DD254.pdf

CLASSIFICATION (When filled in): Unclassified//FOUO

PREVIOUS EDITION IS OBSOLETE. Page 1 of 7DD FORM 254, MAY 2019 PREVIOUS EDITION IS OBSOLETE. Page 1 of 7DD FORM 254, MAY 2019

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

20220531

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED

(See Instructions)

Top Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

Top Secret

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER

FA8207-20-R-0003

DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

20191209

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

TBD

b. CAGE CODE

TBD

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

TBD

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor) Add Row Remove last Row Delete All Rows

a. NAME, ADDRESS, AND ZIP CODE N/A

b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional) N/A

8. ACTUAL PERFORMANCE (Click button to add more locations.) Add Row Remove last Row Delete All Rows

a. LOCATION(S) (For actual performance, see instructions.)

ICBM Systems Directorate 6006 Wardleigh Rd, Bldg 1580 Hill AFB, UT 84056-5816

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

75 ABW/IP

7981 Georgia St., Bldg 1102 Hill AFB, UT 84056

a. LOCATION(S) (For actual performance, see instructions.)

30 SFS/CC

108 Colorado Ave

VAFB, CA 93437

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

30 SW/IP

1031 California Blvd, Suite C-109 Vandenberg AFB, CA 93437-6300

PREVIOUS EDITION IS OBSOLETE. Page 2 of 7DD FORM 254, MAY 2019 PREVIOUS EDITION IS OBSOLETE. Page 2 of 7DD FORM 254, MAY 2019

a. LOCATION(S) (For actual performance, see instructions.)

625 Strategic Operations Squadron 901 Sac Blvd, Suite 2B Offutt AFB, NE 68113

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

55 WG/IP

205 Looking Glass Ave Offutt AFB, NE 68113-4008

a. LOCATION(S) (For actual performance, see instructions.)

AFSPC A-6

150 Vandenburg Street, Ste 1105 Peterson AFB, CO 80914

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

21 SW/IP

135 Dover St. Suite 1055 Peterson AFB, CO 80914

a. LOCATION(S) (For actual performance, see instructions.)

SMC/XR

2430 East El Segundo Blvd, Ste 1340 Los Angeles AFB, CA 90245-4659

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

61 ABG

483 N. Aviation Blvd.

Los Angeles AFB, CA 90245-2808

a. LOCATION(S) (For actual performance, see instructions.)

90 MXG

1235 Commissary Road F.E. Warren AFB, WY 82005

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

90 MW/IP

7100 Garrison Loop, Bldg 34, STE 180 FE Warren AFB, WY 82005

a. LOCATION(S) (For actual performance, see instructions.)

90 MXG/CC

5305 Randall Ave F.E. Warren AFB, WY 82005-3943

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

90 MW/IP

7100 Garrison Loop, Bldg 34, STE 180 FE Warren AFB, WY 82005

a. LOCATION(S) (For actual performance, see instructions.)

Air Force Global Strike Command

(AFGSC) A1/A2/A3/A4/A5/A7/A8

245 Davis Avenue E. Suite 200 Barksdale AFB, LA 71110

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

AFGSC/2 BW/IP

109 Barksdale Blvd West, Ste B08 Barksdale AFB, LA 71110

a. LOCATION(S) (For actual performance, see instructions.)

AFNWC/CC

21 Grenier Street Kirtland AFB, NM 84117

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

377 ABW/IP

4500 Biggs Ave SE (Bldg 926) Kirtland AFB, NM 87116

a. LOCATION(S) (For actual performance, see instructions.)

JNTF CRDC

730 Irwin Ave Schriever AFB, CO 80912

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

50 SW/IP

210 Falcon Pkwy, Suite 17 Schriever AFV, CO 80912

a. LOCATION(S) (For actual performance, see instructions.)

SMC/TEB

3550 Aberdeen Ave SE, Bldg 415, Rm 214 Kirtland AFB, NM 84117

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

377 ABW/IP

4500 Biggs Ave SE (Bldg 926) Kirtland AFB, NM 87116

PREVIOUS EDITION IS OBSOLETE. Page 3 of 7DD FORM 254, MAY 2019 PREVIOUS EDITION IS OBSOLETE. Page 3 of 7DD FORM 254, MAY 2019

a. LOCATION(S) (For actual performance, see instructions.)

AFSEC/SEWN

3550 Aberdeen Ave SE, Bldg 405 Kirtland AFB, NM 87117

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

377 ABW/IP

4500 Biggs Ave SE (Bldg 926) Kirtland AFB, NM 87116

a. LOCATION(S) (For actual performance, see instructions.)

