Attachment 2 - DD254_SOLICITATION_FA8307-26-R-B033.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

(Updated 20250815)

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

August 31, 2028 The public reporting burden for this collection of information, 0704-0567, is estimated to average 36 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD Form 254, "DoD Contract Security Classification Specification"

(See Instructions) - Select from drop-down list: 2

Hanscom SSO: AFLCMC/INHS, 102 Barksdale Street, Hanscom AFB, MA 01731-1801 Defense Counterintelligence Security Agency (DCSA), 27130 Telegraph Road, Quantico, VA 22134

OPSEC GUIDANCE via AFI 10-701, dated 24 July 2019.

Ref Blk 1b: Contractor must obtain SECRET safeguarding capability prior to being provided SECRET information. *Facility will not store classified until facility is cleared to safeguard classified documents.

Ref Blk 8a: All personnel shall comply with local DoD and National Security Policies as defined and enforced at the place of performance (see block 8). The local Commander has the delegated responsibility to assign “Need to Know” and authorize access to classified information, data, and/or products.

Ref Block 10a/11h: COMSEC information includes accountable or non-accountable COMSEC information and controlled cryptographic items (CCI). Access to COMSEC information is authorized to the prime contractor only. Further release requires prior approval from the owner of the COMSEC information. Lackland Line Managers will provide assistance to identify and obtain a source of COMSEC material support (whether from NSA or Air Force) for the contractor. COMSEC/Cryptologic safeguarding requirements apply. See AFMAN 17-1302-O, Communications Security (COMSEC) Operations for guidance.

Ref Blks 10e (2): Contractor will require access to intelligence information and must comply with directions provided by the Contracting Officer’s Representative (COR). The Program Manager has determined that disclosure does not create an unfair competitive advantage for the contractor or a conflict of interest with the contractor’s obligation to protect the information. The COR will identify what intelligence information is required for the contractor to satisfy the contract and will submit that information to the servicing Senior Intelligence Officer (SIO) for approval prior to granting access. Please note that the COR is required to maintain a list of all Collateral Intelligence released to the contractor. This information is not authorized to be released by the contractor (including release to a subcontractor) without prior written authorization of the releasing authority. Access to intelligence data (non-SCI) will be at the location listed in block 8c.

Block 10.g: To facilitate potential access to NATO classified information, all DoD military, civilian, and contractor personnel who are briefed on their responsibilities for protecting U. S. classified military information, shall also be briefed on the requirements for protecting NATO information. NATO briefing required prior to granting access. See 32 CFR Part 117 section 117.19 (g) (7) for details.

Ref Blk 10h: Access to Foreign Government Information (FGI) by cleared U.S. persons is based on the individuals having a valid need-to-know and a personnel security clearance (interim or final). Foreign Government Information: Any foreign government information (excluding NATO). Foreign Government Information (FGI) is classified information provided to the U.S. by a foreign government, an international organization, or any other element thereof which shall be protected, controlled and safeguarded in accordance with reference (e). (This does not include NATO.) The control and safeguarding requirements for FGI may be modified as required or permitted by a treaty or international agreement or, for other obligations that do not have the legal status of a treaty or international agreement such as a contract), by the responsible National security authority of the originating government.

Ref Blk 10j/11l: The contractor shall comply with DoDI 5200.48_DAFI16-1403, Controlled Unclassified Information, DoDM 5200.01, Vol 1_AFMAN16-1404, Vol 1, Air Force Information Security Program, and DoDM 5400.07_AFMAN33-302 Air Force Manual, DoD Freedom of Information Act (FOIA) Program. The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

Ref Blk 10k: Network (SIPRNET) is authorized. SIPRNET users shall receive the Air Force North Atlantic Treaty Organization (NATO) Security Awareness Briefing and sign an acknowledgment prior to SIPRNET access. A formal NATO briefing is required when 1) the SIPRNET enclave, or other classified networks, is approved for NATO and no additional security measures are in place to preclude access or 2) Access to NATO information is authorized. Formal NATO briefings shall be accomplished IAW 32 CFR Part 117 section 117.19 (g) (7).

Contractor employees who need access to government information technology (IT) assigned to national security positions or required to perform national security duties will be subject to investigation to determine whether they are and will remain reliable, trustworthy, of good conduct and character, and loyal to the United States and whether granting or continuing national security eligibility is clearly consistent with the national interest. IT level positions are defined in DoDM5200.02_AFMAN16-1405, Procedures for the DoD Personnel Security Program (PSP)/Air Force Personnel Security 16-1405, Section 3. Performance of these types of duties require a favorably completed Personnel Security Investigation also known as a trustworthiness determination; they do not result in clearance eligibility.

IT Level I duties require a favorably completed Tier 5 (T5) investigation and a periodic reinvestigation every 5 years.

IT Level II duties require a favorably completed Tier 3 (T3) investigation.

IT Level III duties require a favorably completed Tier 1 (T1) investigation.

