Attachment 3 - DD Form 254 - NetApp System Health Check PRJ 11080.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, "DoD Contract Security Classification Specification" Show Attachment Bar

Address

156 Marauder St, Goodfellow AFB, TX 76908

170 Griffith St Goodfellow AFB, TX 76908

Carlos Guzman - carlos.guzman.1@us.af.mil

Review, Office of the Assistant Secretary of Defense (Public Affair Enter public release authority.: Public release of Sensitive Compartmented Information (SCI) is

NOT AUTHORIZED FOR RELEASE AT ANY TIME

Ref 10e (1): SENSITIVE COMPARTMENTED INFORMATION (SCI): All contractor SCI work and access will be at a designated Government SCIF. The contractor must have SCI indoctrinated personnel available to work the contract. All contract personnel requiring access to SCI material must be U.S. citizens and have been granted a final SCI- ICD 704 security eligibility by the U.S. Government. Immigrant aliens, personnel cleared on an interim basis are not eligible for access to intelligence information released or generated under this contract. Classified material released or generated under this contract is not releasable to foreign nationals.

Ref Block 10e(2): General Intelligence Material/Foreign Disclosure applies. Prior approval of the contracting activity is required for subcontracting. Access to Intelligence information requires special briefings and a final U.S. Government clearance at the appropriate non-SCI level (Secret or Top Secret). See attachment 1, 2, and 3.

Contract system administrators and installation technicians must have access to classified to perform duties.

Part 177-National Industrial Security Program Operating Manual (NISPOM), August 2021 and appropriate supplements apply to all classified contract performance.

Ref 10e (1): SENSITIVE COMPARTMENTED INFORMATION (SCI): All contractor SCI work and access will be at a designated Government SCIF. The contractor must have SCI indoctrinated personnel available to work the contract. All contract personnel requiring access to SCI material must be U.S. citizens and have been granted a final SCI- ICD 704 security eligibility by the U.S. Government. Immigrant aliens, personnel cleared on an interim basis are not eligible for access to intelligence information released or generated under this contract. Classified material released or generated under this contract is not releasable to foreign nationals.

Ref Block 10e(2): General Intelligence Material/Foreign Disclosure applies. Prior approval of the contracting activity is required for subcontracting. Access to Intelligence information requires special briefings and a final U.S. Government clearance at the appropriate non-SCI level (Secret or Top Secret). See attachment 1, 2, and 3.

Ref Block 10g: All contractors that have access to JWICS and SIPRnet will be briefed with the AF NATO Security Awareness Acknowledgment. The COR has determined that the contractor will have access to NATO classified and restricted information in order to accomplish daily duties. Prior approval of the contracting activity is required for subcontracting. Access to classified NATO information requires a final U.S. government clearance at the appropriate level.

Ref Block 10j and ll1: FOUO applies. See attachment 4. CUI applies. See attachment 6

Ref Block 11j: OPSEC applies. See attachment 5

Ref Block 11a: Releasing contractor or government activity will furnish complete classification guidance for the service to be performed.

Ref Block 11e: Actual knowledge of generation, or production of classified information is NOT REQUIRED. This document serves as written notice of the letting of a classified service contract.

Ref Block 12: Contractor is to submit requests through the contracting officer for OPSEC program manager review and public release authorization. The contracting officer will provide contractor with written approval/disapproval. Information requiring AF or DoD-level review will be reviewed by the unit’s OPSEC program manager or coordinator who will in-turn forward to the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690.” MAJCOM/DRUs will send information requiring AF or DoD-level review directly to SAF/PAX. (T-1)

ATTACHMENT 1

INTELLIGENCE INFORMATION:

SENSITIVE COMPARTMENTED INFORMATION (SCI) ADDENDUM

SSO Goodfellow SCI ADDENDUM TO DD FORM 254

(1) This contract requires access to Sensitive Compartmented Information (SCI). SSO Goodfellow acting on behalf of the 17 TRG SIO, is the Cognizant Security Office (CSO), has exclusive security responsibility for all SCI contracts issued by contracting organizations and SCI information released to the contractor or developed under the in support of the Goodfellow mission. SSO Goodfellow is also responsible for supervision and oversight of collateral classified information maintained in SCI storage areas. The manuals, regulations and directives checked below provide the necessary guidance for physical, personnel, and information security for safeguarding SCI, and are part of the security classification specification for this contract:

a. DoDM 5105.21-V1 – V3, SCI Security Manual, Administrative Security

b. AFM 14-403 Sensitive Compartmented Information Security and Intelligence, Surveillance, and Reconnaissance Systems Cyber-security and Governance.

