Attachment 4 DD254 Solicitation 12-21-21_Cybersecurity.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

1100 Balch Blvd Stennis Space Center, MS 39529 CSO: NAVOCEANO Security Manager 1002 Balch Boulevard Stennis Space Center, MS 39522-5001 CSO: NOOC Security Manager 1002 Balch Boulevard Stennis Space Center, MS 39522-5001 CSO: FNMOC Security Manager 7 Grace Hopper Ave Monterey, CA 93943-5501 CSO: FWC-N Security Manager 9141 3rd Ave Norfolk, VA 23511 CSO: FWC-SD Security Manager N 4th Street Coronado, CA 92118 CSO: NAVICECEN Security Manager 4231 Suitland Road, NSOF Suitland, MD 20746 CSO: USNO Security Manager 3450 Massachusetts Ave, NW Washington, DC 20392-5420 CSO: NAVIFOR Security Manager 115 Lake View Parkway Suffolk, VA 23435

Commander, Naval Meteorology and Oceanography Command 1100 Balch Blvd Stennis Space Center, MS 39529 Location: Naval Oceanographic Office 1002 Balch Boulevard Stennis Space Center, MS 39522-5001 Location: Naval Oceanographic Operations Command 1002 Balch Boulevard Stennis Space Center, MS 39522-5001 Location: Fleet Numerical Meteorological Operations Command 7 Grace Hopper Ave Monterey, CA 93943-5501 Location: Fleet Weather Center, Norfolk VA 9141 3rd Ave Norfolk, VA 23511 Location: Fleet Weather Center, San Diego CA N 4th Street Coronado, CA 92118 Location: Naval Ice Center 4231 Suitland Road, NSOF Suitland, MD 20746

Location:

U.S. Naval Observatory 3450 Massachusetts Ave, NW Washington, DC 20392-5420 Location: Naval Information Forces 115 Lake View Parkway Suffolk, VA 23435 Block9: The purpose of this contract is to provide a full range of Information Technology (IT) support services and infrastructure support to NAVMETOCCOM, Stennis Space Center, MS, and its Echelon IV organizations. This may include support to activities such as:

• Infrastructure, IT System Administration, Communications, and Cross Domain Solutions

• Information Assurance

• IT Configuration Management (CM)

• IT Customer Interface Management (CIM)

• IT Requirements Managements

• IT Life Cycle Support

Code 01P

Although the actual end items provided by the contractor may not be classified, contractor personnel are required to have access to restricted areas wherein visual access to classified information cannot be precluded. Only personnel with a SECRET level or higher clearance may perform under this contract since the only alternative is to have the restricted areas "sanitized" which would halt all other work in the area. This would not allow NAVMETOCCOM and subordinated commands to meet its operational commitments and therefore, its mission.

All security related matters or questions pertaining to this classified contract shall be addressed to the certifying official identified in block 16 of this DD Form 254.

All reports of contractor security violations associated with this contract shall be mailed by the Cognizant DSS field office directly to the certifying official in block 16 of this DD Form 254. All classified information involved in security incidents shall be retained and provided to the certifying official in block 16 of this DD Form 254 for classification review.

Material, software, and data produced under this contract may be classified in accordance with the source material up to and including TOP SECRET.

The contractor shall advise of contractor personnel changes as they occur and shall ensure ex-employees' security and access badge/decals are returned to the appropriate Government Security Representative immediately upon employee termination.

All development of database, classified hardware, and graphics (when conducted at the contractors location) will be done upon Defense Counterintelligence and Security Agency approved automated information security (AIS) equipment.

All classified information/hardware developed will be classified pursuant to derivative classification procedures or as any applicable classification guide so dictates (NISPOM 32 CFR Part 117) and Executive Order 13526. All applicable classification guides will be identified and made available by the program manager located in block 16. The SRC Security Classification Guide pertains and will be used as the primary source of classification. Meetings or visits conducted by the contractor' will be done IAW NISPOM 32 CFR Part 117.

All classified material generated under this contract will be derivatively classified IAW Executive Order 13526 as amended, based on existing source documents or applicable classification guides. NAVIFOR Contracting Activity will be notified prior to any portion of this contract being subcontracted out.

