Attachment 3 - DD Form 254 STTS Instructor PJ_SR.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

LAST REVIEWED/UPDATED

June 2020

ADDENDUM TO DD FORM 254 (BLOCK 11j)

OPERATIONS SECURITY

1. This section outlines the requirements and procedures necessary for contractors to provide Operations Security (OPSEC) protection for AFSOC’s Critical Information (CI).

2. OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

• Identify those actions that can be observed by adversary intelligence systems.

• Determine which actions are indicators to hostile intelligence systems.

• Identify the information that adversaries can obtain and interpret or piece together to derive relevant critical information.

• Develop, select, and execute countermeasures that eliminate or reduce vulnerabilities to an acceptable level.

3. OPSEC principles are used to help assigned personnel:

• Maintain a continuing awareness of adversary interest in SOF actions and adversary intelligence collection capabilities.

• Understand the need to identify and protect unclassified indicators that reveal sensitive information.

• Evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

4. Our objectives are:

• Protect planned operational activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

• To preserve secrecy concerning specific scenario events and a USSOCOM or AFSOC response to these events.

• To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. AFSOC employed contractors will be briefed on unit Critical Information and Indicators and how to apply OPSEC principles by assigned unit OPSEC program manager/coordinator within 30 days of assignment. Individual training will be developed and applied as required by the level of contact with AFSOC critical information.

6. Unit OPSEC requirements, Critical Information and Indicators Lists (CIILs) and assistance can be found by contacting the unit-specific OPSEC coordinator.

7. OPSEC requirements and assistance can be found at the following:

• AFI 10-701, Operations Security (OPSEC)

• Email: 1sow.io@us.af.mil

• Contact: 1 SOW/IO at 884-4565

1 SOW IP Review 15 May 20

1st SPECIAL OPERATIONS WING

HURLBURT FIELD, FL 32544

LOCAL SECURITY REQUIREMENTS

FOR CONTRACTOR OPERATIONS

1. General. This document prescribes the specific actions to be taken by the visitor group's employees (con-tractors) and the Department of the Air Force (DAF), to properly protect classified information at the visitor group's work center(s) operating on Hurlburt Field, FL. Responsibilities are delineated as follows: (NOTE:

As used in this document, the terminology visitor group, contractor, company, and home office facility (HOF) are synonymous. Furthermore, the verbiage Air Force (AF) activity, unit, contracting officer, pro-gram/project manager, Servicing Security Activity (SSA), etc., refers to entities or representatives of the DAF in their respective capacity.) Any change(s) to this security specification must be approved by the SSA.

a. Visitor Group Security Supervision. The visitor group will operate per DoDM 5200.01, DoD infor-mation Security Program, Air Force Instruction (AFI) 16-1404, Air Force Information Security Program, Air Force Manual (AFMAN) 16-1406, Volume 2, National Industrial Security Program: Industrial Security Procedures For Government Activities and supplements thereto, the Air Force (AF) activity’s unit security program operating instructions (OI), plans and/or procedures and the special security provision addendums that pertain to block 10 and 11 on the DD Form 254, Department of Defense Contract Security Classification Specification. (Throughout this document, these source documents will be referred to as current directives.)

The 1 SOW/IP Office, otherwise known as the Installation Servicing Security Activity (SSA), is responsible for providing security program oversight and the AF activity is responsible for implementing and managing the AF activity security program.

(1) The visitor group’s home office facility (HOF) will identify to the SSA and AF activity, an employee to interface with and serve as the visitor group’s focal point for security related matters. The identified em-ployee will provide security program management assistance to the AF activity’s security manager.

(2) The AF activity, contracting office, visitor group, and SSA will perform duties outlined in this docu-ment in a timely manner. The Installation Commander grants access to classified material to visitor groups.

Contractor employees will be denied access to classified information, restricted/controlled areas, and Auto-mated Information Systems (AIS) until all Industrial Security actions have been completed.

b. Access to and Accountability of Classified Material:

(1) All access or possession of classified material by on-base visitor group personnel, including oral/vis-ual at Hurlburt Field, will be under the AF activity’s supervision. The AF activity maintains accountability, control, and ownership of all classified information at all times in accordance with current directives. The visitor group’s access to classified information will be controlled by the AF activity and limited to contract-specific, need-to-know, information only.

(2) The visitor group receives, releases, and disseminates classified material in accordance with current directives.

(3) If contractor personnel discover unattended classified material or an unsecure/unattended security container they will immediately secure the classified materials and notify the AF activity’s security manager.

