Attachment 18 EOMS II DD Form 254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

CONTROLLED UNCLASSIFIED INFORMATION (CUI) ADDENDUM ATTACHMENT

CONTROLLED UNCLASSIFIED INFORMATION (CUI) ADDENDUM

1. The definition of CUI is information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies, excluding information that is classified pursuant to Executive Order 13526 of 29 December 2009 or the Atomic Energy Act, as amended. In accordance with DoD Instruction 5230.24, Distribution Statements on Technical Documents, such information is referred to collectively as CUI. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), identifies the controls and protective measures developed for DoD CUI (i.e., For Official Use Only (FOUO), Law Enforcement Sensitive (LES), DoD Unclassified Controlled Nuclear Information (DoD UCNI), and LIMITED DISTRIBUTION) as well as some of those developed by other Executive Branch agencies.

2. When CUI is to be provided to or generated by DoD contractors, the controls and protective measures to be applied shall be described in the pertinent contract documents (e.g., contact clause; statement of work; or DD Form 254, “Department of Defense Contract Security Classification Specification”). Solicitations and contracts shall use a non-disclosure of information clause that prohibits release of unclassified information to the public without approval of the contracting activity. The clause shall also be made applicable to subcontractors.

3. The Contractor shall not release to anyone outside the Contractor’s organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract without prior approval from the government.

4. Technical Data is any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process or to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictoral delineations in media, such as computer software, drawings, or photographs, text in specifications, or related performance or design documents, or computer printouts. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and computer software documentation.

5. GOVERNMENT DISTRIBUTIONS STATEMENTS: Will be added to all technical data generated during the execution of this contract, in accordance with DoD Instruction 5230.24.

6. The contractor shall protect CUI from unauthorized disclosure by appropriately marking, safeguarding, disseminating, and destroying such information. CUI will be checked in accordance with DoD Instruction 5200.48.

7. CUI may be identified in security classification guides to ensure the information receives appropriate protection.

8. For unauthorized disclosures of CUI, no formal security inquiry or investigation is required. However, appropriate management action shall be taken to fix responsibility for unauthorized disclosure of CUI whenever feasible or required by other guidance, and appropriate disciplinary action shall be taken against those responsible. The DoD Component that originated the CUI shall be informed of its unauthorized disclosure.

CLASSIFY ACCORDINGLY

DoD SAP ADDENDUM

Mandatory for all SAP efforts

* All DD254s will be at the UNCLASSIFIED o CUI level*

**Remove any item NOT checked on DD254 in Section 10a-k AND Section 11a-m**

***Review ALL portions in BLUE AND update or remove as applicable***

(U) ADDENDUM FOR CONTRACT #XXXXXXXXXXX

(U) CONTRACT COMPLETION DATE: DD MMM YYYY

(U) NETWORK ACCESS REQUIRED: NIPR, SIPR, JWICS

(U) PRIVILEGED USERS SUPPORT THIS CONTRACT: YES

1. (U) Item 10a: Communication Security (COMSEC) Information: Contractor must forward request for COMSEC material/information through Contracting Officer Representative (COR). The contractor is governed by 32 CFR Pa1i 117.21. Access to COMSEC material is restricted to U.S. Citizens holding a final U.S. Government security clearance at the appropriate level. Prior approval from the Government Contracting Agency is required in order for a prime contractor to grant COMSEC access to a subcontractor. Non-accountable COMSEC information, though not tracked in the COMSEC material control system, may still require a level of control within a document control system. Refer to NSA/CSS Policy Manual 3- 16, "Control of Communications Security Material," and the Committee on National Security Systems Instruction (CNSSI) 4001 “Controlled Cryptographic Items," for guidance.

a. Unless “11.h.” is checked, all accountable COMSEC material provided to the contractor is on loan by a government COMSEC account under the terms of the contract and the contractor is established as a Local Element/Hand Receipt Holder of the Government account.

2. (U) Item 10b: Restricted Data (RD): Access to RD requires a final U.S. Government clearance at the appropriate level prior to access. Contractor must follow the guidelines as outlined in DoD Instruction 5210.02 “Access to and Dissemination of Restricted Data and Formerly Restricted Data". Government Contracting Activity (GCA) approval is required prior to granting RD access to a subcontractor.