c. GAFBI 14-301, Personnel and Facility Sensitive Compartmented Information.

d. SEAD 4, Personnel Security Adjudicative Guidelines for Determining Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information

e. ICD 503 – Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation

(2) The name, telephone number and address of the Contract Monitor (CM/COR/COTR) for the SCI portion of this contract is: Carlos Guzman, 325-315-6858, 170 Griffin St, Bldg 448 Rm 56, Goodfellow AFB, TX 76908

(3) The name, telephone number, address and e-mail of the Contractor/Subcontractor FSO/CSSO for the SCI portion of this contract is: First Name Last Name, Phone Number, Email Address, Physical Address City, State ZIP Code.

(4) All DD Forms 254 prepared for subcontracts involving access to SCI under this contract should mirror the Prime and a copy forwarded to the SSO.

(5) Site lead will coordinate all contractor visits through the CM. The site lead will submit a written request to the CM for approval. The certified request must arrive at SSO Goodfellow at least 3 (three) working days prior to the visit.

(6) The contractor will not reproduce any SCI related material without prior written permission of the CM.

(7) Upon request, Security Classification Guides or extracts will be provided by the User Agency.

(8) Electronic processing of SCI requires accreditation of the equipment in accordance with Intelligence Community Directive 503, CNSSI 1253, and National Institute for Standards and Technology (NIST) standards.

(9) This contract requires contractors with (SI/TK/G/HCS-P) access.

(10) Contractor personnel requiring access to SCI will be submitted to SSO Goodfellow via DISS. Nominated employees must meet stated security clearance and access criteria.

(11) The contractor will establish and maintain an access list of those employees who possess the necessary security clearance, working on this contract at Goodfellow AFB, TX in DISS. The list will include the POP start and end date, contract number, access required, name of company and list of current employees.

(12) The contractor will immediately advise the SSO and CM upon reassignment of contract employees, ineligibility of contract employees for SCI access.

(13) The SSO can grant access to only those who possess the necessary security clearance and who are actually providing service under the contract. Further dissemination to other contractors, sub-contractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the releasing agency.

(14) SCI material furnished in support of this contract remains the property of the DoD department or command that released it. Upon completion or cancellation of the contract. All SCI materials furnished will be returned to the direct custody of the originator of the materials.

(15) The contractor will perform SCI work under this contract at Goodfellow AFB, TX.

(16) The contractor will provide the make, model and serial number of any Portable Electronic Device (PED) on a Facility Authorization Letter provided by the SSO.

(17) Facility Authorization Letter, signed by the SSO and/or Site ISSM, must be kept with the Contractor-supplied PED at all times, provided the PED serves a justified mission contract requirement. An AF DoD employee will monitor the Contractor-supplied PED movement and use at all times while in the designated facility. The Contractor-supplied PED will be inspected by SSO or designated representative upon entry and exit of the designated facility. Taking the Contractor-supplied PED in/out of the SCIF is not authorized – the device(s) must remain within the SCIF through the duration of the project, once admitted.

(18) To allow a PED in the SCIF, the contractor will submit a justified mission requirement on company letterhead to the SSO and PM at least 3 (three) business days prior to arrival. Once the justified mission requirement is met, the contractor will be notified of approval or denial via email.

ATTACHMENT 2

INTELLIGENCE INFORMATION:

NON-SENSITIVE COMPARTMENTED INFORMATION (NON-SCI) ADDENDUM

The DD Form 254, block 10e(2) is marked YES, Intelligence information, NON-SCI, therefore the contractor must comply with the following instructions.

