Attachment-58 DD254_J2.pdf

CLASSIFICATION (When filled in):

PREVIOUS EDITION IS OBSOLETE. Page 1 of 7DD FORM 254, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED

(See Instructions)

Top Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

None (See instructions)

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

TBD

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor) Add Row Remove Last Row Delete All Rows

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.) Add Row Remove Last Row Delete All Rows

a. LOCATION(S) (For actual performance, see instructions.)

Government Activity

b. CAGE CODE

(If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

PREVIOUS EDITION IS OBSOLETE. Page 2 of 7DD FORM 254, APR 2018

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.) h. FOREIGN GOVERMENT INFORMATION

d. FORMERLY RESTRICTED DATA i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDI 5200.48, only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

NO PUBLIC RELEASE IS AUTHORIZED

Public Release Authority:

WHCA J2

2743 Defense Boulevard, Washington DC, 20372 / 202-757-6099

13. SECURITY GUIDANCE Add Signature Remove Last Signature Delete All Signatures

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

Reference Block 10.e (1).

Access to Intelligence information that is Sensitive Compartmented Information (SCI) may be required in the performance of this contract.

Contractors are required to complete SCI training requirements through COR approved appropriate systems/databases. Only those personnel that require access to SCI information to complete their job duties will be provided SCI access.

a. The number of personnel required to have access to SCI is determined by the COR/TM and the DISA SSO.

b. The Director, Defense Intelligence Agency (DIA) and Director, Defense Information Systems Agency (DISA), as the executive agent for DIA, have exclusive security responsibility for SCI released to the contractor or developed under the contract.

c. Contractor generated or Government furnished material may not be provided to the Defense Technology Information Center. Contract generated technical reports will bear the statement "Not Releasable to the Defense Technical Information Center per DoD Instruction

PREVIOUS EDITION IS OBSOLETE. Page 3 of 7DD FORM 254, APR 2018

5230.24.

d. All contractor personnel requiring access to SCI information must: be U.S. citizens, have been granted a final ICD 704 security clearance by the US Government, and have been indoctrinated for the applicable compartments of SCI access prior to being given any access to such information released or generated under this contract.

e. Classified material released or generated under this contract is not releasable to foreign nationals without the expressed written permission of the Director, DISA (through the DISA SSO) and Director, DIA.

f. SCI received under this contract may not be released to subcontractor without permission of the DISA SSO.

g. The contractor and COR/TM will revalidate all SCI billets under this contract with the DISA SSO annually or when a revised DD Form 254 is issued, whichever is sooner.

h. All SCI visit requests by contractors shall be forwarded to the COR/TM for approval and need-to-know certification before being sent through the DISA SSO to the facility to be visited.

i. The contractor will abide by DCID 6/6 (formerly 1/7) Security Controls on the Dissemination of Intelligence Information, 11 July 2001.

Provided under separate cover.

Reference Block 10.j.

Contractor will be provided with and will abide by DoD Regulation 5400.7, DoD Freedom of Information Act Program, and DoD 5200.01- M, Information Security Program. Guidance provided under separate cover. Following information provided primarily for information:

1) Controlled Unclassified Information. The caveat, CUI, is defined as unclassified information or material to which access or distribution limitations have been applied IAW U.S. national laws, policies and regulations. The CUI categories serve as exclusive designations for identifying unclassified information throughout the Executive Branch that requires safeguarding or dissemination controls. Due to inconsistent marking of unclassified information, e.g., FOUO, Sensitive but Unclassified (SBU), Law Enforcement Sensitive (LES), etc., by various organizations, EO 13556 directed the standardization of efforts, and 32 CFR Part 2002 outlined the implementing instructions.

(a) Categories. There are two types of CUI categories known as CUI Basic and CUI Specified. While CUI Basic is the standard “flavor” of CUI, where all of the rules of CUI apply to CUI Basic categories and subcategories, making the handling and marking of CUI Basic the simplest, CUI Specified is different, since the requirements for how users must treat each type of information vary with each category or subcategory based on how some authorities have very specific requirements for how to handle the type of information they pertain to. A complete listing of the CUI categories and subcategories can be found in the CUI Registry on the National Archive website (https://www.archives.gov/cui/registry/category-list).