91 MXG/CC

300 Minuteman Drive Minot AFB, ND 58705

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

5 BW/IP

475 Summit Drive Minot AFB, ND 58705-5012

a. LOCATION(S) (For actual performance, see instructions.)

341 MXG/CC

21 77th St. N Malmstrom AFB, MT 59402

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

341 MW/IP

7410 Flightline Drive Bldg 300 Rm 140 Malmstrom AFB, MT 59402

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

The ISC 2.0 contract provides system level integration, system engineering, sustaining engineering, and program management support. In addition, the requirement will help mentor and facilitate knowledge transfer to the ICBM Systems Directorate.

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.) h. FOREIGN GOVERMENT INFORMATION

d. FORMERLY RESTRICTED DATA i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

NC2-ESI/JWICS/SIPRNET Access Required.

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

PREVIOUS EDITION IS OBSOLETE. Page 4 of 7DD FORM 254, MAY 2019

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

The AFFARS clause 5352.204-9000 applies.

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

Public release of Sensitive Compartmented Information (SCI), and Special Access Program (SAP) information is NOT authorized.

Public Release Authority:

NONE AUTHORIZED.

13. SECURITY GUIDANCE Add Signature Remove last Signature Delete All Signatures

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

13.a. DD FM 254 Review: 1 JAN 2026 Contract End Date: 31 JUL 2039

Ref. 10.a: COMSEC safeguarding requirements apply. See the NISPOM chapter 9, section 4 for details. For on-base performance, COMSEC is incumbent on the government. Access on a government installation is granted by the user agency. Access to COMSEC information is restricted to U.S. Citizens holding a final U.S. government clearance at the appropriate level. Personnel must receive the required COMSEC briefing. Prior approval is required from the Government Contracting Activity prior to granting access to COMSEC information to a subcontractor. Contractor is authorized to receive Government furnished cryptographic equipment in performance of this contract.

Ref. 10.b: The contractor is permitted access to RESTRICTED DATA (RD) in performance of this contract. Access to RD requires a U.S.

Government clearance at the appropriate level.

Ref. 10.c: The contractor is permitted access to Critical Nuclear Weapon Design Information (CNWDI) in performance of this contract.

Access to CNWDI requires a special briefing and debriefing. The government program manager or designated representative will ensure contractor employees are briefed for CNWDI. Prior to granting subcontractors access to CNWDI approval must be obtained from the Government Contracting Activity.

Ref. 10.d: The contractor is permitted access to FORMERLY RESTRICTED DATA (FRD) in performance of this contract. Access to FRD requires a U.S. Government clearance at the appropriate level.

Ref 10.g.: The contractor is permitted access to classified North Atlantic Treaty Organization (NATO) information in performance of this contract. The government project manager is the designated representative that will ensure the contractor Facility Security Officer and concerned employees are NATO briefed prior to access being granted. Prior approval of the contracting office is required for subcontracting. See the NISPOM chapter 10, section 7 for additional security requirements. Access to NATO requires a final U.S.

Government clearance at the appropriate level.

Ref. 10.h: The contractor is permitted access to Foreign Government Information in performance of this contract. Access to Foreign Government Information requires a valid need- to-know and final U.S. Government clearance at the appropriate level. Prior approval of the

PREVIOUS EDITION IS OBSOLETE. Page 5 of 7DD FORM 254, MAY 2019 contracting activity is required for subcontracting. Refer to the NISPOM chapter 10, section 3 for additional security requirements.

Ref. 10.j: CUI information provided under this contract shall be safeguarded as specified in DOD Manual 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI).

Ref. 10.k: Contractor requires access to Joint Worldwide Intelligence Communications System (JWICS). Contractor may only access JWICS from inside a Sensitive Compartmented Information Facility (SCIF) meeting Intelligence Community Directive 705, Sensitive Compartmented Information Facilities (SCIFs), requirements. The contractor is permitted access to the Secret Internet Protocol Router Network (SIPRNet). The contractor is permitted access to Nuclear Command and Control – Extremely Sensitive Information (NC2-ESI) in performance of this contract. Access to NC2-ESI Information requires a final U.S. Government clearance at the appropriate level. The servicing NC2-ESI Program Manager will ensure the contractor Facility Security Officer and concerned employees are briefed prior to access being granted. Prior approval of the contracting office is required for subcontracting. Refer to AFI 13-502, Safeguarding Nuclear Command and Control Extremely Sensitive Information (NC2-ESI), for additional security requirements.

