Attachment 3 - IPPS-A AMP DD Form 254 - Final (23 OCT 2023).pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

PEO EIS HQ

9350 Hall Road, Bldg 1445 Fort Belvoir, VA 22060

Polk Building 2521 South Clark Street Arlington, VA 22202 Block9: The Contractor shall provide all personnel, supervision, and other items and non-personal services necessary (except for those specified as Government Furnished in Section 3 of this document) to perform the IPPS-A Inc II services, as defined in this Performance Work Statement (PWS). The Contractor shall perform to the standards in this PWS.

Agile and DevSecOps methodologies must be utilized for incremental and value-added delivery from requirements analysis / elaboration and business process re-engineering (BPR), through architecture, design, and testing, to integration with the IPPS-A production baseline with minimum cybersecurity vulnerabilities.

Integration with the IPPS-A production baseline will be performed with the IPPS-A Capability Support Team. The IPPS-A Capability Support Team is responsible for the integration, baseline testing, cybersecurity compliance, and release / deployment of functionality into the IPPS-A production baseline for operational use. The Army Military Payroll developer will be required to synchronize tasks and associated activities with the IPPS-A Capability Support Team, to include participation in agile teams, where applicable, to ensure smooth integration of Army Military Payroll functionality into the IPPS-A production baseline.

The Government will provide the Integration environment and associated tools to support the integration and test of the Army Military Payroll functionality into the IPPS-A production baseline for release. The IPPS-A Capability Support Team will administer and maintain the Integration environment, will ensure the currency of the IPPS-A baseline, tools, and test data in that environment, and will support the Army Military Payroll developer activities to be performed in that environment, such as incremental testing, cybersecurity scans. Likewise, the Army Military Payroll developer will support the IPPS-A Capability Support Team baseline activities in that environment to ensure readiness of the Army Military Payroll functionality for release.

Headquarters, 9350 Hall Rd. Fort Belvoir, VA 22060-5526

REF: 10(j) Controlled Unclassified Information (CUI) Protection of For Official Use Only (FOUO) information, contractual, and Privacy Act information. FOUO information shall be marked and protected IAW AR 25-55, Freedom of Information Act Program and AR 380-5, DA Information Security Program, Chapter 5. See Appendix 1, Safeguarding "For Official Use Only" (FOUO) Information. Information generated and/or provided under this contract shall be safeguarded and marked as IAW DoDI 5200.01. Personally Identifiable Information (PII) shall be protected IAW the Privacy Act (5 USC 552a), AR 25-1, and DODI 8500.2 Information Assurance (IA) implementation. All personnel accessing the system with elevated privileges or working with PII will at a minimum be IT Level I compliant.

REF: 10(k) OTHER - NIPRNET/SIPRNET All contractors shall have the appropriate personnel security investigation (PSI) completed and favorably adjudicated by the DoD CAS, and granted eligibility for access to SECRET level classified information not later than the time of the Task Order/Contract award. All Contractors must apply for Common Access Card (CAC), NIPRnet access, and SIPRnet access if required. SIPRnet access will be limited to only those employees who have a SIPRnet requirement during this contract and are determined by the government to have a need to know classified information. The contractor is not authorized to access, download or further disseminate any classified information which is outside the scope of the defined contract requirements unless specifically authorized in writing by the Government Program Manager (PM) or government network security authority. The contractor shall complete and forward to the KO/COR, a SIPRnet access request for approval by the Requiring Activity SIPRnet Trusted Agent prior to receiving access. Although the NATO brief is a requirement for SIPRnet it does NOT mean that the contractor has a requirement for access to NATO information. Access to NATO information is a specific requirement that will need additional justification from the government Project Manager (PM) and KO/COR. The IPPS-A Security Officer shall administer a NATO awareness brief to only those contractors who require access to the SIPRnet. The contractor and IPPS-A Security Officer must sign and retain the NATO briefing/debriefing form for the life of the contract. The IPPS-A Security Officer is required to update individual contractors DISS account reflecting the indoctrination to NATO Secret.

REF: 11(a): ACCESS TO CLASSIFIED INFORMATION ONLY AT A GOVERNMENT ACTIVITY - The contractor and subcontractors will comply with FAR Clause 52.204-2, 53-204-1 and comply with the Security Agreement (DD Form 441).

a. Access to classified information is restricted to properly accredited DA activities. The DA Original Classification Authority (OCA) Information Owner (IO) will provide security requirements, procedures and classification guidance for performance of this contract.

b. All contractors shall have the appropriate personnel security investigation (PSI) completed and favorably adjudicated by the DoD CAS, and granted eligibility for access to SECRET level classified information at the time of the Task Order/Contract award and or before performing any work under this Task Order/Contract award and must maintain the level of security required for the life of the Task Order/Contract award.

c. The contractor and subcontractors require access to classified source data up to and including SECRET in support of the Task Order/Contract award performance effort.

d. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Derived From” line necessitates compliance with the DoDM 5200.01, Volume 2, and DoDM 5220.22 NISPOM, paragraph 4-208a, and the use of a bibliography.

e. All classified Material/Information will be protected IAW all Executive Orders, laws, statutes, and policies promulgated via Department of Defense and DA Directives, Regulations, Instructions, Manuals, all amendments and revisions as provided in the PWS, references (which include DoDM 5200.01 Volumes 1-3), and AR 380-5.

f. Submit visit requests to the IPPS-A Security Office via DISS for need-to-know verification and access.

