Attachment 2. DD254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, "DoD Contract Security Classification Specification"

Linthicum, MD 21090 Enter general unclassified description of this procurement.: The contractor shall support DC3 Systems Engineering and Technical Assistance (SETA) Professional Support Services - In the delivery of Cyber Support and Mission & Enterprise Management under Contract # TBD

Period of Performance: 9/2026-3/2030

CO: AFDW/PKA, Joycelyn Roux@us.af.mil

COR/PM: DC3/ER, Robi Wainwright, robi.wainwright.2@us.af.mil, 410-981-0496

DC3 SETA Technical Point of Contact (TPOC): Alan Savage, alan.savage.2@us.af.mil, 410-981-1038

SSO: HQ AFOSI/XI-SSO, 27130 Telegraph Road, Quantico, VA 22134 Phone: 571-305-8714

The following items apply to this contract:

Continuation DD Form 254: Security Guidance

Item 8.a. ACTUAL PERFORMANCE LOCATION: TBD

Item 10a. COMMUNICATIONS SECURITY (COMSEC): COMSEC material/information may not be released to DoD contractors without the Air Force Cryptological Support Center’s Approval. Contractor must forward request for COMSEC material/information to the COMSEC officer through the Program Office. The contractor is governed by DoD 5220.22-S, COMSEC Supplement to the NISPOM in the control and protection of COMSEC material/information.

Access to COMSEC MATERIAL BY PERSONNEL IS RESTRICTED TO U.S. CITIZENS HOLDING A FINAL U.S. Government clearance. Such information is not releasable to personnel holding only reciprocal clearances.

10.b. RESTRICTED DATA (RD): The contractor is permitted access to RD in the performance of this contract and will be briefed accordingly.

10.d. FORMERLY RESTRICTED DATA (FRD): The contractor is permitted access to FRD in the performance of this contract. Access to FRD requires a final U.S. Government clearance at the appropriate level.

Item 10.e. Personnel working on the DC3 Task Order are subject to random counterintelligence (CI) polygraphs as needed.

(1) SENSITIVE COMMPARTMENTED INFORMATION (SCI): Contractor requires access to SCI and Non-SCI intelligence materials/information. Prior approval of the contracting activity is required for subcontracting. Access to intelligence information requires a final U.S. government clearance at the appropriate level. Contractor will comply with all applicable agency directives IAW DCID 6/9, Director of Central Intelligence Directives.

Item 10.e. (2) NON-SENSITIVE COMPARTMENTED INFORMATION (SCI): See paragraph 10.e. (1) above.

Item 10.f. SPECIAL ACCESS INFORMATION: DC3 managers of Special Access Programs (SAP) will grant access when the need-to-know is required to accomplish the tasking under this contract. Use of SAP material by contractors will be at DC3 or other government facilities.

Item 10.g. NORTH ATLANTIC TREATY ORGANIZATION (NATO) INFORMATION:

The contractor is permitted access to NATO information in the performance of this contract.

Item 10.h.: FOREIGN GOVERNMENT INFORMATION: The contractor is permitted access to Foreign Government information in the performance of this contract. Access requires a final U.S. Government clearance at the appropriate level.

Item 10.i.: LIMITED DISSEMINATION INFORMATION: The contractor is permitted access to Limited Dissemination information in the performance of this contract. Access requires a final U.S. Government clearance at the appropriate level.

Item 10.j.: FOUO information provided under this contract will continue to be safeguarded as specified in the “For Official Use Only” addendum. However, there are pending changes to discontinue the use of FOUO marking. All internally created FOUO documents, upon review, will be remarked Unclassified or IAW CUI guidelines, as appropriate, based upon the content of the information. Cognizance of CUI requirements is required.

Item 10.k.:

(1) Contractor personnel will not release the Law Enforcement Sensitive material to any activity or person of the contractor’s organization not directly engaged in providing services under the contract or to another contractor (including subcontractors), government agencies, private individuals or organizations without prior approval of the Directorate, Enterprise Resource and Management.