Ref. 11.c: The contractor requires access to classified source data up to and including TOP SECRET in support of the work effort. All classified information received or generated will be properly stored and handled according to the markings on the material. Contractor will abide by the following security classification guidance: Intercontinental Ballistic Missile (ICBM) SCG effective date 23 Oct 2008 with most current letter. Strategic Automated Command Control Systems (SACCS) 465l Weapon System SCG dated 1 February 2013 and the most current changes. Ground Based Strategic Deterrent (GBSD) Security Classification Guide (SCG) signed 22 May 2016 and the most current changes. The applicable SCG will be provided under a separate cover. At the termination or expiration of this contract, the U.S.

Government will be contacted for proper disposition instructions.

Ref. 11.d: The contractor must provide adequate storage for classified hardware and materials to the level of TOP SECRET which exceeds 2 cubic feet and is of size and quantity that it cannot be safeguarded in a General Service Administration (GSA) approved security container.

Ref. 11.g: The contractor is authorized to use the services of the Defense Technical Information Center (DTIC). The contractor must prepare a DD Form 1540, Registration for Scientific and Technical Information Services, for GCA submittal. The contractor may submit a DD Form 2345, Military Critical Technical Data Agreement, (after registration with DTIC) to the Defense Logistics Services Center for access to unclassified, militarily critical technical data from other DoD sources. Reference the NISPOM chapter 11, section 2 for preparation of these forms. The GCA must be involved in certifying need-to-know for contractors to utilize DTIC.

Ref. 11.h: A COMSEC account will be established and COMSEC will be protected per the NISPOM chapter 9, section 4.

Ref. 11.c: The contractor requires access to classified source data up to and including TOP SECRET in support of the work effort. All classified information received or generated will be properly stored and handled according to the markings on the material. Contractor will abide by the following security classification guidance: Intercontinental Ballistic Missile (ICBM) SCG effective date 23 Oct 2008 with most current letter. Airborne Launch Control System Replacement (ALCS-R) SCG signed 16 Aug 2017 and the most current changes.

Strategic Automated Command Control Systems (SACCS) 465l Weapon System SCG dated 1 February 2013 and the most current changes. Ground Based Strategic Deterrent (GBSD) Security Classification Guide (SCG) signed 22 May 2016 and the most current changes. The applicable SCG will be provided under a separate cover. At the termination or expiration of this contract, the U.S.

Government will be contacted for proper disposition instructions.

Ref. 11.d: The contractor must provide adequate storage for classified hardware and materials to the level of TOP SECRET which exceeds 2 cubic feet and is of size and quantity that it cannot be safeguarded in a General Service Administration (GSA) approved security container.

Ref. 11.e.: Contract is for engineering services. Classification markings on the material to be furnished will provide the guidance necessary for performance of the contract.

Ref. 11.g: The contractor is authorized to use the services of the Defense Technical Information Center (DTIC). The contractor must prepare a DD Form 1540, Registration for Scientific and Technical Information Services, for GCA submittal. The contractor may submit a DD Form 2345, Military Critical Technical Data Agreement, (after registration with DTIC) to the Defense Logistics Services Center for access to unclassified, militarily critical technical data from other DoD sources. Reference the NISPOM chapter 11, section 2 for preparation of these forms. The GCA must be involved in certifying need-to-know for contractors to utilize DTIC.

Ref. 11.h: A COMSEC account will be established and COMSEC will be protected per the NISPOM chapter 9, section 4.

Ref. 11.j: The contractor must comply with the U.S. Government, DOD, Air Force, AFMC, Hill AFB, and AFNWC/NI Operation Security (OPSEC) Programs. The contractor must comply with any additional OPSEC requirements referenced in attachment within Item 13.

PREVIOUS EDITION IS OBSOLETE. Page 6 of 7DD FORM 254, MAY 2019

Ref. 11.k: This contract requires the use of the Defense Courier Service (DCS). The government contracting activity will request written approval for DCS services from the Commander, Defense Courier Service, ATTN: Operations Division, United States Transportation Command, 508 Scott Drive, Scott Air Force Base, IL 62225. Prior approval is required from the contracting activity, prior to authorizing a subcontractor to utilized DCS services.

Ref. 11.l: In accordance with DFARS Subpart 252.204-7012, contractors and subcontractors will safeguard covered defense information that resides in or transits through contractor information systems by applying specified network security controls, and will report cyber incidents.

Ref. 11.m.: The contractor is designated as an Independent Visitor Group and will provide the information requested by the Notification of Government Security Activity and Visitor Group Security Agreements Clause, Air Force Federal Acquisition Regulation Supplement 5352.204- 9000, to the Servicing Security Activity addresses, listed in Item 15 “Ref: 8.a”, at least 30 days prior to beginning operations.