During non-duty hours, visitor group personnel will notify Security Forces at 850-884-7777. Classified ma-terial will be turned over to the base security forces when the designated safe custodian or security manager cannot be contacted.

c. Storage of Classified Material:

(1) The visitor group is authorized to store and handle classified information in accordance with cur-rent directives. All classified information shared with the visitor group must be stored in an approved government owned and controlled security container. The contractor is prohibited from establishing and/or maintaining a separate classified information system. All classified material will be returned and secured in the designated government security container at the end of the duty day.

(2) The AF activity will have access to and control of all security containers. The responsibility for setting the storage container combination rests with the AF activity. Each container will have a govern-ment safe custodian appointed. The Standard Form (SF) 700, Security Container Information, will be used to identify persons having knowledge of the combination(s). This form will be posted inside the locking drawer of each security container.

d. Transmission of Classified Material:

(1) The on-base visitor group is not authorized for direct receipt or dispatch of classified material at Hurlburt Field; these actions will be coordinated with the AF activity.

(2) Classified material may be hand carried on/off Hurlburt Field by an appropriately cleared and briefed visitor group courier, provided the employee is so designated in writing by the contractor as a courier, and approved by the AF activity’s commander or designee, in accordance with current direc-tives.

e. Disposition of Classified Material. The visitor group will return all classified information to the AF activity at the end of contract performance or when no longer required, unless authorized to do otherwise by the contracting officer and specified on the DD Form 254, Department of Defense Contract Security Classification Specification.

f. Reproduction of Classified Material. When authorized, only AF approved and controlled reproduc-tion equipment will be used by the visitor group. The visitor group will not reproduce classified material without permission of the AF activity.

g. Security Education. The AF Activity Security Manager will ensure contract employees who require access to classified information receive initial and recurring security education training (at least annu-ally) regarding their individual responsibility for safeguarding classified information.

h. Personnel Security Clearances. The visitor group’s HOF will submit Visit Authorization Request (VARs) for on-base employees to the AF activity’s security manager. Each visitor group must submit their own VAR. The AF activity (program manager/contracting officer) serves as sponsor for the visits.

The VAR will be submitted using the Joint Personnel Adjudication System (JPAS) visit request function or its successor system and will not exceed one year.

i. Reports. The SSA coordinates and/or reports security violations committed by visitor group employ-ees to the appropriate Defense Counterintelligence and Security Agency Field Office, base contracting office, and the visitor’s group HOF, if and when appropriate. The visitor group must keep the AF activ-ity and SSA advised of any reports submitted per AFI 71-101V4, Counterintelligence.

j. Contractor Restricted Area Badges. If required for contract performance, the AF Form 1199, USAF Restricted Area Badge, will be issued to visitor group personnel for entry into Restricted Areas on Hurl-burt Field. Entry credentials are issued at the request of the AF activity.

k. Contractor Installation Access. Contractor personnel will be issued the Common Access Card (CAC) per Homeland Security Presidential Directive-12 (HSPD-12). The CAC, upon presentation at base entry control points, shall be accepted for perimeter screening purposes.

l. Security Checks. As required, visitor group personnel will be scheduled to perform end-of-day secu-rity checks within their assigned work areas by the AF activity in accordance with current directives.

These checks will ensure security precautions are taken to protect classified material. The Standard Form 701, Activity Security Checklist, and Standard Form 702, Security Container Check sheet, will be used to record these checks.

m. Emergency Protection. The visitor group will make every effort to secure all classified material in an approved storage container in the event of a natural disaster, major accident, or civil disturbance in accordance with current directives. If the area is evacuated and/or the container(s) abandoned, the visitor group employees will, upon termination of the emergency condition, examine classified holdings to en-sure there has been no compromise or loss of exposed information. In the event of missing material or possible compromise, the visitor group employees will immediately notify the AF activity’s security manager.

n. Clarification of Security Requirements. The visitor group will address inquiries or questions per-taining to security requirements to the AF activity’s security manager.

o. Foreign Involvement. The visitor group is required to notify the AF activity and contracting office, prior to any foreign involvement, regardless of access requirements or the sensitivity of information to be disclosed (classified or unclassified).

2. Security Reviews. Visitor Groups will be included in the AF activity’s Staff Assistance Visits (SAVs), Information Security Program Assessments and self-inspections.