(2) Material provided or generated in support of this contract does not become the property of the contractor. Upon expiration of the contract, all Law Enforcement Sensitive Information released and any material using data from such sensitive information shall be returned to the Contracting Officer or authorized representative for final disposition. All Law Enforcement Sensitive materials will be afforded at a minimum the same level of protection as material classified as Confidential. Due regard for security will be considered in telephone conversations, facsimile, and e-mail communications.

(3) Contract employees to perform work assignments within the DC3 Sensitive Compartmented Information Facility (SCIF) are required to possess and maintain a Top Secret Security clearance, based on a favorably adjudicated T5 investigation, with SCI eligibility.

a. Contract employees to perform work assignments within the DC3 SCIF on Special Access Programs (SAP) are required to possess and maintain a Top Secret security clearance based on a favorably adjudicated T5 investigation, with SCI and/or Single Integrated Operations Program (SIOP) eligibility.

(4) Contract employees to perform work assignments within the DC3, SETA are required to possess and maintain a Secret Security clearance. (Unsure if this will be a requirement.)

(5) Contract servicing security managers are required to validate employees’ clearances information and pass visit requests via DISS to the DC3 Security Manager within 48 hours of hiring, in accordance with the National Industrial Security Program Operating Manual (NISPOM).

a. In the case(s) of military members who are retired or mustered out of the military, the servicing security manager is required to convert the individual(s) military security clearance to civilian status.

b. In the case(s) of personnel obtained from other civilian agencies, servicing security managers are required to request transfer of security clearance information to their agency.

(6) DC3 does not have Original Classification Authority. Each DC3 Directorate interacts with organizations that provide Security Classification Guides. These are available to contractors on site at DC3.

Item 11.a. Contractor performance is restricted to TBD, DC3, 911 Elkridge Landing Road, Linthicum, MD 21090; locations in Maryland. (May want to maintain 911 building since contractor employees will be expected to attend meetings, etc., on-site.)

Item 11.c.: The contractor requires access to classified source data up to and including Top Secret in support of the work effect. DC3 does not have Original Classification Authority. Each DC3 Directorate interacts with organizations that provide Security Classification Guides. These are available to contractors on site at DC3.

14: REPORTS: In addition to the contractor’s reporting requirements in the NISPOM, the Contractor Facility Security Officer shall provide a copy of any report submitted to the DOD CAF via DISS and to the Cognizant Security Agency (CSA) to the DC3 Security Manager identified in Block 16 within one (1) business day of submitting the report to the DOD CAF and to the CSA.

VISITOR GROUP SECURITY AGREEMENT

This agreement, entered into by DC3, and the prime contractor and their subcontractors, hereafter referred to as “visitor groups”. It prescribes the specific actions to be taken by the visitor group employees to properly protect classified information at the on-site contract performance location. Responsibilities are delineated as follows:

1. Under the terms of this agreement, the visitor group will operate under the guidance and requirements of the DC3 Security program, and all applicable Director of Central Intelligence Agency directives (DCID), Department of the Defense (DoD) and Air Force regulations and directives. The servicing security activity, HQ AFOSI/IPO SSO is responsible for providing security program oversight and guidance.

2. The contractor’s security manager will be identified in writing to DC3 security manager.

3. All access to, or possession of, classified information by contractor personnel at DC3 will be under the supervision and control of DC3.

4. All government automated information systems used by the visitor group are subject to monitoring, search and seizure. All government regulations on use apply. The visitor group will not install any software without approval of DC3.

5. The contractors will establish an information management system and control classified material in accordance with DoD 5220.22-M (NISPOM), HQ AFOSI Directives, and DC3 standard operating procedures.

6. The visitor group will ensure that end of day security checks are accomplished in areas assigned to them.

7. Contractors discovering unattended classified material in an insecure/unattended location will immediately notify the DC3 security manager at 410-981-1144 during normal duty hours. After duty hours, contact the DC3 Security Manager at 410-925-7563 (iPhone) or if unable to reach the security manager, call DC3 Security Staff 410-981-0143/6615, or 443-517-3614 (iPhone).