=========================================End of References=============================================

List of Attachments [1] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

Add Attachment View Selected Attachment Remove Selected Attachment

NAME & TITLE OF REVIEWING OFFICIAL

NEBEKER, ALEX B.,

Program Manager, AFNWC/NIAAC

SIGNATURE

NAME & TITLE OF REVIEWING OFFICIAL

CORNELIUS, ERIES H,

Chief Security Officer, AFNWC/NI

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

Ref 10.e.(1): Contractor requires access to SCI materials; SCI security requirements apply, see attached SCI Clauses in attachment within Item 13 for details.

Ref 10.e.(2): The contractor will require access to, and receipt of, classified intelligence documents in the performance of this contract.

Contractor shall restrict access to those individuals with a valid need-to-know who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, or other government agencies and private individuals or organizations is prohibited unless authorized in writing by the COR with prior approval of SSO HILL. See Non-Sensitive Compartmented Information (SCI) Clauses in attachment within Item 13 for details.

Ref 10.f.: Special Access Program (SAP) security requirements apply, see SAP Information Addendum attachment within Item 13 for details.

Ref. 11.i: TEMPSET requirements apply, see attached TEMPEST addendum for details.

Ref 11.j.: OPSEC requirements apply, see attached OPSEC addendum for details.

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

Ref. 8.a.: The Defense Security Services (DSS) is relieved of all industrial security review responsibilities for contractor collateral classified performance on government installations identified in Items 8.a. The following SSAs have exclusive oversight responsibilities while operating on the installations: Hill AFB, UT: 75 ABW/IPD (@usaf.mil); Minot AFB, ND: 5 BW/IP

PREVIOUS EDITION IS OBSOLETE. Page 7 of 7DD FORM 254, MAY 2019

(5.BW.Security.Countermeasures.dl.1@@us.af.mil); Peterson AFB, CO: 21 SW/IP (21sw.ip.wf@us.af.mil); Vandenberg AFB, CA: 30 SW/ IP (30SW.IPWorkflow@us.af.mil); Schriever AFB, CO: 50 SW/IP (50sw_ipworkflow@us.af.mil); Offutt AFB, NE: 55 WG/IP (55WGIP@us.af.mil); Los Angeles AFB, CA: 61 SFS/S5 (61.SFS.Workflow.1@us.af.mil); F.E. Warren AFB, WY: 90 MW/IP (90MW.IP@us.af.mil); Malmstrom AFB, MT: 341 MW/IP (341mw.ip@us.af.mil); Kirtland AFB, NM: 377 ABW/IP (377abw.ip@us.af.mil)

Ref. 10.e(1). DSS is relieved of security inspection responsibility for all SCI material related to this contract. The SSO maintains inspection responsibility for all SCI material related to this contract.

Ref 10.f.: The Defense Security Service (DSS) has been relieved of inspection oversight responsibilities for SAP programs associated with this contract. The Air Force is identified as the Cognizant Security Authority (CSA) with the AFOSI PJ fulfilling the execution role for all contractor inspections under the purview of SAF/AAZ.

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

AFNWC/NIAAC

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

c. ADDRESS (Include ZIP Code) 6011 Gum Lane, Bldg 1229 Hill AFB, UT 84056-5816

d. POC NAME

Nebeker, Alex B.

e. POC TELEPHONE (Include Area Code)

+1 (801) 586-6652

f. EMAIL ADDRESS (See Instructions) alex.nebeker@us.af.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

Thomas, Christopher B.

b. TITLE

Contracting Officer

c. ADDRESS (Include ZIP Code) 6008 Wardleigh Rd, Bldg 1580 Hill AFB, UT 84056-5816

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

e. CAGE CODE OF THE PRIME CONTRACTOR (See Instructions.)

N/A

f. TELEPHONE (Include Area Code)

+1 (801) 775-6732

g. EMAIL ADDRESS (See Instructions) christopher.thomas.87@us.af.mil

h. SIGNATURE

i. DATE SIGNED (See Instructions)

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

1. TBD - steven.nutt.2; 2. (david.sweeney.2@us.af.mil); 3.

(5.BW.Security.Countermeasures.dl.1@@us.af.mil); 4.

(30SW.IPWorkflow@us.af.mil); 5. (55WGIP@us.af.mil); 6.

(90MW.IP@us.af.mil); 7. (341mw.ip@us.af.mil); 8.

(377abw.ip@us.af.mil); 9. (50sw_ipworkflow@us.af.mil); 10.