3. Other:

a. Forms. The AF activity furnishes all government forms and applicable AFIs, OIs, Security Classifica-tion Guides and/or unit security plans required in support of this agreement.

b. Sub-contracts. A separate DD Form 254 is completed for each subcontractor requiring access to clas-sified information. The visitor group or the HOF, as applicable, is responsible for preparing the DD Form 254 for any subcontractors and must provide a copy to the SSA. The visitor group makes required distribution.

c. Controlled Unclassified Information (CUI)/Sensitive Information: Contractors are responsible for the protection of Controlled Unclassified Information (CUI) to include but not limited to: For Official Use Only, Privacy Act and Operations Security (OPSEC) information.

d. Communication/IT Systems.

(1) On-base visitor groups will not establish their own Information Technology (IT) systems/networks (Local Area Networks [LAN], Wide Area Network [WAN], Cellular phone/USB Modem as WAN, Wi- Fi as WAN, etc.) without the direct permission of governing communications and responsible infor-mation systems office.

(2) On-base visitor group personnel who need access to government IT systems must be determined to be trustworthy by the completion of a favorable personnel security investigation commensurate with assigned duties and adjudication by a designated government official prior to IT access being granted or assumption of sensitive duties.

LOCAL SECURITY REQUIREMENTS

FOR CONTRACTOR OPERATIONS

ADDENDUM to DD FORM 254 (BLOCK 10a)

COMSEC

COMSEC material/information may not be released to DoD contractors without Air Force Cryptological Support Center (AFCSC) approval. Contractors will forward requests for COMSEC to the COMSEC officer through the CAASETA program office. The con-tractor is governed by appropriate Air Force Security Instructions/Manuals (AFSSI/AFSSM) or Air Force Instructions (AFI). Access to COMSEC material or information is restricted to US citizens holding final U.S. Government clearances and is not releasable to personnel holding only a reciprocal clearance. Personnel requiring COMSEC access will be briefed in accordance with AFMAN 17- 1302-O (Communications Security Operations). The Air Force program/project manager will designate the number of personnel re-quiring COMSEC access. The number will be limited to the minimum necessary and will be on a strict need-to-know basis. If con-tractor is working within a squadron/unit, the contractor will go through the squadron/units’ COMSEC Responsible Officer for the use of COMSEC.

IN PERFORMING THIS CONTRACT:

Contractor may be required to provide storage for classified hardware to the level of Top Secret. The contractor will follow all in-structions from AF AFIs, AFSSIs, AFSSMs, and AFMANs

A COMSEC account will be established, if necessary, and COMSEC will be protected per DoD 5220.22-S.

See AFSSI 7700, AFSSI 7702, and AFMAN 33-214v1 for additional guidance and requirements.

The contractor is authorized to use the services of DCS if they have acquired an account through AFCSC. The contracting activity must request DCS services from the Commander, Defense Courier Service, ATTN Operations Division, Ft George G. Meade MD 20755. Only certain classified information qualifies for shipment by DCS. It is the responsibility of the contracting activity to comply with DCS policy and procedures.

REQUIREMENTS:

The requirements of DoD 5220.22-M and NSA/CSS Policy Manual 3-16 are applicable to this effort.

All contractor personnel to be granted access to classified COMSEC information must be U.S. citizens granted FINAL clearance by the government prior to being given access. Immigrant aliens, interim cleared personnel, or personnel holding a contractor granted CONFIDENTIAL clearance are not eligible for access to classified COMSEC information released or generated under this contract without the express permission of the Director, NSA.

Contractor employees or cleared commercial carriers shall not carry classified COMSEC material on commercial passenger aircraft anywhere in the world without the approval of the procuring contracting officer.

No contractor generated COMSEC or government furnished material may be provided to the Defense Technical Information Center (DTIC). Contractor generated technical reports will bear the statement "Not Releasable to the Defense Technical Information Center per DoD Directive 5100-38."

Classified paper COMSEC material may be destroyed by burning, disintegration, chopping or high security crosscut shredding. Cryp-tographic key tapes must be “terminally” destroyed (destroyed to the point where it cannot be reconstructed) utilizing devices listed on the Evaluated Products List (EPL) for Punched Tape Destruction Devices or the EPL for High-Security Disintegrators. Contact the COMSEC office for a list of approved devices. When a method other than burning is used, all residues must be reduced to pieces 5mm or smaller in any dimension. When classified COMSEC material other than paper is to be destroyed, specific guidance must be obtained from the User Agency.

Unclassified COMSEC information released or generated under this contract shall be restricted in its dissemination to personnel in-volved in the contract. Release in open literature or exhibition of such information without the express written permission of the Di-rector, NSA, is strictly prohibited.