8. The visitor group is not authorized to store classified material independent of DC3. Storage containers made available to the visitor group will remain under the control of DC3.

a. The responsibility of setting storage container combination rests with DC3.

b. The visitor group will not use private locksmiths to set or repair the combination.

9. The visitor group will record each opening and closing of the storage container on SF 702, Security Container Check Sheet.

10. The visitor group will use SF 700, Security Container Information to record individuals having knowledge of the combination. This form will be attached to the inside of the locking drawer of each security container or door.

11. The visitor group will make every effort to ensure classified information is secure in an approved GSA storage container during an emergency. Visitor group personnel will maintain constant surveillance of classified information that cannot be properly stored. After the emergency, the visitor group will conduct an immediate check of all classified containers to ensure there has been not compromise or loss. If any discrepancy is found, the visitor group will immediately contact DC3 security manager at 410-981-1144 during normal duty hours and 410-925-7563 after duty hours.

12. The visitor group is not authorized to direct receipt or dispatch classified material. Classified information will be transmitted to and through AF classified information control systems.

13. The visitor group may hand carry classified information off site provided the employee has been designated to do so by an authorized DC3 government official, provided with a signed courier card or letter, upon receiving a courier briefing regarding their responsibilities by the DC3 Security Staff.

14. The visitor group will accomplish annual security awareness training as designated by DC3.

15. All SF 312, Nondisclosure Agreements will be initiated and maintained by the contract servicing security manager and the DC3 Security Manager.

16. HQ AFOSI/IPO-SSO will conduct security inspections of contractor areas in DC3.

17. The contract servicing security manager will submit a Visit Authorization Letter via DISS when there is a change in personnel or contract modification or at least annually.

18. The contract security manager or visitor group will immediately notify DC3 Security Staff of any changes in operating location or any foreign involvement or interest regardless of the sensitivity (classified or unclassified) of the information disclosed or requested.

19. In order for individual contractors to have unescorted access to DC3, the following must be on file with the DC3 security manager:

DD 254, DOD Contract Security Classification Specifications; Receive a Security Briefing regarding Visitor Group Security Procedures in this document; Visit Authorization Letters.

20. Contractor badges will be issued for the length of the contract, or as required by DC3.

21. Badges allowing unescorted access are the property of the DC3 and may be terminated or confiscated.

22. The visitor group will comply with physical security directives of the DoD and the Air Force.

23. Nothing in this agreement shall be construed to impose any liability on the part of the U.S. government for injury to the agents, employees, its subcontractors, assignees, or other individuals acting on behalf of the contractor, to the property of the same, nor shall anything in this agreement be construed to modify the provisions of existing contracts.

RELEASE OF SCI INFORMATION TO DOD CONTRACTORS

1. Requirements for access to SCI (SI/TK/G/H) material:

a. All SCI material will be handled in accordance with DoD 5200.1, DoD Information Security Program and AFI 31-401, Air Force Information Security Program, which will be furnished by the DC3 security manager upon request.

b. SCI material will not be released to contractor employees without specific release approval of the originator of the material as outlined in governing directives; based on prior approval, appropriate clearance held, and certification of “need-to-know” by the DC3 security manager.

c. Names of contractor personnel requiring access to SCI will be submitted to the DC3 security manager for approval. Upon receipt of written approval from the DC3 security manager, the contractor servicing security office will submit a Visit Authorization Request(s) for the appropriate level of security clearance needed, in accordance with the NISPOM to DC3.

d. Inquiries pertaining to classification guidance for the program material will be directed to the use of the Security Classification Guides that are provided by DC3 partners to DC3 and would be available within the Directorate.

e. SCI material furnished in support of this contract remains the property of the DoD, agency or command originator.

f. SCI material will be stored and maintained in approved storage containers only in government facilities only.