(61.SFS.Workflow.1@us.af.mil); 11. (21sw.ip.wf@us.af.mil);

11. (DSS.FCB@mail.mil.); 12. Headquarters DSS (27130 Quantico, VA 2213)

Ref: 10.e.(1) Sensitive Compartmented Information (SCI) Addendum

ADDENDUM TO DD FORM 254 (Block 10e (1)) Sensitive Compartmented Information (SCI) Clauses

Contract/Solicitation Number , Expiration Date (Do not include option years)

Company , Cage Code

Reference Block 14

1. This contract requires access to Sensitive Compartmented Information (SCI). Per the National Security Act of 1947, as amended; Executive Order (EO) 12333, as amended; EO 13526; EO 13549; EO 12829; EO 12968, as amended; 32 CFR Part 2001; 32 CFR Part 2003, 32 CFR Part 2004; and other applicable provisions of law; DNI Memorandum ES 2017-00356; DoD Manual 5105.21, Volumes 1 -3; AFMAN 14-403; AFMAN 14-401; Joint DoDIIS Cryptologic SCI Information Systems standards (JDSCSISSS); 5220.22-M (NISPOM and Supplement); ICD 701, ICD 702, ICD 703, ICD 704/ICPGs 704.1. ICPG 704.2, ICPG 704.3, ICPG 704.4, ICD 710, DCID 6-06, as amended; ICD 705, ICS 705-1; ICD 501 and related NIST/CNSSI guidance for Risk Management Framework, other regulations as applicable, and the AFMC SCI Management Guidance provides the necessary guidance for physical, personnel, information, and information systems security measures and is part of the SCI security specifications for the contract.

2. This contract will require _____ SCI positions in order to fulfill contractual obligations. SCI access is subject to U.S. Government review and approval as outlined in the aforementioned SCI security guidance.

Justification must be identified in the contract Statement of Work (SOW)/Performance Work Statement (PWS). Upon completion or cancellation of the contract, the SSO/CSSO will debrief all personnel not required for contract closeout and those positions will be disestablished.

3. Name, organization, Telephone number and address of the contract Officer Representative (COR) for the SCI portion of this contract is:

Contracting Officer Representative Office Symbol Phone Number

4. All DD Form 254s prepared for subcontracts involving access to SCI under this contract must be forwarded to the COR for approval and then to SSO HILL for review and concurrence prior to award of the subcontract. Inquiries pertaining to classification guidance on SCI will be directed to the COR listed in para. 3 above. SCI security management issues shall be directed to:

SMO: SSO HILL – AFLCMC/INLS Address: 6137 WARDLEIGH ROAD DSN: 777-0484/Comm: 801-777-0484 HILL AFB, UT 84056-5843

5. SCI Access: SCI will not be provided to contractor employees without the specific release approval by the originator of the material as outlined in the governing directives and based on prior approval and certification of “need-to-know” by the Contracting Officer’s Representative (COR). The COR requirements and responsibilities are as follows: 1) COR be Military Member or Government Civilian. 2) Must be SCI indoctrinated. 3) Will establish Billet Position Document (instructions and worksheet template provided by SSO HILL). 4) Will validate each candidate’s need-to-know via the “Nomination Letter” process (instructions and template provided by SSO HILL). 5) If work will be performed in a contractor operated SCIF, the COR will coordinate with SSO HILL to identify a Contractor Special Security Officer (CSSO).

6) If work will be performed in a US Government owned SCI Facility (SCIF), the COR will coordinate with

SSO HILL to identify a Contractor Special Security Representative (CSSR)

a. Names of contractor personnel requiring access to SCI and justification for SCI access will be submitted for coordination and action to SSO HILL after the COR’s approval/concurrence. Upon receipt of written approval from the COR, the Facility Security Officer (FSO) and/or Contractor Special Security Officer (CSSO) may submit the necessary forms to the Defense Security Service (DSS) for a Single Scope Background Investigation (SSBI) for those personnel nominated for SCI in accordance with the National Industrial Security Program Operating Manual (NISPOM).

b. The COR and SSO/CSSO must restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract. Further dissemination to other contractors, sub-contractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the releasing agency.

6. SCI Materials: SCI materials furnished in support of this contract remains the property of the DoD department or command that released it. Upon completion or cancellation of the contract, all SCI materials furnished will be returned to the direct custody of the originator of the materials or the COR.

a. Classified foreign intelligence materials will not be released to foreign nationals or immigrant aliens whether or not they are also consultants, U.S. contractors, or employees of the contractor regardless of the level of their security clearance, except with advance written permission from the originator.

b. Contractor personnel must maintain accountability for all intelligence (to include foreign intelligence) materials released to their custody.

c. Contractor personnel must not reproduce classified foreign intelligence without advance approval of the releasing agency. If permission is granted, each copy will be controlled in the same manner as the original.

The CSSO must not destroy any classified foreign intelligence without advance approval of the releasing agency.