(b) Marking. The mandatory marking for all CUI material is the CUI banner marking, which appears centered, in bold capitalized black text, at the top of each page containing CUI. As an optional best practice, the CUI banner marking may also be placed centered at the bottom of the document. The content of the banner marking must be inclusive of all CUI within the document and must be the same on each page. All documents containing CUI must indicate the designator’s agency either through the use of letterhead, a signature block with agency designation, or the use of a “Controlled by” line. Every effort should be made to identify a point of contact, branch, or division within an organization, as well as include contact information. Portion markings are optional in a fully unclassified document, but it is permitted and encouraged to facilitate information sharing and proper handling of the information. Additional information on how to properly mark CUI material can be found in the ISOO Manual, Marking Controlled Unclassified Information.

(c) Dissemination. Dissemination and access to CUI should be encouraged and permitted to the extent such activity meets the following criteria: abides by the laws, regulations, or U.S. Government-wide policies that established the information as CUI; furthers a lawful government purpose; is not restricted by an authorized limited dissemination control established by this guide; and is not otherwise prohibited by law. Non-Executive Branch entities may receive CUI directly from members of the Executive Branch or as sub-recipients from other non-Executive Branch entities. In order to disseminate CUI to a non-Executive Branch entity, you must have a reasonable expectation that the recipient will continue to control the information in accordance with EO 13556, 32 CFR Part 2002, and the CUI Registry. For additional information concerning dissemination guidelines, reference 32 CFR Part 2002 subparagraph 16.

(d) Securing. CUI material and/or information must be safeguarded at all times in a manner that minimizes the risk of unauthorized disclosure while allowing for access by authorized holders. For categories designated as CUI Specified, personnel must also follow the procedures in the underlying laws, regulations, or U.S. Government-wide policies that established the specific category or subcategory involved. Safeguarding measures that are authorized or accredited for classified information are also sufficient for

PREVIOUS EDITION IS OBSOLETE. Page 4 of 7DD FORM 254, APR 2018 safeguarding CUI. At a minimum, authorized holders of CUI material must have access to controlled environments in which to protect CUI from unauthorized access or observation. Likewise, when discussing CUI, personnel must reasonably ensure that unauthorized individuals cannot overhear the conversation. When outside a controlled environment, personnel must keep the CUI under their direct control or protect it with at least one physical barrier. Personnel or the physical barrier must reasonably protect the CUI from unauthorized access or observation.

(e) Transmittal. Personnel may use the U.S. Postal Service or any commercial delivery service when transporting CUI to another organization. It is recommended that in-transit automated tracking and accountability tools be used when send CUI material through the postal system. Personnel may also use interoffice or interagency mail systems to transport CUI. Ensure to mark packages that contain CUI to indicate that they are intended for the recipient only and should not be forwarded. Do not put CUI markings on the outside of an envelope or package.

(f) Destruction. CUI material and/or information may be destroyed when the organization no longer needs the information and applicable records disposition schedules set forth by applicable laws, regulations, or U.S. Government-wide policies no longer require retaining the records. When destroying CUI, including in electronic form, it must be done so in a manner that makes it unreadable, indecipherable, and irrecoverable.”

Reference Block 11.e.

Contract is for equipment maintenance services around equipment which processes classified information. Actual knowledge of, generation, or production of classified information is not required for performance of the contract. Cleared personnel are required to perform this service because visual or aural access to classified information cannot be precluded by escorting personnel. Any classification guidance will be provided by the using activity

Reference Block 11.j.

OPERATIONS SECURITY (OPSEC) REQUIREMENTS: OPSEC requirements will be necessary in the performance of this contract in accordance with individual program requirements and DoDM 5205.07 series. Program-specific information shall not be communicated via unclassified systems. Any communication with outside activities not involved with this contract/solicitation is PROHIBITED, unless otherwise authorized by the DISA SSO or WHCA PSO/SAP Branch. Program-related telephonic communications will be conducted in accredited facilities on appropriately classified secure telephone systems. In addition, the contractor shall not use its association with the sponsoring agency or other Government agencies

All work is to be performed in accordance with DoD Operations Security (OPSEC) requirements, per the following applicable documents:

a. National Security Decision Directive (NSDD) 298: National Operations Security Program

b. Department of Defense Directive (DoDD) 5205.02, DoD Operations Security (OPSEC) Program

c. Department of Defense Manual (DoDM) 5205.02, Operations Security (OPSEC) Program Manual