1. Requirements for access to non-SCI:

a. All intelligence material released to the contractor remains the property of the U.S. Government and may be withdrawn at any time. Contractors must maintain accountability for all classified intelligence released into their custody.

b. The contractor must not reproduce intelligence material without the written permission of the originating agency through the Intelligence Support Office. If permission is granted, each copy shall be controlled in the same manner as the original.

c. The contractor must not destroy any intelligence material without advance approval or as specified by the Contract Monitor (CM). (EXCEPTION: Classified waste shall be destroyed as soon as practicable in accordance with the provisions of the Industrial Security Program).

d. The contractor must restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract with a valid need to know. Further dissemination to other contractors, subcontractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the originating agency through the CM.

e. The contractor must ensure each employee having access to intelligence material is fully aware of the special security requirements for this material and shall maintain records in a manner that will permit the contractor to furnish, on demand, the names of individuals who have had access to this material in their custody.

f. Intelligence material must not be released to foreign nationals or immigrant aliens whether they are consultants, US contractors, or employees of the contractor and regardless of the level of their security clearance, except with advance written permission from the originator. Request for release to foreign nationals shall be initially forwarded to the contract monitor and shall include:

(1) A copy of the proposed disclosure.

(2) Full justification reflecting the benefits to US interests.

(3) Name, nationality, particulars of clearance, and current access authorization of each proposed foreign national recipient.

g. Upon completion or termination of the classified contract, or sooner when the purpose of the release has been served, the contractor will return all classified intelligence (furnished or generated) to the source from which received unless retention or other disposition instructions are authorized in writing by the CM.

h. The contractor must designate an individual who is working on the contract as custodian. The designated custodian shall be responsible for receipting and accounting for all classified intelligence material received under this contract. This does not mean that the custodian must personally receipt for all classified material. The inner wrapper of all classified material dispatched should be marked for the attention of a designated custodian and must not be opened by anyone not working directly on the contract.

i. Within 30 days after the final product is received and accepted by the procuring agency, classified intelligence materials released to or generated by the contractor, must be returned to the originating agency through the contract monitor unless written instructions authorizing destruction or retention are issued. Requests to retain material shall be directed to the CM for this contract in writing and must clearly indicate the justification for retention and identity of the specific document to be retained.

j. Classification, regarding, or declassification markings of documentation produced by the contractor shall be consistent with that applied to the information or documentation from which the new document was prepared. If a compilation of information or a complete analysis of a subject appears to require a security classification other than that of the source documentation, the contractor shall assign the tentative security classification and request instructions from the contract monitor. Pending final determination, the material shall be safeguarded as required for its assigned proposed classification, whichever is higher, until the classification is changed or otherwise verified.

2. Intelligence material carries special markings. The following is a list of the authorized control markings of intelligence material:

a. “Dissemination and Extraction of Information Controlled by Originator (ORCON).” This marking is used, with security classification, to enable a continuing knowledge and supervision by the; originator of the use made of the information involved. This marking may be used on intelligence, which clearly identifies, or would reasonably permit ready identification of an intelligence source or method, which is particularly susceptible to countermeasures that would nullify or measurably reduce its effectiveness. This marking may not be used when an item or information will reasonably be protected by use of other markings specified herein, or by the application of the "need-to-know" principle and the safeguarding procedures of the security classification system.

b. "Authorized for Release to (name of country/ International Organization)." The above is abbreviated REL. This marking must be used when it is necessary to identify classified intelligence material the US government originator has predetermined to be releasable or has been released through established foreign disclosure channels to the indicated country(ies) or organization.

3. The following procedures govern the use of control markings.

a. Any recipient desiring to use intelligence in a manner contrary to restrictions established by the control marking set forth above shall obtain the advance permission of the originating agency through the CM. Such permission applies only to the specific purposes agreed to by the originator and does not automatically apply to all recipients. Originators shall ensure that prompt consideration is given to recipients' requests in these regards, with particular attention to reviewing and editing, if necessary, sanitized or paraphrased versions to derive a text suitable for release subject to lesser or no control markings.

b. The control marking authorized above shall be shown on the title page, front cover, and other applicable pages of documents, incorporated in the text of electrical communications, shown on graphics, and associated (in full or abbreviated form) with data stored or processed in automatic data processing systems. The control marking also shall be indicated by parenthetical use of the marking abbreviations at the beginning or end of the appropriate portions. If the control marking applies to several or all portions, the document must be marked with a statement to this effect rather than marking each portion individually.

c. The control markings shall be individually assigned at the time of preparation of intelligence products and used in conjunction with security classifications and other marking specified by E.O. 12958 and its implementing security directives. The marking shall be carried forward to any new format in which the same information is incorporated including oral and visual presentations.