7. SCIF Guidance: A SCIF meeting the physical security requirements in ICD 705 is required for this contracting effort. All SCI used for this contract shall be stored, handled, and maintained in an accredited SCIF. (if contractor SCIF complete table, otherwise delete table)

Company FSO/CSSO Name Phone Number

8. Visits: The contractor will submit the written request for SCI visit certifications through the COR for approval of the visit. The certification must arrive at SSO HILL at least three working days prior to the visit.

9. Electronic Processing: Information assurance and electronic processing; information security (computer) and network connectivity require accreditation of the equipment connectivity.

a. Other networks processing corporate unclassified, SIPRNET, or other collateral information will follow the cognizant authority policy requirements. Prior authorization by a cognizant authority must be obtained before operation. Non-AF SCI systems must be accredited by the designated authority and may require a Co-Use Agreement (CUA) for operation in DIA facilities.

b. Joint Worldwide Intelligence Communication System (JWICS) accounts require NATO – Secret indoctrination reflected in Joint Personnel Adjudication System (JPAS). JWICS access must be coordinated through the AFLCMC/INL Information Systems Security Manager (ISSM)

c. For contract work within an approved contractor facility, all SCI information systems will be accredited and authorized following the Risk Management Framework (RMF), IAW ICD 503 and the ICD 503 Practitioners Manual. All SCI systems will be accredited through the XACTA system and HQ AFMC and the Authorizing Official (AO), the 25th AF/A6S (AF Intelligence Community). Other applicable policy as directed by DIA, ODNI, or HQ AFMC shall apply. This includes all electronic connectivity and electronic methods for storing and communicating within and outside the SCIF.

Reference Block 15

1. Inspections: This contract requires access to SCI. If the contractor has established a SCIF, DIA and its designees are responsible for all inspections of the contractor SCIF and SCI security management program for ensuring compliance with all SCI security regulations and policies. If a new SCIF must be established in accordance with this contracting effort, permission to build/accredit a SCIF must be requested through the COR and forwarded to SSO Hill. Special Security Officers (SSOs) reserve the right to conduct program reviews of AF SCI materials and SCI program management to ensure the protection of AF equities.

Ref: 10.e.(2) Non-Sensitive Compartmented Information (SCI) Addendum

ADDENDUM TO DD FORM 254 (Block 10e (2)) Non-Sensitive Compartmented Information (SCI) Intelligence Information Clauses

Contract/Solicitation Number , Expiration Date (Do not include option years)

Company , Cage Code

Reference Block 14

1. Special Requirements of Intelligence Information: The contractor will require access to, and receipt of, classified intelligence documents in the performance of this contract. In addition to the requirements and controls for classified material in DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), the contractor shall adhere to the National Security Act of 1947, as amended; Executive Order (EO) 12333, as amended; EO 13526; EO 13549; EO 12829; EO 12968, as amended; 32 CFR Part 2001; 32 CFR Part 2003, 32 CFR Part 2004; and other applicable provisions of law; ICD 501; ICD 703; ICD 710;

and AFMAN 14-403 and other regulations as applicable.

2. Name, organization, Telephone number and address of the contract Officer Representative (COR):

Contracting Officer Representative Office Symbol Phone Number

3. Intelligence Information Access:

a. Contractor shall restrict access to those individuals with a valid need-to-know who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, or other government agencies and private individuals or organizations is prohibited unless authorized in writing by the COR with prior approval of SSO HILL.

b. Contractor shall not release intelligence data to foreign nationals or immigrant aliens regardless of their security clearance or contract status without advanced written permission from the COR, SSO HILL, Foreign Disclosure Policy Office, and HQ AFMC/A2S.

c. Contractor shall ensure that each employee having access to intelligence material is fully aware of the special security requirements for this material and maintains records in a manner that permits the contractor to furnish on demand the names of individuals who have access to the material in their custody.

4. Intelligence Information Materials:

a. Contact SSO HILL for permission to make extra copies of intelligence data required by the contractor if approval has not previously been stipulated above, or been stipulated in the release letter. The COR then maintains accountability of copies and ensures all information is returned to the Air Force upon contract termination/expiration.

SMO: SSO HILL – AFLCMC/INLS Address: 6137 WARDLEIGH ROAD DSN: 777-0484/Comm: 801-777-0484 HILL AFB, UT 84056-5843

b. Maintain a record of all intelligence materials released to the contractor, and ensures all data is returned to the COR within 2 years after final delivery of goods and services or after completion or termination of the classified contract, whichever comes first. If retention is required beyond the 2 year period the contractor must request and receive written authority from the COR in the form of a signed Final DD FORM 254/Contract Security Classification Specification identifying the period of retention and disposition instructions for the intelligence materials, once the specified period of retention ends.

c. Contractor shall maintain accountability for all intelligence released in his/her custody. Contractors must agree that all intelligence data released to them, all reproductions, and other material generated (including authorized reproductions) is the property of the US Government and will be returned upon request of the sponsoring agency or expiration date of the contract, whichever comes first.

d. Contractor shall not reproduce intelligence without permission from SSO HILL through the COR. If approved, must control each copy in the same manner as the original.

e. Contractor shall not reproduce intelligence without advance approval from the COR, except for working papers and derivative material produced in the publication process. Working papers and derivative material produced in the publication process do not need destruction approval.