REF: 11(g): Contractor or contractor employees shall request to register with DTIC and subsequently to have access to DoD controlled information while working on an official effort supporting a particular contract through the GCA. The GCA may authorize contractor use of DTIC services on the DD Form 254. The level of access granted to a contractor depends upon the classification of the contract to be registered with DTIC and the approval of the USG approving official (a contracting officer, contracting officer’s technical representative, contracting officer’s representative, program manager, or project manager). For DTIC registration, go to www.dtic.mil/dtic/and select registration.

REF: 11(j): OPERATIONS SECURITY (OPSEC) REQUIREMENTS - The contractor and subcontractors shall comply with PEO-EIS IPPS-A OPSEC standing operating procedures (SOP) in accordance with AR 530-1 and PEO-EIS OPSEC Plan to protect classified, and Controlled Unclassified Information, and critical information used at the PEO-EIS government classified controlled facility locations throughout the National Capital Region, during the performance of this contract.

REF: 11(l): RECEIVE, STORE OR GENERATE CONTROLLED UNCLASSIFIED INFORMATION (CUI) - Contractors and subcontractors who have access to Controlled Unclassified Information, software, technical data and export controlled documents must be aware of their responsibility to protect this information in accordance with DoDI 5200.48. Those contractors having access to classified networks, software, information, and technical data must have a valid security clearance and need-to-know. Both instances must be in accordance with the current version of DoDI 5200.48 and 32 CFR Part 117, National Industrial Security Program Operating Manual.

REF: 11(m): OTHER-

a. All contractor, military, and civilian personnel shall not use personal e-mail or other non-government electronic accounts to conduct official DoD communications or to exchange official project information, and must not auto-forward official messages to nonofficial or corporate accounts.

(1) Personal, nonofficial electronic accounts may not be used to conduct official DoD communications for personal convenience or preferences.

(2) Adverse Actions -The intentional violation of a.[refer above] (including any rules, regulations, or other implementing guidelines) shall be a basis for disciplinary action in accordance with subchapter I, II, or V of chapter 75 of title 5

(3) Exceptions must meet the combined three conditions:

(a) Emergencies and other critical mission needs, as approved by the Government.

(b) When official communication capabilities are unavailable, impractical, or unreliable, as approved by the Government.

(c) It is in the interests of DoD or other USG missions, as approved by the Government (IAW DoDI 8170.01, January 2, 2019 Change 1, August 24, 2021 Section 3: Procedures pg22; 44 USC §2911: Disclosure requirement for official business conducted using non-official electronic messaging accounts).

b. All contractor and subcontractor personnel must be US citizens; NOTE: personnel with dual citizenship are not authorized access to collateral classified information unless they "meet the guidelines of the Department of the Army Security Executive Agent Directive 4" monitored by the company FSO and COR.

c. Contractor and subcontractor personnel shall complete the following required SETA training within 30 days of assignment and annually thereafter: DoD Cyber Awareness Challenge, Information Security Program Training, Identifying and Safeguarding Personally Identifiable Information (PII), DoD Mandatory Controlled Unclassified Information (CUI) Training, Insider Threat Awareness, U.S. Army Threat Awareness and Reporting Program (TARP), Level 1 Antiterrorism Training, Army OPSEC Level I (Newcomers and Refresher), Derivative Classification Training in accordance with DoDM 5220.22 and AR 350-1.

d. This Prime Contractor and Subcontractor DD Forms 254 shall be reviewed and concurred by the COR for any Original, Revision, Final, and/or Follow-on Contract.

e. All IPPS-A information, personnel, industrial, operations, physical security, cybersecurity, insider threat, anti-terrorism, and force protection incidents, infractions, and violations will be reported to the COR and PEO EIS IPPS-A SO immediately upon discovery.

f. All Contractors and Subcontractors shall inform their company security office of the location of any intended Foreign Travel a minimum of 2 weeks prior to departure. Individuals shall:

1. Complete of Level I Anti-terrorism within 12 months before travel.

2. Receive a travel-threat briefing from their company security office prior to departure.

3. Consider enrolling in the Smart Traveler Enrollment Program before traveling.

4. Be advised to visit the State Department’s website for travel alerts and warnings for countries with an elevated threat. The site also has information on the embassies and consulates; entry, exit and visa requirements; local laws and special circumstances; and health and medical facilities for every country.

5. Receive a Travel Debrief from their company security office upon return.

See Attachment A Department of Defense Contract Security Classification Specification

Address: PEO EIS HQ 9350 Hall Road, Bldg 1445 Fort Belvoir, VA