4. Request for release of intelligence material to a contractor must be prepared by the Contract Monitor (CM) and submitted to the Intelligence Support Office. This should be accomplished as soon as possible after the contract has been awarded. The request will be prepared and accompanied with a letter explaining the requirements and copies of the DD Form 254 and Statement of Work.

ATTACHMENT 3

RELEASE OF INTELLIGENCE INFORMATION ADDENDUM

The DD Form 254, block 10e is marked YES, Intelligence Information, therefore the contractor must comply with the following instructions.

1. Authorized Control Markings of Intelligence Information

a. "Dissemination and Extraction of Information Controlled by Originator (ORCON).” This marking is used only on classified intelligence that clearly identifies or would reasonably permit ready identification of intelligence sources or methods that are particularly susceptible to countermeasures that would nullify or measurably reduce their effectiveness. It is used to enable the originator to maintain continuing knowledge and supervision of the further use of intelligence beyond the original dissemination. This control marking may not be used when an item of information will reasonably be protected by use of any other markings specified herein, or by the application of the "need-to-know" principle and safeguarding procedures of the security classification system.

b. "Not Releasable to Foreign Nationals (NOFORN).” This control marking is used to identify classified intelligence material that may not be released in any form to foreign governments, foreign nationals, or non-US citizens without permission of the US Government originator, and then only when released in compliance with the National Disclosure Policy.

c. "Authorized for Release to (Name of country(s)/international organization.” This marking is used to identify classified intelligence material that the US Government Originator has predetermined to be releasable or has been released through established foreign disclosure channels to the indicated country(s) or organization.

2. Procedures Governing Use of Control Markings

a. Any recipient desiring to use intelligence in a manner contrary to the restrictions established by the control markings set forth above, shall obtain the advanced permission of the originating agency. Such permission applies only to the specific purposes agreed to by the originator and does not automatically apply to all recipients. Originator will ensure that prompt consideration is given to recipients' requests, with particular attention to reviewing and editing if necessary, sanitized or paraphrased versions to derive a text suitable for release subject to lesser or no control markings.

b. The control markings authorized above shall be shown on the title page, front cover, and other applicable pages of documents, incorporated in the text of electrical communications, shown on graphics, and associated (in full or abbreviated form) with data stored or processed in automatic data processing systems. The control markings also shall be indicated by parenthetical use of the markings abbreviations at the beginning or end of the appropriate portions. If the control markings apply to several or all portions, the document may be marked with a statement to this effect rather than marking each portion individually.

c. The control markings in paragraph one (1) shall be individually assigned at the time of preparation of intelligence products and used in conjunction with security classifications and other markings specified by EO 12958 and its implementing ISOO Directive. The markings shall be carried forward to any new format in which the same information is incorporated, including oral and visual presentations.

ATTACHMENT 4

FOR OFFICIAL USE ONLY (FOUO) ADDENDUM

The DD Form 254, block 10J is marked YES, For Official Use Only Information (FOUO), therefore, the contractor must comply with the following FOUO handling instructions.

1. GENERAL: As of 1 December 2022, no new documents will be marked FOUO. The following FOUO instructions are only for those documents currently marked FOUO. The instructions comply with guidance provided in NSTISSI 4002; and the Privacy Act; the Freedom of Information Act (FOIA); and the Information Security Program.

a. The FOUO marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act.

b. Use of the FOUO marking does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

2. IDENTIFICATION MARKINGS:

a. An unclassified document containing FOUO information will be marked “For Official Use Only” at the bottom of the front cover (if any), on the first page, on each page containing FOUO information, on the back page, and on the outside of the back cover (if any). No portion markings will be shown.