Ref 10a:

Ref 10e(1):

Ref 10g: The contractor is permitted access to North Atlantic Treaty Organization (NATO) information in performance of this contract. Access to NATO information requires a final U.S. Government clearance at the appropriate level. The governmentre NATO briefed prior to access being granted. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM 32 CFR Part 117. Prior approval from the contracting activity is required for subcontracting.

Ref 10j: FOUO information provided under this contract shall be safeguarded as specified in the attachment, Protecting For Official Use Only (FOUO) Information.

Ref 11b:

Ref 11c:

Ref 11f:

Ref 11j:

a) The Contractor shall not release to anyone outside the Contractor's organization any unclassified information, regardless of medium, pertaining to any part of this contract or any program related to this contract, unless; 1) The Contracting Officer has given prior written approval; or 2) The information is otherwise in the public domain before the date of release.

b) The Contractor agrees to include a similar requirement in each subcontract under this contract. Subcontractors shall submit requests for authorization to release through the prime contractor to the Contracting Officer.

Ref 11l;

Ref 11m (Other): For task orders issued for Fleet Numerical Meteorology and Oceanographic Center (FNMOC), the following additional security guidance is provided:

a. For "Have Access Elsewhere" only orders, classified contract performance is restricted to the actual work performance location (User Agency principal locations) cited in Block 8 of this DD Form 254 and other government or cleared contractor facilities as approved by FNMOC. Contractor will have access to or be exposed to classified government local area network/wide area network (LAN/WAN) and will receive an on-site briefing by a government representative. Briefings by the government security department may include, but are not limited to, the following: issuance and use of Security Classification Guides (SCG); generation, receipt, fabrication, modification, and storage of classified material on/off site; ID's, badges; and other local security requirements. All contractor personnel are required to attend security awareness training and briefings coordinated by the FNMOC Security Department and/or Special Security Officer, including annual Counterintelligence Awareness and Reporting Training (CIAR), as directed by DODD 5240.06, which will be conducted by the Naval Criminal Investigative Service (NCIS).

b. All classified visits shall be pre-approved by the FNMOC Government Security Manager by forwarding to the individual identified under Points of Contact for need-to-know certification at least two (2) working days in advance of the proposed visit. Visit letters shall contain all information required by the DOD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM) and shall not exceed the period of performance end date.

c. Points of Contact are as follows Name Title Phone/email Kevin Whittier Information Assurance Manager kevin.d.whittier.civ@us.navy.mil; 831-656-4603 Elizabeth A. Coleman Security Manager elizabeth.a.coleman.civ@us.navy.mil; 831-656-4482 Randolph L. (Randy) McLeod Personnel Security Manager randolph.l.mcleod.civ@us.navy.mil; 832-656-4377 Joel S. Millwee SSO joel.s.millwee.civ@us.navy.mil; 831-658-1307

ANNEX - Security Classification Guide

1. The contractor shall not release any information relating to this contract including unclassified information unless authorized by FNMOC.

2. Upon completion of this contract, all materials provided to the contractor will be returned to the Government Program Office unless written exception is provided to the contractor. Materials generated by the contractor may be returned or destroyed as directed. All items approved for retention will be specifically listed in the approval letter. NOTE: Receipt and/or generation of classified material are not permitted in the contractor's spaces. All classified work is to be performed as the User Agency's principal location and other customer-designated locations as approved.

3. All classified data provided to the contractor will contain classification markings and downgrading instructions, where appropriate. Classified material and equipment will remain under FNMOC accountability and will be handled in accordance with applicable FNMOC directives.

4. Security classification guides and controlled unclassified information (e.g. FOUO, distribution statement controlled) are not authorized for public release; therefore they cannot be posted on a publicly accessible web-server or transmitted over the internet unless appropriately encrypted. Requests for a public release cannot be transmitted via the internet until the contractor receives final approval from FNMOC.

5. Contractor must submit a request for sharing classified information and other sensitive information between prime contracts in writing to the FNMOC Security Office, 7 Grace Hooper Avenue, Stop 1, Monterey CA 93943, for approval.

6. All classified documents must be destroyed using a National Security Agency (NSA) approved high security crosscut shredder listed on the NSA/CSS evaluated products list for high security crosscut shredders, or other approved method for destroying classified information.

SSO

Suite 309-WS105 Mechanicsburg, PA 17050-2411 Address: Naval Information Forces 1100 Balch Blvd Stennis Space Center, MS 39529