Ref Blk 11a: Using activity will provide security classification guidance for performance on this contract. On base performance in support of the USMILGP-Bogota , Embassy of the United States, Bogota, Colombia. If any classified information is generated in the performance of this contract at the identified location, the contractor shall apply derivative classification and markings consistent with the source material.

Ref Blk 11f: Overseas contractor performance will occur as an intermittent visitor or a visitor group at USMILGP-Bogota, Embassy of the United States, Bogota, Colombia. DCSA is relieved of all security oversight for performance on the installation and overseas performance. Security oversight will be under the cognizance USSOUTHCOM, 9301 NW 33rd St. Doral, FL 33172 for collateral classified performance.

Ref Blk 11j: Have Operations Security (OPSEC) Requirements: OPSEC requirements apply. See Performance Work Statement (PWS) for requirements.

Ref Blk 11k: Go to https://www.ustranscom.mil/cmd/associated/dcd/ for Defense Courier Service points of contacts and guidance.

Ref Blk 11m: The Following FARS and DFARS Clauses apply, Far Clause 52.240-92, FAR Clause 52.240-93, DFARS Clause 252.204-7012, DFARS 252.204-7000, DFARS 252.204-7008 and DFARS 252.204-7009.

Ref Blk 12: Public Release: Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the NISPOM (DoD 5220.22-M), unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority. The contractor is responsible for obtaining the approval of the GCA prior to release of any information received or generated under the contract, except for certain types of information authorized by the NISPOM. Subcontractors must submit requests for public release through the prime contractor. The prime contractor is responsible for submitting the subcontractor’s request for public release to the GCA public release authority. Contractor is to submit requests through the Contracting Officer for OPSEC Program Manager review and public release authorization. The Contracting Officer will provide contractor with written approval/disapproval. Information requiring AF or DoD-level review will be reviewed by the unit's OPSEC Program Manager or Coordinator who will in-turn forward to the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690. Transmission of public release request via e-mail is not authorized.

Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware. All classified information received or generated will be properly stored and handled according to the markings on the material. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of the contract, the U.S. Government will be contacted for proper disposition instructions. Contractor will abide by and shall apply derivative classification and markings governed by the current version of the following security classification guidance: The National Industrial Security Program Operating Manual (NISPOM), February 2006, Incorporating Change 2 May 18, 2016 applies. Prior to declassifying or downgrading information marked with a date or event on the "declassify on" line: The Contractor will confirm the OCA has not extended the classification period by reference to the applicable Security Classification or Declassification Guide or by consulting with the Program Office with the OCA.

1. Responsibilities.

1. Air Force components that originate or are responsible for technical documents must determine their documents’ distribution availability and mark them appropriately before disseminating them. Components are responsible for the proper handling, securing, disseminating, and disposing of scientific and technical information.

1.1. The AFI 61-204 Instruction is based upon DODD 5230.24 and applies to all technical documents. “It also applies to engineering drawings, standards, specifications, technical manuals, blueprints, drawings, plans, instructions, computer software and documentation, photographs, technical orders, databases, and any information that can be used or adapted for use to design, engineer, produce, manufacture, operate, repair, overhaul, or reproduce any military or space equipment or technology concerning that equipment. It applies to any medium that transfers information, including paper, microform, electronic storage, and video recordings.” These technical documents can be defined as”…information that conveys scientific and technical information or information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process or to design, procure, produce, support, maintain, operate, repair or overhaul material. This data may be graphic or delineations in media, such as drawings or photographs, text in specifications or related performance or design type documents or computer printouts. Examples of technical data include research and engineering data, engineering drawings and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information and computer software documentation.

2. Marking Scientific and Technical Documents.

2.1. Mark all scientific and technical documents, whether produced in hard-copy or in digital format that may be disseminated.

2.1.1. Apply the single most appropriate distribution statements. Fill in the reason, the date of determination, and the controlling DoD office. Other changes to these distribution statements are prohibited. NOTE: Distribution statements apply to secondary distribution only; they do not apply to primary distribution from the controlling DoD office. Distribution control markings must be clearly discernable as documents and/or data are opened. Record media casings must also be clearly marked.

3. Dissemination of Scientific and Technical Information.

3.1. Do not disseminate any scientific or technical document, including one in draft or preliminary form that does not have a clearly marked distribution statement.

3.2. Primary dissemination of scientific or technical information must be in accordance with all regulations and instructions applicable to the scope of primary dissemination or the document’s distribution statement, whichever covers the broader audience.

Below is the marking that is to be used for all documents that require STINFO markings.

DISTRIBUTION F: Further dissemination only as directed by AFLCMC/HNCCPF/AFLCMC/HNC or DOD higher authority.

WARNING: This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C Sec 2751 et seq.) or the Export Administration Act of 1979, as amended (Title 50 U.S.C. App. 2401 et seq.). Violators of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DOD Directive 5230.25.