Recipients of COMSEC information under this contract may not release information to subcontractors without permission of the User Agency.

COMSEC systems requirements and assistance can be found at the following:

Email: 1.socs.ca657504@us.af.mil Contact: 1 SOCS/SCXS at 884-5666

COMSEC

ADDENDUM TO DD FORM 254 (BLOCK 10k)

AUTOMATED INFORMATION SYSTEMS

1. This section outlines the requirements, procedures and Air Force publications that must be ad-hered to by contractors as a condition of use of Hurlburt Field Automated Information Systems (AIS) and Local Area Networks (LAN).

2. Cybersecurity practices are the actions that protect information and information systems by ensuring their continued availability, integrity, confidentiality, and non-repudiation. This in-cludes providing for restoration of information systems by incorporating disaster recovery capa-bilities to ensure continuity of operations under all conditions.

3. Key publications governing the use and security of AF AIS are listed below. Many include additional publications by reference, which are equally applicable.

• AFSSI 7700, Emission Security

• AFI 33-200, Air Force Cybersecurity Program Management

• AFI 33-210, Air Force Certification and Accreditation (C&A) Program (AFCAP)

• AFMAN 33- 152, User Responsibilities and Guidance for Information Systems

• AFI 10-712, Cyberspace Defense Analysis (CDA) Operations and Notice and Consent

Process

4. All personnel are required to safeguard information and information systems against unau-thorized access, modification, destruction or disclosure.

5. Per the Hurlburt Field NIPRnet System Security Authorization Agreement (SSAA), contrac-tor owned hardware and software will not be connected to Hurlburt Field unclassified or classi-fied LAN.

6. Non-Air Force wireless network devices are forbidden on Hurlburt Field.

7. All portable electronic devices (PED) are prohibited from use or possession within Hurlburt Field buildings where classified information is processed, stored or discussed.

8. All information systems, software, and/or enclaves operating on Hurlburt Field must be certi-fied and accredited through the DoD Information Assurance Certification and Accreditation Pro-gram (DIACAP) prior to being implemented or connected to a network.

9. The 1 SOW Cybersecurity Office is the source for cybersecurity related information.

• Email: 1sow.cybersecurity@us.af.mil

• Contact: 1 SOCS/SCXS at (850) 884-6605 mailto:1sow.ia@hurlburt.af.mil

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments [4] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form) 10A-COMSEC ADDENDUM (2020).pdf 10K-AIS ADDENDUM (2020).pdf 11J-OPSEC ADDENDUM (2020).pdf HFLD Local Security Requirements (2020).pdf

212 Lukasik, Room 230, Hurlburt Field, FL. 32544 850-884-5143, 1SOW.IPC.IndustrialSecurity@us.af.mil

100 SERVAIS WAY

HURLBURT FIELD, FL 32544

Block9: Provide instruction for Radio Communications, Pararescue unique training, Small Unit Tactics, Surveillance and Reconnaissance, Close Quarters Battle (CQB), Land Navigation, Tactical Vehicle Training, Convoy Operations Training, and Full Mission Profile Events.

2. Classified markings on all working, draft, and final copies of deliverable material shall be in accordance with DODM 5200.01, Vol 2, and applicable instructions contained in the respective security classification guides.

3. Use only AF certified AIS for performance on base and will comply with all AF AIS procedures.

Ref Item 10k: Secret Internet Protocol Network (SIPRNET) access authorization. The contractor shall not access, download, or further disseminate any information or data that falls outside the scope of execution of the defined contract requirements. In the event any additional access is required, the Program Manager, Contracting Officer Representative, or Security Manager must request modification/revision of the DD Form 254 and/or Statement of Work to the issuing Contracting Officer. Contractor shall prepare and submit all required documentation as required by command policy prior to receiving access.

Ref Item 12: Contractor is to submit requests through the Contracting Officer for OPSEC Program Manager review and public release authorization. The Contracting Officer will provide contractor with written approval/disapproval. Information requiring AF or DoD–level review will be reviewed by the unit’s OPSEC Program Manager or Coordinator who will in-turn forward to the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690. (This statement is required by AFMAN 16-1406V2)

**See attached addendums for items 10a, k, 11j and Hurlburt Field Local Security Requirements.

text: STTS/DOO 850-884-2173 text: 1 SOW/IPC 850-884-5143

Contracting Officer Representative rep: PARRISH HOLLINGSWORTH, GS-11 Chief, Industrial Security

Hurlburt Field, FL 32544-5810 Address: 350 Tully Street Bldg 90339 Hurlburt Field, FL 32544