g. All SCI material released to the contractor remains the property of the U.S. Government and may be withdrawn at any time. Contractors must maintain accountability for all SCI material released into their custody.

h. The contractor must not reproduce SCI material without the written permission of the originating agency through the DC3 Security Manager. If permission is granted, each copy shall be controlled in the same manner as the original.

i. The contractor must not destroy any SCI material without advance approval or as specified by DC3. (EXCEPTION: SCI waste shall be destroyed as soon as practicable in accordance with the provisions of the Industrial Security Program).

j. The contractor must restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract with a valid need to know. Further dissemination to other contractors, subcontractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the originating agency through the DC3 Security Manager.

k. The contractor must ensure each employee having access to SCI material is fully aware of the special security requirements for this material and shall maintain records in a manner that will permit the contractor to furnish, on demand, the names of individuals who have had access to this material in their custody.

l. SCI material must not be released to foreign nationals or immigrant aliens whether they are consultants, U.S. contractors or employees of the contractor and regardless of the level of their security clearance, except with advance written permission from the originator. Requests for release to foreign nationals shall be initially forwarded to the program manager and shall include:

(1) A copy of the proposed disclosure

(2) Full justification reflecting the benefits to U.S. interests.

(3) Name, nationality, particulars of clearance, and current access authorization of each proposed foreign national recipient.

m. Upon completion or termination of the SCI contract, or sooner when the purpose of the release has been served, the contractor will return all SCI material (furnished or generated) to the source from which received unless retention or other disposition instructions are authorized in writing by DC3 Security Manager.

n. The contractor must designate an individual who is working on the contract as custodian. The designated custodian shall be responsible for receipting and accounting for all SCI material received under this contract. This does not mean that the custodian must personally sign for all SCI material.

o. The inner wrapper of all SCI material dispatched should be marked for the attention of a designated custodian and must not be opened by anyone not working directly on the contract.

p. Classification regarding, or declassification markings of documentation produced by the contractor shall be consistent with that applied to the information or documentation from which the new document was prepared. If a compilation of information or a complete analysis of a subject appears to require a security classification other than that of the source documentation, the contractor shall assign the tentative security classification and request instructions from the program manager. Pending final determination, the material shall be safeguarded as required for its assigned or proposed classification, whichever is higher, until the classification is changed or otherwise verified.

2. The program manager (PM) will:

a. Review the product for contract applicability and determine the product (s) required by the contractor to complete contractual obligations. After the PM has reviewed the product(s) for contract applicability and determined that the product is required by the contractor to complete obligations, the PM must request release from the originator through the Intelligence Division. Originator release authority is required on all SCI products listed below.

(1) Documents bearing the control markings of ORCON, PROPIN

(2) GAMMA controlled documents

(3) Any NSA/SPECIAL marked products

(4) All categories as listed in USAF Intel 201-1

b. Review contractor access requests to ensure satisfactory justification (need-to-know), security clearance level and completeness of required information.

c. Coordinate visits by contractor employees when visits are conducted as part of the contract effort.

d. Maintain records of all SCI material provided to the contractor in support of the contract effort. By 15 January (annually) provide the contractor with a complete list of all documents transferred by contract number, organizational control number, copy number and document title, for inventory purposes.

e. Determine dissemination of SCI studies or material originated or developed by the contractor.

f. Within 30 days of completion of the contract, provide written disposition instructions for all SCI material furnished to, or generated by, the contractor with an information copy to the supporting security office.

g. Review and forward all contractor requests to process SCI electronically to the accrediting security manager for coordination through appropriate channels.

h. Request for release of intelligence material to a contractor must be prepared by the PM and submitted to the DC3 security manager. This should be accomplished as soon as possible after the contract has been awarded. The request will be prepared and accompanied with a letter explaining the requirement and copies of the DD Form 254 and Performance Work Statement