3. (U) Item 10c: Critical Nuclear Weapon Design Information (CNWDI): Access requires a final U.S. Government clearance at the appropriate level. Contractor must follow the guidelines as outlined in DoD Instruction 5210.02 and 32 CFR Part 117.20. GCA approval is required prior to granting CNWDI access to a subcontractor.

4. (U) Item 10d. Formerly Restricted Data (FRD): Access to Formerly Restricted Data requires a final U.S. Government clearance at the appropriate level. Contractor must follow the guidelines as outlined in DoD Instruction 5210.02. GCA approval is required prior to granting FRD access to a subcontractor.

5. (U) Item 10e (1). Intelligence Information Sensitive Compartmented Information (SCI): See attached SCI Addendum for additional security requirements. Access to intelligence information require a final Top Secret U.S. Government clearance and SCI indoctrination. Personnel are required to sign a SCI Non-Disclosure Agreement. The contractor must provide individuals who are able to achieve and maintain the eligibility standards for access to SCI and other controlled access program information as set forth in the Intelligence Community Directive (ICD) 704 Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information, for continued employment. The GCA must provide prior approval before a subcontract involving access to intelligence information can be issued.

6. (U) Item 10e (2). Intelligence Information (Non-SCI): Contractor will require access to ICD 710 Classification Management and Control Markings System. For Non-SCI Requirements: All contractor personnel assigned under this contract must possess a current Top Secret security clearance. Personnel are required to sign a non-disclosure agreement. The GCA must provide prior approval before a subcontract involving access to non-intelligence information can be issued.

7. (U) Item 10f. Special Access Program (SAP) Information: This contract is in support of a special access program (SAP) imposing strict requirements for Need-to-Know (NTK), access controls, special handling procedures, physical security measures, and administrative controls beyond those prescribed for collateral Department of Defense (DoD) classified Information. This contract is a total carve out established in accordance with 32 CFR Part 117 and requires special security requirements.

a. (U) Personnel may be required to be accessed to additional programs based on mission need. Specific program security classification guides will be provided as needed under separate cover.

b. (U) The Defense Counterintelligence Security Agency (DCSA) Cognizant Security Office identified in Item 6c. of the DD Form 254 is relieved of respons1bility and security oversight under this contract. The PSO shall have overall security oversight and responsibility for this contract, to include oversight of all compartmented information and/or material received and/or generated under this contract.

c. (CLASSIFY) The contract document and its Contract Security Classification Specification (DD Form 254) shall not be released without prior written authorization from the PSO. If in direct support of a mission requirement and validated and approved by the PSO, the unclassified acknowledgement statement indicated in the Security Classification Guide (SCG) for the PID programs may be provided to un-cleared personnel; under no circumstance is CLASSIFIED, CONTROLLED UNCLASSIFIED, and/or HVSACO information to be divulged to individuals without formal access to the Special Access Program(s) and/or valid need-to-know. The PSO shall be notified immediately of attempts by unauthorized persons to seek information regarding this program. Public release of program information, regardless of the classification, is not authorized without approval from the GPM, the COR and the PSO.

(CLASSIFY) The Department of Defense Manuals (DoDM) 5205.07 Vol 1-4 and successor guidance as updated shall be utilized in the execution of this contract. A series of Security Classification Guides, specific to the PID programs to include collateral classification guides if applicable, will be provided to the contractor under separate cover. Other non-contract related SAP information is not authorized for use in the performance of this contract without prior written authorization of the Government Program Manager (GPM) and the cognizant Program Security Officer.

d. (U) This contract imposes strict application of the need-to-know principle. Program access is strictly limited to an absolute minimum number of persons essential to the fulfillment of this contract. Prospective candidates for performance on this contract shall not be informed of their consideration for access to a SAP. They may however, be advised of their consideration to a position requiring access to classified information. Nominees for access to program information will require written approval by the cognizant access approval authority, or designated representative prior to gaining knowledge of or access to any codeword or program related information. Access approvals are valid for 30 days following official notification, unless the PSO has approved an extension in writing. Persons approved for access will execute a Special Access Program Indoctrination Agreement (SAPIA) prior to receiving indoctrination briefings into this SAP. Executed SAPIAs shall be forwarded to the PSO within three (3) working days or uploaded into the DoD system of record.