HANDLING AND DESTRUCTION NOTICE: Comply with distribution statement and destroy by any method that will prevent disclosure of contents or reconstruction of the document. (STINFO markings should be located on the title page of the published or drafted document, briefing, drawing, etc. Markings require the following: (1) Distribution Statement, (2) Warning, and (3) Handling and Destruction Notice).

The contractor shall follow the Security Classification Guide (SCG) and all security classification guides of systems/information associated with the program for derivative classification, identification of the level and duration of classification for specific information elements, and public release requirements.

Prior to declassifying or downgrading information marked with a date or event on the "declassify on" line, the Contractor will confirm the Original Classification Authority (OCA) has not extended the classification period by reference to the applicable Security Classification or Declassification Guide, or by consulting with the OCAs Program Office. Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware. All classified information received or generated will be properly stored and handled according to the markings on the material. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of the contract, the U.S. Government will be contacted for proper disposition instructions. Contractor will abide by and shall apply derivative classification and markings governed by the current version of the following security classification guidance.

The contractor shall identify CPI and Resident CPI (formerly called Critical Technology) which need to be protected. The CPI identified shall be approved by the USG Program Manager. The CPI identification shall include a review of the system, unique integration, support equipment and the Non-Resident design/process/material aspects of the program. All identified CPI shall be protected with appropriate countermeasures. In the case of Resident CPI the use of Anti-Tamper shall be considered and documented in an Anti-Tamper Recommendation Report in accordance with the DAG Chapter 13 and DoDI 5200.39. The contractor shall identify system security engineering requirements in the contractor’s Requirements Management Specification, write Test Plans and accomplish Verification Testing to mitigate protection risks to an appropriate level.

The Contractor will notify the Government Contracting Activity and the Government Security Manager within 24 hours of any incident involving the actual or suspected compromise/loss of classified information to enable the Government to conduct immediate assessment of potential impact pending formal inquiry/investigation. Actual or suspected compromise of Covered Defense Information will be reported IAW DFARS Clause 252.204-7012.

FAR Clause 52.240-92 – Security Requirements – Contract involves access to information classified Confidential, Secret or Top Secret. Compliance with the NISPOM.

FAR Clause 52.240-93 – Basic Safeguarding of Covered Contractor Information – Information not intended for public release that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government.

DFARS 252.204-7000 –Disclosure of Information – Prohibits the contractor from releasing any classified information pertaining to the contract or any program related to the contract, unless they have CO approval.

DFARS 252.204-7008 – Compliance with Safeguarding Covered Defense Information Controls – Requires contractors and subcontractors to safeguard covered defense information that resides in or transmits through covered contractor information systems by applying specified network security controls as identified in NISTSP 800-171.

DFARS 252.204-7009 – Limitations on the use or disclosure of Third-Party Contractor reported Cyber Incident Information – Required for contractor services that include support for the Government’s activities related to safeguarding covered defense information and cyber incident reporting.

DFARS Clause 252.204-7012 – Safeguarding Covered Defense Information (CDI) and Cyber Incident Reporting – Requires a company to safeguard CDI and to report to the DoD the possible exfiltration, manipulation, or other loss or compromise of unclassified CDI.

DFARS Clause 252.239-7000 and 252.239-7001 - For additional EMSEC requirements.

- Program Manager/COR - Carlos R. Cortez, HNCPPF, Lackland AFB, TX , 210-925-2530, carlos.cortez.14@us.af.mil Reviewing Official’s Office Symbol, phone and email (6): AFLCMC/HNCCPF

COR

Reviewing Official’s Office Symbol, phone and email (6): AFLCMC/HNCCPF

CHIEF, FMS

Reviewing Official’s Office Symbol, phone and email (6): AFLCMC/HNCC

OPSEC COORDINATOR

Reviewing Official’s Office Symbol, phone and email (6): AFLCMC/HNC-SO

INDUSTRIAL SECURITY MANAGER

Reviewing Official’s Office Symbol, phone and email (6): AFLCMC/INHS

SPECIAL SECURITY OFFICE (SSO)

Reviewing Official’s Office Symbol, phone and email (6): AFLCMC/HNC-SO

CHIEF OF SECURITY / IP

AFLCMC/HNCCPF

NAME & TITLE OF REVIEWING OFFICIAL (6): MOORE, TANESHA

AFLCMC/HNCCPF

NAME & TITLE OF REVIEWING OFFICIAL (6): TSgt MEYER, ADAM J.

AFLCMC/HNCC

NAME & TITLE OF REVIEWING OFFICIAL (6): LARA, JESUS A.

AFLCM/HNC-SO

NAME & TITLE OF REVIEWING OFFICIAL (6): DARLENE CEROVAC

AFLCMC/INHS

NAME & TITLE OF REVIEWING OFFICIAL (6): WALKER, KIMALA A., GG-14, DAF

CHIEF OF SECURITY/IP

Ref Blk 11f: The DCSA is relieved of all security oversight for performance on the installation and overseas performance. USSOUTHCOM, 9301 NW 33rd St. Doral, FL 33172 will maintain security oversight.

Bldg. 1530 San Antonio, TX 78226-1810