3. The following procedures govern the use of control markings.

a. Any recipient desiring to use intelligence in a manner contrary to restrictions established by the control marking set forth above shall obtain the advance permission of the originating agency through DC3 security manager. Such permission applies only to the specific purposes agreed to by the originator and does not automatically apply to all recipients. Originators shall ensure that prompt consideration is given to recipients’ requests in these regards, with particular attention to reviewing and editing, if necessary, sanitized or paraphrased versions to derive a text suitable for release subject to lesser or no control markings.

b. The control marking authorized above shall be shown on the title page, front cover, and other applicable pages of documents, incorporated in the text of electrical communications, shown on graphics, and associated (in full or abbreviated form) with data stored or processed in automatic data processing systems. The control marking also shall be indicated by parenthetical use of the marking abbreviations at the beginning or end of the appropriate portions. If the control marking applies to several or all portions, the document must be marked with a statement to this effect rather than marking each portion individually.

c. The control markings shall be individually assigned at the time of preparation of SCI products and used in conjunction with security classifications and other marking specified by E.O. 12958 and its implementing security directives. The marking shall be carried forward to any new format in which the same information is incorporated including oral and visual presentations.

4. Request for release of SCI material to a contractor must be prepared by the PM and submitted through the DC3 security manager to AFOSI/XOQ. This should be accomplished as soon as possible after the contract has been awarded. The request will be prepared and accompanied with a letter explaining the requirements and copies of the DD Form 254 and Performance Work Statement.

RELEASE OF NON-SCI INFORMATION TO DOD CONTRACTORS

1. Requirements for access to non-SCI:

a. All intelligence material released to the contractor remains the property of the U.S. Government and may be withdrawn at any time. Contractors must maintain accountability for all classified intelligence released into their custody.

b. The contractor must not reproduce intelligence material without the written permission of the originating agency through the Intelligence Support Office. If permission is granted, each copy shall be controlled in the same manner as the original.

c. The contractor must not destroy any intelligence material without advance approval or as specified by DCCI/DCFL. EXCEPTION: Classified waste shall be destroyed as soon as practicable in accordance with the provisions of the Industrial Security Program.

d. The contractor must restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract with a valid need-to-know. Dissemination to other contractors, subcontractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the originating agency through the DC3 security manager.

e. The contractor must ensure each employee having access to intelligence material is fully aware of the special security requirements for this material and shall maintain records in a manner that will permit the contractor to furnish, on demand, the names of individuals who have had access to this material in their custody.

f. Intelligence material must not be released to foreign nationals or immigrant aliens whether they are consultants, U.S. contractors, or employees of the contractor and regardless of the level of their security clearance, except with advance written permission from the originator. Requests for release to foreign nationals shall be forwarded to the DC3 security manager and shall include:

(1) A copy of the proposed disclosure

(2) Full justification reflecting the benefits to U.S. interests.

(3) Name, nationality, particulars of clearance, and current access authorization of each proposed foreign national recipient.

g. Upon completion or termination of the classified contract, or sooner when the purpose of the release has been served, the contractor will return all classified intelligence (furnished or generated) to the source from which received unless the DC3 security manager authorizes retention or other disposition instructions in writing (AFMAN 37-139).

h. The contractor must designate an individual who is working on the contract as custodian. The designated custodian shall be responsible for receipting and accounting for all classified intelligence material received under this contract. This does not mean that the custodian must personally sign for all classified material. The inner wrapper of all classified material dispatched should be marked for the attention of a designated custodian and must not be opened by anyone not working directly on the contract.

i. Within 30 days after the final product is received and accepted by the procuring agency, classified intelligence materials released to or generated by the contractor, must be retuned to the originating agency through the contract monitor unless written instructions authorizing destruction or retention are issued. Requests to retain material shall be directed to DC3 security manager for this contract in writing and must clearly indicate the justification for retention and identity of the specific document to be retained.

j. Classification, regarding, or declassification markings of documentation produced by the contractor shall be consistent with that applied to the information or documentation from which the new document was prepared. If a compilation of information or a complete analysis of a subject appears to require a security classification other than that of the source documentation, the contractor shall assign the tentative security classification and request instructions from the contract monitor. Pending final determination, the material shall be safeguarded as required for its assigned or proposed classification, whichever is higher, until the classification is changed or otherwise verified.