e. (CLASSIFY) Baseline clearance and investigation requirements for the PID program(s) are: Update this section based on the specific access requirements identified in the program establishment paperwork.

i. (U) SECRET Level Access: A US Government SECRET clearance based on a current (within 6 years) completed Access National Agency Check (ANACI) or National Agency Check with Local Agency and Credit Checks (NACLC)/Tier 3 and access eligibility in accordance with Special Access Program Nomination Process (SAPNP) criteria.

ii. (U) TOP SECRET Level Access: A US Government TOP SECRET clearance based on a current (within 6 years) completed Single Scope Background Investigation (SSBI)/Tier 5 (T5) or SSBI Periodic Review (SSBI/PR)/Tier 5 Review (T5R) and access eligibility in accordance with the SAPNP criteria.

f. (U) Personnel nominated for access to Secret or Top Secret SAP information will be determined eligible/ineligible for access in accordance with the established DoDM 5205.07 Vol 2 Special Access Program Nomination Process (SAPNP) criteria.

g. (CLASSIFY) The Contract number INSERT FULL CONTRACT NUMBER, regardless of the classification per the SCG, is not authorized for release in the public domain without prior approval from the PSO. This includes any contractor corporate payment/management systems, requests for Common Access Cards, COMSEC accounts, requests for access to government systems, etc.

h. (U) All classified discussions, Information Systems (IS) processing and/or storage of any SAP information and/or materials will be conducted at the SAP accredited/approved facility identified in Section 8 of the attached DD Form 254.

i. (U) Classified information/materials generated under this contract will reflect appropriate security classification markings (e.g., portion and banner markings), program codeword, PID, and required access level, as stipulated in DoD guidance and the applicable SCGs.

j. (U) The Contractor Program Manager (CPM) and Contractor Program Security Officer (CPSO) have security classification review responsibility for information generated/produced in connection with this contract. Questions regarding security classification, not governed by specific security classification guidance, will be addressed to the PSO for a classification determination.

k. (U) Collateral information/materials not directly re1ating to this contract shall not be introduced or authorized within an approved program facility without prior written authorization from the PSO.

l. (CLASSIFY) Graphic arts, reproduction, publication, printing, binding, word processing, and clerical and administrative support services will not be subcontracted to commercial facilities nor will work on any program information relating to this contract by performed external to accredited PID program space/area(s) with in the contractor's facility.

m. (U) Classified or unclassified program subcontracting must have prior approval of the Procurement Contracting Officer (PCO) and PSO. The CPSO will complete a subcontractor or supplier data sheet for submission to the PSO. Any classified program activity which requires the use of a subcontractor facility must meet DoDM 5205.07 Vol 3 criteria and be approved by the PSO. The Prime Contractor CPSO is responsible for the security administration at the subcontractor facility, under the security oversight of the PSO.

n. (U) The CPSO is required to ensure that all adverse and Continuous Evaluation (CE) information regarding any indoctrinated personnel under his or her cognizance is forwarded to the Consolidated Adjudication Services (CAS) by the site or facility Local Security Manager or entry in Defense Information System for Security (DISS) or successor system of record procedures for reporting information. The CPSO is to retain evidential record of submission of said information to the CAS; compliance of this requirement will be validated during the facility compliance inspection. Additionally, the CPSO is required to adhere to the DoDM 5205.07 Vol 2 by providing the cognizant PSO with the applicable SAP Format(s), or other submitted documentation for any reportable adverse event/occurrence of indoctrinated personnel.

(U) Within 24 hours, contractors will notify their Agency (or GCA) PSO in writing of any and all security incidents. Subcontractors will also notify their prime contractors if they make any notifications or submit reports to their CSA IAW 32 CFR Part 117: NISPOM Rule. The prime contractor will also provide notification to both subcontractor management and FSO of subcontractor security incidents courtesy copying the Agency (or GCA) PSO.