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked, “FOUO.”

c. Any “For Official Use Only” information released to a contractor by a DOD User Agency is required to be marked with the following statement prior to transfer:

This document contains information EXEMPT FROM MANDATORY DISCLOSURE under the FOIA. Exemptions _______ apply.

d. Removal of the FOUO marking can only be accomplished by the originator or other competent authority. When the FOUO status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: Contractors may disseminate “For Official Use Only” information to their employees and subcontractors who have a need for the information in connection with a classified contract.

4. STORAGE: During working hours, “For Official Use Only” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desk is adequate when internal building security is provided during non-working hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: “For Official Use Only” information may be sent via first –class mail or parcel post. Bulky shipments may be sent by fourth-class mail. Electronic transmission of FOUO information, e.g., voice, data or facsimile, e-mail, shall be by approved secure communications systems or systems utilizing access controls such as Public Key Infrastructure (PKI), whenever practical. When sending FOUO records over facsimile equipment, use cover sheets and consider the location of the sending and receiving machines to ensure authorized personnel are available to receive FOUO information. Exercise caution before transmitting personal information over e-mail to ensure it is adequately safeguarded. Some information may be so sensitive and personal that e-mail may not be the proper way to transmit it. When sending personal information over e-mail within DoD, ensure: (1) there is an official need; (2) all addressee(s) (including “cc” addressees) are authorized to receive it under the Privacy Act; and (3) it is protected from unauthorized disclosure, loss, or alteration. Protection methods may include encryption or password protecting the information in a separate Word document. When transmitting personal information over e-mail, add “FOUO” to the beginning of the subject line, followed by the subject, and apply the following statement at the beginning of the e-mail:

“This e-mail contains FOR OFFICIAL USE ONLY (FOUO) information which must be protected under the Privacy Act and AFI 33-332.”

Do not indiscriminately apply this statement to e-mails. Use it only in situations when you are actually transmitting personal information. DoD Regulation 5400.7/AF Supp, Chapter 4, provides additional guidance regarding FOUO information.

6. DISPOSITION: When no longer needed, FOUO information may be disposed of by any means approved for the destruction of classified information, or by tearing each copy into pieces to preclude reconstructing, and placing it in a regular trash container, or as directed by the User Agency.

7. UNAUTHORIZED DISCLOSURE: The unauthorized disclosure of “For Official Use Only” information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions.

ATTACHMENT 5

OPSEC REQUIREMENTS ADDENDUM

The DD Form 254, block 11j is marked YES, HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS; therefore, the contractor must comply with the following OPSEC instructions.

11j: HAVE OPERATION SECURITY (OPSEC) REQUIREMENTS: OPSEC is a structured process that identifies critical information, analyzes friendly actions, integrates threat analysis and risk assessments, then helps personnel apply protective measures to mitigate unacceptable risk. Organizations and personnel supporting 17TH Training Group (AETC) may have OPSEC requirements associated with their activities and support. The contractor will comply 17TH Training Group (AETC) OPSEC Program. The basis for the on-site contractor OPSEC program is AFI 10-701. OPSEC requirements apply. The contractor must comply with special OPSEC requirements contained in the contract or addendum thereto. The following standard expectations are included in all work:

a. The contractor supporting specific event-oriented activities will develop OPSEC Plans/Annexes when directed by the supported program, or comply with the program's OPSEC Plan/Annex.

b. Personnel assigned will receive OPSEC Awareness Education and Duty-Related Training as deemed necessary by the Government or program supported.

c. OPSEC Awareness Education and Training will be provided or coordinated through government channels.

d. The contractor is required to protect controlled unclassified information and/or indicators that may reveal classified information, sensitive or critical information or information that can be collected in aggregate to identify vulnerabilities.

e. Specifically, the contractor is prohibited from disclosing, without express permission from the United States Air Force, any structured process that identifies critical information, analyzes friendly actions, integrates threat analysis and risk assessments that helps personnel apply protective measures to mitigate unacceptable risk.

HSPD-12: The contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directives-12 (HSPD-12), Office of Management and Budget (OMB) Guidance M-05-24, Federal Information Processing Standards Publication (FIPS PUB) number 201) and GSA HSPD-12, Standard Operating Procedure (SOP), Personnel Security Process, dated November 18, 2005.