5. Electronic Processing: Information assurance and electronic processing; information security (computer) and network connectivity require accreditation of the equipment connectivity. Networks processing corporate unclassified and/or other collateral information will follow the cognizant authority policy requirements. Prior authorization by a cognizant authority must be obtained before operation.

Ref: 10.f. Special Access Program (SAP) Information Addendum

Contract or Solicitation#

General: All security aspects/procedures for this effort will be administered IAW applicable Security Classification Guide(s) (SCGs), which will be transmitted under separate cover to an approved facility.

The contractor is required to perform any SAP activity in a government approved facility, accredited by AFOSI/PJ using AIS (if applicable) approved by same. The government Program Office will resolve any conflicting security guidance. This DD Form 254 clarifies the Special Access portion of this contract. The Government does not believe there is additional cost associated with this security clarification. If the contractor believes there is cost associated with this DD Form 254, they must bring it to the attention of the Contracting Officer prior to implementation.

1. Prior to subcontracting any portion of this activity, the contractor is required to receive written approval from the Government contracting office. The Contracting Officer will coordinate any new subcontracting requirements with the PSO through the AFNWC/NI Government SAP Security Officer (GSSO) prior to authorizing the contractor to initiate any new subcontracts. PSO approval of subcontracting must be received in writing by the contracting officer. All personnel requiring access to SAP information must be U.S. citizens, have been granted a final “SECRET” or “TOP SECRET” U.S.

Government security clearance (as determined by the AFOSI/PJ), have been approved as meeting established criteria by a Government cognizant authority, and have been indoctrinated for applicable SAP prior to being given access to such information generated or received under this contract.

Immigrant aliens, interim cleared personnel, or personnel holding contractor granted CONFIDENTIAL clearances are not eligible for access to classified information generated or released under this contract without the expressed written permission of the AFOSI/PJ PSO.

2. Contractor or government furnished material may not be provided to the Defense Technical Information Center (DTIC). Contractor generated reports will bear the statement: “Not releasable to the Defense Technical Information Center per DoD Instruction 5230.24.”

3. DSS is relieved of security cognizance for SAP portions of this activity.

4. Upon expiration of this contract, contractor shall request disposition instructions for all SAP program material. Any exception to security policy shall be referred to AFOSI/PJ PSO for coordination with the appropriate agencies and contracting officer.

Guidance can be found: http://www.esd.whs.mil/DD/DoD-Issuances/ http://www.e-publishing.af.mil/ http://www.dss.mil/isp/specialprograms.html

SAP References:

- DoDM 5200.01 Volumes 1-4 - Manual - DoD Information Security Program

- DoD 5220.22-M - The National Industrial Security Program Manual (NISPOM)

- DoDD 5205.07 - Directive - Special Access Program (SAP) Policy

- DoDI 5205.11 - Instruction - Management, Administration, and Oversight of DoD SAP

- DoDI 8510.01 - Instruction - Risk Management Framework (RMF) for DoD Information Technology (IT) using Joint SAP Implementation Guide (JSIG)

- DoDM 5205.07 Volumes 1 - Manual - DoD SAP Security: General Procedures

- DoDM 5205.07 Volumes 2 - Manual - DoD SAP Security: Personnel Security

- DoDM 5205.07 Volumes 3 - AFMAN 16-703 Volume 3 - Manual - SAP Security: Physical Security

- DoDM 5205.07 Volumes 4 - Manual - DoD SAP Security: Marking

- AFPD 16-7 - Directive - SAPs

- AFI 16-701 - Instruction - Management, Administration and Oversight of SAPs http://www.esd.whs.mil/DD/DoD-Issuances/ http://www.e-publishing.af.mil/ http://www.dss.mil/isp/specialprograms.html

- Air Force Security Marking Guide for SAPs

Supersession of any of the above documents found in Governing Guidance will not require an immediate revision to this DD Form 254. The updated document will be deemed to be on contract as of the date of supersession. Additional costs incurred due to the updated guidance will be brought to the attention of the GCO immediately. At contract expiration, the contractor shall request disposition instructions for all classified and unclassified material.