(U) The prime contractor must provide the PSO documentation from the owning facility security officer (FSO), including subcontractors, attesting that Defense Information System for Security (DISS) entries have been made for each security violation. Documentation of DISS entry must be furnished within 30 calendar days of final report submission and must include the DISS entry date, DISS case number, culpable individual name, and security incident date, and the incident description entered in DISS.

o. (U) All programmatic material relating to this contract and its administration shall be classified and marked and transmission shall be protected in accordance with the program specific security classification guide, this DD Form 254, the DoDM 5205.07 Vol l and 4, DoD guidance or as directed by the PSO.

i. (U) TOP SECRET//SAR material shall not under any circumstances, be mailed through the U.S. Postal System. Courier of TOP SECRET//SAR material will be only on U.S. military or commercial aircraft with prior written PSO approval.

p. (U) The following mailing addresses will be utilized to send materials in support of this contract to the government:

(U) REQUESTS FOR PAYMENT - Follow the procurement and payment process specified in the contract document.

q. (U) The contractor's mailing procedures shall be sent to the PSO for review and approval. The contractor will immediately inform both the PCO and PSO of an1 change in the contractor’s mailing address or mailing procedures.

r. (U) All invoices/vouchers submitted under this contract will be UNCLASSIFIED and devoid of any information which would require them to be classified. Follow the invoice/voucher submission instructions contained in the contract/order.

s. (CLASSIFY) When counsel is retained by the contractor to represent corporate interests in matters related to or associated with PID sponsored activities, the PCO/PSO must be notified in writing. The counsel shall be treated as any subcontractor with a subcontract.

t. (U) The contractor shall comply with DoDI 5015.02 DoD Records Management Program for all records management procedures. Upon completion of this contract and when the final deliverable has been accepted by the Government, the contractor will conduct an inventory/audit of all accountable classified documents received or generated under this contract and forward a copy to the PSO. Documents necessary for contract close-out (i.e., notification of receipt and acceptance by sponsor, applicable financial documents, contracts, etc.) may be retained by the contractor after contract completion if determined, by the PCO and PSO, to be required for final audit and subsequent close-out.

u. (CLASSIFY) At the end of the contract Period of Performance, the contractor shall submit a written request to the PCO/PSO for authorization to retain specific materials or transfer materials to a new contract. Retention of any additional PID classified documents beyond contract closeout will be considered only if there is a follow-on contract. Exceptions to this may be granted by the Government on a case by case basis. Written requests should be forwarded to the PSO/PCO for consideration.

v. (U) Program related verbal communications shall be conducted on approved secure telephone lines. Therefore, the contractor shall obtain, operate, and maintain secure telephonic communications compatible with STE/vIPer phones. The cost of obtaining and operating secure communications shall not be a direct charge to the contract.

w. (U) The following reports/deliverables are required in addition to the requirements of the DoDM 5205.07 Vol 1-4 and successor guidance as updated:

i. (U) A Corrective Action Plan (CAP) addressing deficiencies noted during the compliance inspection will be developed and forwarded to the PSO no later than 30 days from contractor receipt of the inspection report. The CAP shall be updated and sent to the PSO every 30 days thereafter until all open items have been certified closed by the PSO.

ii. (U) Security Plan for Test will be developed in accordance with the DoDI 5000.89 Department of Defense Instruction Test and Evaluation policy and forwarded to the PSO for review no later than 90 days prior to the activity to ensure that a final plan is signed prior to the commencement of the events(s).

iii. (U) An approved site specific Operations Security (OPSEC) Plan is required. Site specific OPSEC plans will be developed in consonance with the guidance outlined within the current 32 CFR Part 117, and DoDM 5205 .07, Vol 1-4.

x. (U) Any conflict between instructions contained in 32 CFR Part 117, the DoDM 5205.07 Vol 1-4, the DoDM 5200.01 Vol 1-4, and this DD Form 254 must be reported to the PSO by the most expedient means for resolution.

y. (U) Non-compliance with any of the requirement and restrictions of this clause, 32 CFR Part 117, DoDM 5205.07 Vol 1-4, or other DoD security policy may result in debriefing and removal from access to this program, and may also be grounds for termination of the contract for default. Furthermore, any unauthorized disclosure of classified information pertaining to this contract or program could seriously affect the National Defense of the United States, and such revelation would be subject to Federal Prosecution under the Espionage Laws, Title 18, United States Code, Sections 641, 793, 794, 798, 952, and 1001.