NOTE: The contractor shall insert the following clause in all subcontracts whom the subcontractor is required to have physical access to a federal controlled facility or access to a Federal information system.

Position Sensitivity: In accordance with DOD 5200.2-R, the DoD Personnel Security Program, this contract requires personnel performing work on a sensitive AIS to be: 1) a US Citizen, and 2) assigned to positions which are designated at one of 3 sensitivity levels (IT –I, IT – II, or IT – III). These designations equate to Critical Sensitive and Non-Critical Sensitive positions. The Contractor will ensure individuals assigned to these sensitive positions have completed the appropriate access requests forms.

• IT – Level I – Individuals assigned to positions where damage to DoD networks and development systems can be accomplished and no checks are in place to determine potential destruction of sensitive information. The investigation requirement for these positions is completion of Special Security Background investigation (SSBI) with favorable results.

• IT Level – II and III – Individuals assigned to positions where daily unsupervised access to DoD networks and information systems containing Sensitive but Unclassified or Sensitive Classified up to and including Collateral Secret information is part of their duties. The Investigation requirement for these positions is completion of a Defense National Agency Check with Written Inquires (DNQACI) with favorable results.

• These positions require that investigations be completed prior to assigning individuals to a position of trust. A US Citizens that has a DNACI in process and a successful local records check, can be allowed assignment to the positions before the completion of the investigation, in the best interest of the DoD, at the discretion of the Contracting Officer.

• Foreign nationals may be appointed to Positions IT – II and III if they: 1) possess a unique or unusual skill or expertise that is urgently needed for a specific DoD requirements and for which a suitable US citizen is not available; and 2) approved in writing by HRC. Under no circumstances can these individuals be assigned before completion and favorable adjudication of the appropriate security investigation.

• The government retains the right to request removal of contract personnel, regardless of prior clearance or adjudication status, whose actions clearly conflict with the interest of the Government. The reason for removal will be fully documented in writing by the Contracting Officer. When and if such removal occurs, the Contractor will, within 30 working days, assign qualified personnel to any vacancies thus created.

• Where access to classified information is necessary in the performance of the duties called for under this contract, the guidance contained in the DoD 5200.2-R apply. A determination of eligibility for access to classified information or assignment to sensitive duties is a discretionary security decision based on judgments by appropriately trained adjudicative personnel.

ATTACHMENT 6

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

The DD Form 254, block 10J is marked YES, Controlled Unclassified Information (CUI), therefore, the contractor must comply with the following CUI handling instructions.

CUI is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. CUI is not classified under Executive Order 13526, Classified National Security Information, or 42 USC § 2011-2259, as amended. All CUI must be controlled until authorized for public release in accordance with DoDIs 5230.09, Clearance of DoD Information for Public Release, 5230.29, Security and Policy Review of DoD Information for Public Release, DoDM 5400.07, DoD Freedom of Information Act (FOIA) Program, and DoDM 5205.07-V1, DoD SAP Security Manual: General Procedures.

The authorities to waive wing/unit level requirements in this publication are identified with a Tier (“T-0, T-1, T-2, T-3”) number following the compliance statement.

The following procedures will be used to protect Controlled Unclassified Information (CUI) information.

1. MARKING:

This paragraph covers the essential marking requirements for initial phased implementation of the DoD CUI Program. Markings shall be immediately apparent, alert holders to the presence of CUI, identify the office of origin, identify the category(ies) of CUI in the document, and provide guidance on distribution/dissemination. (T-1).

a. At minimum, CUI markings for unclassified DoD documents will include the acronym “CUI” in the banner and footer of the document. In addition to banner markings, all DAF correspondence containing CUI will have the CUI designation indicator on the cover or first page of the document. (T-0).

b. If portion markings are selected, then all document subjects and titles, as well as individual sections, parts, paragraphs, or similar portions of a CUI document known to contain CUI, will be portion marked with “(CUI).” Use of the unclassified marking “(U)” as a portion marking for unclassified information within CUI documents or materials is required.

(1) There is no requirement to add the “U,” signifying unclassified, to the banner and footer as was required with the old FOUO marking (i.e., U//FOUO).