Ref: 11.i. TEMPEST Addendum

Emission Security (EMSEC) Requirements

EMISSIONS SECURITY ASSESSMENT REQUEST (ESAR)

FOR ALL CLASSIFIED SYSTEMS

1. The contractor shall ensure that compromising emanations (EMSEC) conditions related to this contract are minimized.

2. The contractor shall provide countermeasures assessment data to the Contracting Officer (CO), in the form of an ESAR. The ESAR shall provide only specific responses to the date required in paragraph c, below. The contractor’s standard security plan shall NOT be used as a “stand-alone” ESAR response. The contractor shall NOT submit a detailed facility analysis/assessment. The ESAR information will be used to complete an EMSEC Countermeasures Assessment Review of the contractor’s facility to be performed by the government EMSEC authority using current Air Force EMSEC directives. EMSEC is applied on a case-by-case basis and further information may be required to complete the review. Should this be the case, the contractor shall provide this information to the contracting officer when requested. After the evaluation of the ESAR by the government EMSEC authority, additional EMSEC requirements may be established.

3. ESAR contents shall include, as a minimum, the following information (NISPOM, paragraph 11- 101c) (Note: A copy of your Automated Information System Security Plan(s) (AISSP) will suffice.

a. The specific classification and special categories of material to be processed or handled by electronic means.

b. The specific location where classified processing will be performed.

c. The name, address, title and telephone number of a point-of-contact at the facility where processing will occur.

NOTE: Once the above information has been provided to the CO, no further reporting is required for equipment reconfigurations. However, if the facility is physically relocated to another geographical location, the information requested in paragraph c above MUST be furnished to the CO.

4. The prime contractor shall ensure that all subcontractors and/or vendors comply with EMSEC requirements when performing classified processing related to this contract. They will provide the above documentation through their prime to the contracting officer to complete the ESAR.

Ref: 11.j. Operations Security Requirements Addendum

Operations Security (OPSEC) Prime Contract or Solicitation #:

Reference: National Security Decision Directive (NSDD) 298

DOD 5205.02

DODD 5205.02E

AFI 10-701

All contractors, subcontractors, their employees, associates, and consultants who have access to critical information must comply with the DOD and Air Force-sponsored Operations Security (OPSEC) program. The OPSEC Program is directed by NSDD298, DOD Publications, and applicable Air Force guidance.

OPSEC is a systematic means of identifying and protecting information, which an adversary could use to their advantage or to our disadvantage. Critical Information (CI) is generally unclassified but can become classified through compilation. This sensitive information has been identified by the organization’s OPSEC program as requiring protection. OPSEC Measures (OM) are control standards with which all personnel must comply in order to protect CI against adversaries.

RESPONSIBILITIES:

The AFNWC/NI OPSEC Program Coordinator Timothy M. Gill will provide / approve OPSEC training curriculum for use by the contractor. Critical Information and Indicator Listings (CIILs) will be protected by all contract personnel. Approved organizational OPSEC measures will be used by all contract personnel to protect critical information in their possession and protect against current foreign intelligence and industrial espionage threats. The OPSEC PM/Coordinator and the Lead contractor must ensure all contract personnel working on the contract or having access to CI attend initial and annually recurring refresher training and that the approved curriculum is presented.

Training will be provided before contract personnel are allowed access to or handling of critical information. All contract personnel will comply with the organizations OPSEC standards and practices as trained. Additional training may be required based on updates to critical information, OPSEC measures, intelligence threat/vulnerability, or other fundamental changes to the OPSEC program. The OPSEC Coordinator is responsible for contacting the OPSEC Program Manager if OPSEC isn’t written into the contract.

The OPSEC PM/Coordinator for the organization will track OPSEC training statistics for all personnel working on the contract, when each individual has received the required OPSEC training, and when refresher training is due. Forward training statistics to the installation OPSEC PM at the end of each calendar quarter and/or upon request. The OPSEC Coordinator will provide a copy of the ICBMSD OPSEC Plan to the contractor upon request and the contractor is subject to the requirements of that plan. The ICBMSD OPSEC Plan is “for official use only” and distribution outside the constraints of the contract in part or in its entirety is prohibited. Upon completion of the contract, the contractor will destroy the OPSEC Plan by shredding the document so that it cannot be reconstructed and deleting any electronic copies.

Contactors with OPSEC requirements within a contract must ensure employees receive OPSEC training as specified within the contract. Accomplishment of training must not exceed 90 days from initial assignment to a contract with OPSEC requirements. Annual training will be accomplished NLT 30 September of each year. The contractor personnel will not be given access to

Ref: 11.j. Operations Security Requirements Addendum an organization’s CIIL until after training has been…