8. (U) Item 10g. North Atlantic Treaty Organization (NATO): Access to NATO classified information requires a final U.S. Government clearance at the appropriate level and a NATO access briefing/debriefing. Prior approval of the contracting activity is required for subcontracting to impose NATO requirements or grant NATO access to a subcontractor. Contractor personnel shall be debriefed by the GCA prior to departure from this contract. The contractor must adhere to the requirements of 32 CFR Part 117.19.

9. (U) Item 10h. Foreign Government Information (FGI): FGI must be protected at the equivalent level provided to similar categories of U.S. Government information or as specified by the foreign Government in written Government-to-Government agreements. Access to classified FGI requires a final U.S. Government clearance at the appropriate level. Prior approval from the COR is required prior to subcontracting. The contractor must adhere to the requirements of 32 CFR Part 117.

10. (U) Item 10j. Controlled Unclassified Information (CUI): The Contractor is authorized access to CUI and it must be classified, declassified, marked, protected, stored, destroyed, transmitted, and transported, as specified in DoDI 5200.48 Controlled Unclassified Information. The contractor is prohibited from disclosing or disseminating this information without the expressed written authorization of the COR. In addition, contractors or subcontractors must obtain approval from the GCA prior to posting any unclassified information on the Internet. The contractor shall provide all cleared employees with some form of security education and training at least annually. Refresher training shall reinforce the information provided during the initial security briefing and shall keep cleared employees informed of appropriate changes in security regulations. Contractors shall maintain records about the programs offered and employee participation in them. Contractors may obtain defensive security, threat awareness, and other education and training information and material from their CSA or other sources.

a. (U) With the implementation of DoDI 5200.48, DoDI 5200.01, Volume 4, “DoD Information Security Program: Controlled Unclassified Information” (24 February 2012, as amended), has been cancelled and "For Official Use Only" (FOUO) and is no longer authorized.

b. (U) Unclassified Automated Information Systems (AIS) used to process CUI under this contract must meet the basic security requirements listed in the NIST SP 800-171 as amended, “Compliance for Federal Contract”. AIS accredited and approved for processing classified information under this contract are also approved to process DoD CUI.

c. (U) Transmission: CUI may be transmitted using the following:

· (U) Mail CUI may be sent via first class mail or parcel post. Bulk shipments may be sent by fourth class mail. Contents must be properly marked, but no markings will appear on the outer wrapper.

· (U) Facsimile - Normally CUI may be sent via Facsimile equipment. To prevent unauthorized disclosure, coversheets should be used, the locations of both fax machines should be considered, and availability of an authorized recipient at the receiving end should be confirmed. Secure classified fax machines may be used without the above verifications.

· (U) E-Mail/Web Sites - E-mail may be used on approved secure communication systems or systems using other protective measures such as Public Key Infrastructure (PKI) or transport layer security (e.g., https). E-mail messages must be appropriately marked to identify CUI status. Personnel will not use unofficial or personal email accounts, messaging systems, or other non-DoD information systems, except approved government contractor systems to conduct official business involving CUI.

· (U) Video Teleconferencing - Only use Government Agency approved secure, encrypted video conferencing and collaborative platforms (i.e. SVTC, etc.). CUI may not be discussed over commercially available video conferencing applications.

d. (U) Unauthorized Disclosure: Report misuse, mishandling, or Unauthorized Disclosure of CUI to the Unauthorized Disclosure Program Management Office, the Controlling Agency, and the appropriate Military Department Counterintelligence Organization. While Unauthorized Disclosure of CUI does not constitute a security violation, a formal security inquiry/ investigation is required if disciplinary action will be taken against the individual(s) responsible. Unauthorized Disclosure of certain CUI, such as export controlled-technical data, may also result in civil and criminal sanctions against responsible persons based on procedures codified in relevant law, regulation, or government-wide policy.

11. (U) Item 10k. Other (Specify): Contractor will require Access to the following Automated Information System (AIS): NIPR, SIPRNET, JWICS. Access must be approved in advance of allowing access to the contractor by the Cognizant Authority of each system. All unclassified DoD information in the possession of non-DoD entities on non-DoD information systems shall be protected in accordance with DoDI 8582.01, Security of Unclassified DoD Information on Non-DoD Information Systems.