(2) Banners, footers, and portion marking will only be marked “Unclassified” or “(U)” for unclassified information in accordance with the June 4, 2019 ISOO letter. If the document also contains CUI, it will be marked in accordance with Paragraph 3.4.a. and additional forthcoming guidance.

(3) Do not use the CUI portion marking in subject lines of memorandums or emails unless the information in the subject line contains CUI. Likewise, do not label file names with the CUI portion marking for the same reasons.

(4) Do not use former agency dissemination controls such as Law Enforcement Sensitive (LES), DoD Unclassified Controlled Nuclear Information (DoD UCNI), Sensitive But Unclassified (SBU), and DEA Sensitive with CUI markings. These former markings should be represented accordingly as CUI categories in the CUI Designation Indicator block.

c. CUI markings in classified documents will appear in paragraphs or subparagraphs known to contain only CUI and must be portion marked with “(CUI).” CUI will not appear in the banner or footer.

(1) There will be an acknowledgment added to the warning box on the first page of multi-page documents to alert readers to the presence of CUI in a classified DoD document, as shown in Figure 1.

(2) Volume 2 of DoDM 5200.01 requires DoD intelligence producers to follow DNI formats for intelligence production under the authority of the DNI. When DoD CUI is incorporated into a Digital Access Policy under the authority of the DNI, the information and the document will follow the Digital Access Policy standards established by the DNI.

(3) Classified documents containing CUI will include both the classification authority block and CUI designation indicator. (T-0).

(4) If all the sub-paragraphs or sub-bullet points carry the same classification as the main paragraph or bullet point, portion marking is not required for the sub-paragraphs or sub-bullet points. However, if any of the sub-paragraphs or sub-bullet points carry different classifications from the main paragraph or bullet point, portion marking is required for the sub-paragraphs or sub-bullet points. (T-0).

d. The dissemination marking “not releasable to foreign nationals (NOFORN or NF)” is an intelligence control marking used to identify intelligence information an originator has determined meets the criteria of Intelligence Community Directive 710 and Intelligence Community Policy Guidance 403.1, which provides guidance for further dissemination control markings. It must be applied to controlled unclassified intelligence information that is properly characterized as CUI with appropriate CUI markings. CUI identified with this marking will not be provided, in any form, to foreign governments (including coalition partners), international organizations, foreign nationals, or other non-U.S. persons without the originator’s approval in accordance with E.O.s 13526 and 13556. If originator approval is required for further dissemination, the originator will mark the requirement on the information in accordance with Section 4.1(i)(1) of E.O. 13526.

(1) The application of the control marking “not releasable to foreign nationals” (NOFORN or NF) will only be applied, when warranted, to unclassified intelligence information properly categorized as CUI and reviewed by a Foreign Disclosure Officer to ensure there are no international agreements in place to prohibit its use and prohibiting sharing.

(a) If the use of NOFORN is authorized, the banner line will read “CUI//NOFORN.” The “(CUI/NF)” portion marking is applied preceding the applicable portion.

(2) The control marking NOFORN or NF will be applied to Naval Nuclear Propulsion Information (NNPI), Unclassified Controlled Nuclear Information (UCNI), National Disclosure Policy (NDP-1), and cover and cover support information. When warranted, it can be applied to unclassified information properly categorized as CUI having a licensing or export control requirement. Before marking a document or material as NOFORN or NF, it will be reviewed by the Foreign Disclosure Officer to ensure there are no agreements in place to prohibit its use and sharing.

(3) The application of “Releasable to” (“REL TO”) can only be applied, when warranted and consistent with relevant law, regulation, or government-wide policy or DoD policy, to information properly categorized as CUI with an export control or licensing requirement with a foreign disclosure agreement in place.

(a) Export-controlled CUI transfers to foreign persons must be in accordance with the Arms Export Control Act, International Traffic in Arms Regulations, Export Control Reform Act, Export Administration Regulations, and DoDI 2040.02. In accordance with DoDDs 5230.11 and 5230.20, a positive foreign disclosure decision must be made before CUI is released to a foreign entity.

(b) DoD operational CUI (not related to intelligence) may be marked as REL TO.

(3) For DAF information authorized for…