2. Intelligence material carries special markings. The following is a list of the authorized control markings of intelligence material:

a. “Dissemination and Extraction of Information Controlled by Originator (ORCON).” This marking is used with a security classification to enable a continuing knowledge and supervision by the originator of the information involved. This marking may be used on intelligence which clearly identifies or would reasonably permit ready identification of an intelligence source or method which is particularly susceptible to countermeasures that would nullify or measurable reduce its effectiveness. This marking may not be used when an item or information will reasonable be protected by use of other markings specified herein, or by the application of the need-to-know principle and the safeguarding procedures of the security classification system.

b. “Authorized for Release to (Name of Country(ies)/International Organization.” The above is abbreviated “REL.” This marking must be used when it is necessary to identify classified intelligence material the U.S. Government originator has predetermined to be releasable or has been released through established foreign disclosure channels to the indicated country(ies) or organization.

3. The following procedures govern the use of control markings.

a. Any recipient desiring to use intelligence in a manner contrary to restrictions established by the control marking set forth above shall obtain the advance permission of the originating agency through DC3 security manager. Such permission applies only to the specific purposes agreed to by the originator and does not automatically apply to all recipients. Originators shall ensure that prompt consideration is given to recipients’ requests in these regards, with particular attention to reviewing and editing, if necessary, sanitized or paraphrased versions to derive a text suitable for release subject to lesser or no control markings.

b. The control marking authorized above shall be shown on the title page, front cover, and other applicable pages of documents, incorporated in the text of electrical communications, shown on graphics, and associated (in full or abbreviated form) with data stored or processed in automatic data processing systems. The control marking also shall be indicated by parenthetical use of the marking abbreviations at the beginning or end of the appropriate portions. If the control marking applies to several or all portions, the document must be marked with a statement to this effect rather than marking each portion individually.

c. The control markings shall be individually assigned at the time of preparation of classified products and used in conjunction with security classifications and other marking specified by E.O. 12958 and its implementing security directives. The marking shall be carried forward to any new format in which the same information is incorporated including oral and visual presentations.

4. Request for release of classified material to a contractor must be prepared by the DCITP and submitted through the DC3 security manager to AFOSI/XOQ. This should be accomplished as soon as possible after the contract has been awarded. The request will be prepared and accompanied with a letter explaining the requirements and copies of the DD Form 254 and Performance Work Statement.

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

The following procedures will be used to protect Controlled Unclassified Information materials and products.

1. HANDLING: Access to CUI material shall be limited to those employees needing the material to do their jobs. The CUI marking is assigned to material created by a DoD user agency. CUI is not a classification, but rather requires extra precaution to ensure it is not released to the public.

2. MARKING: Mark unclassified documents containing CUI “Controlled Unclassified Information” at the bottom of each page and back (if any). In a classified document, mark:

a. An individual paragraph that contains CUI, but not classified material by placing “CUI” at the beginning of the paragraph.

b. The top and bottom of each page that has both CUI and classified material by placing the highest security classification of the material on that page.

c. “CUI” at the bottom of each page that has CUI but no classified material.

d. If a classified document also contains CUI material or if the classified material becomes CUI when declassified, place the following statement on the bottom of the cover or the first page under the classification marking: NOTE: If declassified, review the document to make sure material is not CUI and not exempt under AFI 37-131 before public release.

e. Mark other records such as computer print outs, photographs, films, tapes or slides: “Controlled Unclassified Information” so the receiver or viewer knows the record contains CUI material.

f. Mark each part of a message that contains CUI material. Unclassified messages containing CUI material must show the abbreviation “CUI” before the text begins.

g. Ensure documents that transmit CUI material call attention to any CUI attachments.

h. CUI material released to a contractor by a DoD user agency must have the following statements on the front page or cover: “THIS DOCUMENT CONTAINS MATERIAL EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FREEDOM OF INFORMATION ACT. EXEMPTION (S) APPLY.”