Use below if Contractor has an accredited SCIF and has a JWICS system installed:

(CLASSIFY) (Contractor in question) acknowledges that access to information through Government networks shall be determined, as necessary, for contract performance. Any other use must be approved in writing by the sponsoring Government agency. Use of his information, or the connectivity provided, for marketing, business development, or attempting to gain advantage in future competitive acquisition is strictly prohibited and may result in severe sanctions against the individuals involved and the corporation. Sanctions may include termination of the current contract for cause and disbarment from future Government contracts.

12. (U) Item 11c. Receive, Store, and Generate Classified Information or Material: Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware. All classified information received, stored, or generated will be properly stored and handled according to the markings on the material. All classified Information received, stored, or generated is the property of the U.S. Government. The contractor cannot act as an Original Classification Authority. In the absence of a more specific localized guidance, the contractor can refer to and be guided by DoDI C-5240.08, Counterintelligence (CI) Security Classification Guide. The contractor is not authorized to release U.S. Government classified material to any activity or person, including subcontractors without the COR's written approval. All requirements for the control and accounting for original documentation and copies apply. Classified information will be protected IAW 32 CFR Part 117.155, DoDM 5200.01, Vol 3, and DoDM 5205.07 Vol 1, and DoDM 5105.21 Vol 1. At the termination or expiration of this contract, the U.S. Government will be contacted for proper disposition instructions. Contractor will abide by the following security classification guidance: List unclassified titles or identities and provide SCG(s) either, in the contract package or under separate cover. If under separate cover, add “Provided under separate cover” following the listed SCG(s).

13. (U) Item 11d. Fabricate, Modify, or Store Classified Hardware: (Note: As the Cognizance Security Office, the PSO, should verify the appropriate mailing or shipping address to transmit any classified hardware and to verify the approved classified storage capacity at the contractor facility and any other contractor actual performance locations. Describe the nature and extent of the storage that will be required. Will Restricted or Closed Areas be required? Is hardware involved? If so, how much hardware is involved? How large is the hardware? Will there be a separate requirement for open storage of classified documents?)

14. (U) Item 11f. Have Access to U.S. Classified Information Outside the U.S., Puerto Rico, U.S.

Possessions and Trust Territories: The Contractor, when performing or traveling outside the United States under this contract shall:

a. (U) Affiliate with the Overseas Security Advisory Council if the contractor or subcontract U.S. entity.

b. (U) Ensure personnel who are in-country on a non-transitory basis, register with the U.S. Embassy, and that contractor and subcontractor personnel who are third country nationals comply with any security related requirements of the Embassy of their nationality.

c. (U) Provide all personnel with Antiterrorism/Force Protection Awareness (ATFP) Information commensurate with which the DOD provides to its military and civilian personnel, to the extent such information can be made available prior to travel outside the United States.

d. (U) Obtain and comply with the most current ATFP guidance for contractor personnel.

e. (CLASSIFY) Overseas places of performance are expected to include: (Note: Indicate the overseas city and country where performance will occur.)

15. (U) Item 11g.·Be Authorized to Use the Services of Defense Technical Information Center (DTIC) or Other Secondary Distribution Center: Contractor must prepare and forward DD Form 1540, “Registration for Scientific and Technical Information Services” and DD Form 2345, “Military Critical Technical Data Agreement” to the COR for authorization BEFORE the services may be requested. Technical information on file at the DTIC will be available to the contractor if the contractor requires such information. The contracting officer will certify the field of interest relating to the contract. Awarded subcontract DD Form 254 must state “Information extracted from classified reference material shall be classified according to the marking on such material.”

16. (U) Item 11h. Require a COMSEC Account: All program related classified verbal and electronic communications shall be conducted on approved secured instruments. Therefore, the contractor shall obtain, operate, and maintain a secure encrypted communication capability compatible with Government equipment. Prior approval from the GCA is required in order for a prime contractor to grant COMSEC access to a subcontractor. Requests to utilize the contract number in order to establish a COMSEC account must be approved by the GCA. The contractor is governed by 32 CFR Part 117.21 Communication Security (COMSEC) and NSA/CSS Policy Manual 3-16. Access to COMSEC material is restricted to US Citizens holding a final US Government security clearance. Such information is not releasable to personnel holding only reciprocal clearance.

17. (U) Item 11i. Have a TEMPEST Requirement: Prior to processing classified information on an information system, the contract will undergo the Risk Management Framework (RMF) process in accordance with the Joint SAP Implementation Guide (JSIG) (for SAP information). All IS shall adhere to the JSIG and in accordance with the Office of Defense (OSD) Transition to Risk Management Framework Memorandum dated 18 Dec 2013. Per the transition memorandum, all SAP/SCI systems shall be accredited under JSIG before processing SAP/SCI information. The contractor shall provide the Security Control Assessor (SCA) with the RMF compliant body of evidence documentation, as identified in the JSIG (for SAP) or DODI 8500.01 (for collateral). The contractor shall submit to the PSO a TEMPEST Checklist and any additional forms as required by the TEMPEST security standards in accordance with CNSSP 300 (National Policy on Control of Compromising Emanations). The contractor will be required upon award of contract to ensure compliance with either (a) the TEMPEST countermeasure(s) required by the Authorizing Official (AO) based on recommendations by the Certified TEMPEST Technical Authority (CTTA) in accordance with the CNSSI 7000 (TEMPEST Countermeasures for Facilities) or, (b) more limited countermeasures imposed by the CTTA, based upon evaluation of the TEMPEST Checklist. The contractor shall not expend any funds to achieve TEMPEST compliance until the TEMPEST Checklist has been evaluated, compliance directions has been received in writing from the PSO/SSO, and written approval for fund expenditure has been received in writing from the PCO.

18. (U) Item 11j. Have Operations Security (OPSEC) Requirements: The contractor will apply Operations Security (OPSEC) to enhance protection for classified and unclassified critical information. While the documents identified in references below provide details on the development of OPSEC programs and implementation of OPSEC analyses, the requirements below provide the minimum standards for OPSEC application directed in this contract.

a. (U) The contractor manager or a delegated OPSEC coordinator will be familiar with operations security (OPSEC) as described in National Security Decision Directive Number 298, DoD Directive 5205.02, and DoD Manual 5205 .02-M.

b. (CLASSIFY) Military Service and COCOM OPSEC guidance (Joint Publication 3-13.3, CJCS Instructions, and appropriate Service or COCOM issuances) may also apply if the contracted activity is performed in a Service or COCOM operational environment. If performance is conducted in a tenant arrangement within a Service or COCOM environment and a conflict is identified in local guidance, forward concerns through the GPM, to the PSO for clarification.

c. (U) The PSO is the authority to resolve all OPSEC guidance conflict(s) for this contract and will coordinate with the Service or COCOM OPSEC Program Manager as needed.

d. (U) Personnel will comply with OPSEC measures and program requirements established at the government site/program.

e. (U) Personnel supporting the contract will protect details described on the Critical Information List (CIL) provided by the COR as proprietary to the government.

f. (U) All personnel supporting the contract will receive initial and recurring (at least annually) OPSEC awareness training that identifies relevant threat information including techniques used by adversaries to obtain classified and unclassified critical information, directed OPSEC measures, OPSEC coordinator contact information, and reporting requirements. The OPSEC coordinator will maintain training records that can be reviewed during assessments or compliance inspections.

19. (U) Item 11k. Be Authorized to Use the Defense Courier Service (DCS): The use of DCS is on a case by case only. All requests to utilize DCS will go through the PSO to the SAPCO for approval. Written approval from the GCA is required before a Prime Contractor can authorize a subcontractor to use the services of DCS.

Only certain classified information qualifies for shipment by DCS. The GCA is responsible for complying with DCS policy and procedures. Prior approval of GCA is required before a Prime Contractor can authorize a subcontractor to use the services of DCS. Guidance can be found in DoDI 5200.33 Defense Courier Operations.

20. (U) Item 11l. Receive Store or Generate Controlled Unclassified Information (CUI): Contractor will refer to DoDI 5200.48 when receiving, storing, or generating CUI. Contractors shall provide all cleared employees with security training and briefings commensurate with their involvement with classified information. The contractor shall provide all cleared employees with some form of security education and training at least annually. Refresher training shall reinforce the information provided during the initial security briefing and shall keep cleared employees informed of appropriate changes in security regulations. Contractors shall maintain records about the programs offered and employee participation in them. Contractors may obtain defensive security, threat awareness, and other education and training information and material from their CSA or other sources.