3. STORAGE: During normal duty hours, place CUI material in an out of sight location, if your work area is accessible to persons who do not have a valid need for the material. After normal duty hours, store CUI material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided. When internal security does not exist, locked buildings, or rooms usually provide adequate after-hours protection. For additional protection, store CUI material in locked containers such as file cabinets, desks, or bookcases. Expenditure of funds for security containers or close areas solely for the protection of CUI material is prohibited.

4. TRANSMISSION: CUI material shall be transmitted by the same methods as other unclassified material. Discussion of CUI material on the telephone is authorized if necessary for the performance of the contract. CUI material may be transmitted over telephone lines in digital form, by telephone, by telecopies, or by other Teletype lines without encryption.

5. RELEASE: CUI material shall not be released outside the contractor’s facility except to representatives of the DoD.

6. DESTRUCTION: When no longer needed, CUI material shall be disposed of by a method that precludes its disclosure to unauthorized individuals.

Law Enforcement Sensitive (LES)

The following procedures will be used to protect Law Enforcement Sensitive (LES) materials and products.

1. HANDLING: Access to LES material shall be limited to those employees needing the material to do their jobs. The LES marking is assigned to material created by a DoD user agency. LES is not a classification, but rather requires extra protection to ensure it is not released to the public.

2. MARKING: Mark unclassified documents containing LES “Law Enforcement Sensitive” at the bottom of each page and back (if any). In a classified document, mark:

a. An individual paragraph that contains LES, but not classified material by placing “LES” at the beginning of the paragraph.

b. The top and bottom of each page that has both LES and classified material by placing the highest security classification of the material on that page.

c. “LES” at the bottom of each page that has LES but no classified material.

d. If a classified document also contains LES material or if the classified material becomes LES when declassified, place the following statement on the bottom of the cover or the first page under the classification marking: NOTE: If declassified, review the document to make sure material is not LES and not exempt under AFI 37-131 before public release.

e. Mark other records such as computer print outs, photographs, films, tapes or slides: “Controlled Unclassified Information” so the receiver or viewer knows the record contains LES material.

f. Mark each part of a message that contains LES material. Unclassified messages containing LES material must show the abbreviation “LES” before the text begins.

g. Ensure documents that transmit LES material call attention to any LES attachments.

h. LES material released to a contractor by a DoD user agency must have the following statements on the front page or cover: “THIS DOCUMENT CONTAINS MATERIAL EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FREEDOM OF INFORMATION ACT. EXEMPTION(S) APPLY.”

3. STORAGE: During normal duty hours, place LES material in an out of sight location, if your work area is accessible to persons who do not have a valid need for the material. After normal duty hours, store LES material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided. When internal security does not exist, locked buildings, or rooms usually provide adequate after-hours protection. For additional protection, store LES material in locked containers such as file cabinets, desks, or bookcases. Expenditure of funds for security containers or close areas solely for the protection of LES material is prohibited.

4. TRANSMISSION: LES material shall be transmitted by the same methods as other unclassified material. Discussion of LES material on the telephone is authorized if necessary for the performance of the contract. LES material may be transmitted over telephone lines in digital form, by telephone, by telecopies, or by other Teletype lines without encryption.

5. RELEASE: LES material shall not be released outside the contractor’s facility except to representatives of the DoD.

6. DESTRUCTION: When no longer needed, LES material shall be disposed of by a method that precludes its disclosure to unauthorized individuals.

DC3 Security Manager

Protection. Within the Department of Defense, CUI-LES information shall be safeguarded and destroyed as required for CUI information.

Contractor will comply with DC3 entry control procedures. Contractor will comply with the Air Force Special Access Programs (SAP) and Single Integrated Operations Program (SIOP).

Linthicum, MD 21090