21. (U) Item 11m. Other:

a. (U) All unclassified DoD information in the possession of non-DoD entities on non-DoD information systems shall be protected in accordance with DoDI 8582.01, “Security of Non-DoD Information Systems Processing Nonpublic DoD Information.”

b. (U) The contractor organization is required to establish and implement an Insider Threat program as required per 32 CFR Part 117.7(d). All Insider Threat concerns and reports as well as all Department of Defense Insider Threat Management Analysis Center (DITMAC) threshold-level events (per the UNSECDEF for Intel MEMO - Reporting Information to the DITMAC, Dec 2016) involving or pertaining to personnel supporting this contract will be submitted within 24 hours of incident or incident notification to the Counter Insider Threat (CINT) Program Office via secure phone at XXX-XXX-XXXX. If a Military Department Counterintelligence Organization (MDCO) or a DoD Law Enforcement Activity (LEA) has accepted investigative jurisdiction of an Insider Threat incident or inquiry pertaining to personnel supporting this contract, the contractor is to provide the SAP CINT Program Office with the following information regarding the inquiry or investigation:

i. First and Last Name of employee being investigated.

ii. Date of Birth of employee being investigated.

iii. Place of Birth of employee being investigated.

iv. Social Security Number (SSN) of employee being investigated.

v. DoD Identification Number of employee being investigated, if issued a Common Access Card (CAC)

vi. Name of the MDCO or LEA that has jurisdiction of the inquiry or investigation.

c. (U) Consent to subcontract restriction : All security requirements levied upon the prime contractor and/or otherwise associated with this contract shall immediately be flowed down from the prime contractor to any subcontractor (or from a subcontractor to a lower tier subcontractor), regardless of the scope of any such participation should it require access to classified information or unescorted access to controlled space where classified information (regardless of media) and/or hardware is open-stored, generated or otherwise accessible. Escorted access is defined as being under the visual control of appropriately cleared personnel with the requisite need-to-know. Subcontractors are expressly not authorized to participate in this contract unless and until such time that the COR has expressly consented in writing to the participation of any such participant.

d. (U) Contractors who have received a Common Access Card (CAC) to access to government installations and systems pursuant to the requirements of the contract are required to notify the Trusted Agent (TA) when an individual is no longer supporting the contract for which they obtained the CAC. All CACs must be returned to the TA at this time.

ADD ONLY FOR SCI CONTRACTS

e. (U) All classified SCI visit requests by contractors shall be forwarded to the COR for approval and need-to-know certification before being sent to the facility to be visited. Contractor individuals who hold SCI access through this contract are required to notify the SSO prior to leaving the contract or being debriefed from SAP programs. Any SCI-related government issued badges must be returned. Failure on the part of the contractor for not ensuring their employee is properly debriefed may result in a security violation against the company. In the event of a suspected or verified security violation involving SCI associated with this contract or pre-award effort, the CPSO or FSO must notify the PSO within 24-hours of their knowledge of the incident. The PSO will advise SSO immediately upon notification from the contractor.

22. (U) Item 12. Public Release: No public release or disclosure is authorized of classified program information. A pre-release and/or pre-publication security review is required prior to the disclosure of information which is either categorically or directly related to the program, but not formally classified within SAP channels. In each case, approval must be obtained from the GPM. The request must be submitted from the person desiring to make the publication or presentation, via the Contractor Program Security Officer (CPSO) to the PSO with at least 30 days prior to its intended release.

23. (U) Item 13. Security Guidance: The contractor will adhere to all policy guidance listed in Item 13 of the DD 254.

a. (U) The contractor shall adhere to the following Security Classification Guides (SCGs) in accordance with Program Office (PO) guidance and all classification guidance signed by the DON SAPCO (or other agency as appropriate) and implemented by the PO. This includes:

i. (CLASSIFY) The current PID SCGs.

ii. (U) Program Office instructions.

b. (U) A site-specific OPSEC plan and/or Program Protection Implementation Plan is required to be submitted to the PSO within 6 months of contract award.

c. (U) Personnel may be required to be accessed to additional Special Access Programs based on mission need. Specific program security classification guides will be provided as needed via approved program system.

d. (U) An insider threat program is required per 32 CFR Part 117.

CLASSIFY ACCORDINGLY

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, "DoD Contract Security Classification Specification"

101…