The contractor will accomplish the following minimum requirements in support of the Government Activity's Security Operations:

a. The contractor will practice OPSEC and implement OPSEC countermeasures to protect the Government Activity's Critical Information. Items of Critical Information are those facts, which individually, or in the aggregate, reveal sensitive details about the Government Activity or the Contractor’s security or operations related to the support or performance of this contract, and thus require a level of protection from adversarial collection or exploitation not normally afforded to unclassified information.

b. The contractor must protect Critical Information and other sensitive unclassified information and activities, especially those activities or information which could compromise classified information or operations, or degrade the planning and execution of operations performed or supported by the contractor in support of the mission. Protection of Critical Information will include the adherence to and execution of countermeasures which the contractor is notified by or provided by the PSO/SAP Branch, for Critical Information on or related to this contract.

c. The contractor must fully understand that Sensitive Unclassified Information is that information marked "UNCLASSIFIED/FOR OFFICIAL USE ONLY," Privacy Act of 1974, COMPANY PROPRIETARY, or other CUI outlined in Block 10.e. above.

Reference Block 12.

Public Release is not authorized.

PREVIOUS EDITION IS OBSOLETE. Page 5 of 7DD FORM 254, APR 2018

Visit Authorization Requests (VARs)

All visit requests by contractors to WHCA facilities under the purview of this contract shall be forwarded to the Contracting Officer Representative (COR) for approval, and need to know certification. The Defense Counterintelligence and Security Agency (DCSA) retains responsibility for inspections of the contractor's Facility Security/Personnel Security requirements. Recommend visit access requests (VARs) by contractors to WHCA facilities be sent via the Defense Information System for Security (DISS) to the VAR Center (SMO:

W068AA2) or appropriate SMO for the effort. The COR must approve the VAR prior to sending the request to the facility being visited and a government sponsor must submit a CATS request in order to ensure access to compound.

If DISS is not available, the VAR must contain the following information on company letterhead

• Company name, address, telephone number, facility security clearance

• Name, SSN, date and place of birth, and citizenship of the employee intending to visit

• Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date, adjudication date & agency)

• Name of COR/Alt COR

• Dates or period the VAR is to be valid.

• Classification level of visit/meeting

• POC w/phone number

Contractor shall be responsible for safeguarding classified information in their custody or under their control. Individuals are responsible for safeguarding classified information entrusted to them. The extent of protection afforded classified information shall be sufficient to reasonably foreclose the possibility of its loss or compromise, inadvertently or otherwise.

GENERAL INFORMATON:

PERSONNEL SECURITY- PRESIDENTIAL SUPPORT DUTY (PSD) REQUIREMENTS:

Contractor personnel assigned to this contract will require a Top Secret clearance and must qualify for PSD IAW DoD Directive (DoDD) 5210.55, “Department of Defense Presidential Support Program,” and DoD Instruction (DoDI) 5210.87, “Selection of DoD Military and Civilian Personnel and Contractor Employees for Assignment to Presidential Support Duties (PSD).” Initial PSD approval is based on a favorable suitability interview, a current Single Scope Background Investigation (SSBI), currently called “Tier 5 Investigation” (T5), or SSBI-Reinvestigation (SSBI-PR), currently called “Tier 5 periodic reinvestigation” (T 5PR) within the preceding 36 months, and favorable adjudication of the candidate’s T5 or T 5PR investigation IAW DoDI 5210.87. A waiver of the 36-month requirement may be approved on a case-by-case basis. Personnel assigned to this contract must maintain their security clearance and PSD status in good standing IAW DoD Directives and Regulations. Final PSD determinations may take at least 3 months, or longer, depending on the scope of the candidate’s investigation. (NOTE: IAW DoDD 5210.55, DoDI 5210.87, and OSD Memorandum, dated June 2, 2017, the five (5) year period for Tier 5 and Tier 5 PRs remains in effect for all PSD candidates.)

NOTE: This DD 254 is an unclassified document; only reference the title or other unclassified description of the guidance, instruction, and/or other requirement(s). Public release of program information in PROHIBITED as stipulated in Section 12. Finished documents or other materials pertaining to this effort will not be released to the Defense Technical Information Center (DTIC) or any other such information service under any circumstances. A pre-publication and/or presentation review is required prior to the use of any classified or unclassified information which is either tangentially or directly related to this contract. In each case, approval must be obtained from the Contracting Officer. In addition to the prohibitions outlined in section 117.9.a.9 of the NISPOM, the contractor SHALL NOT use its association with the sponsoring Government Activity or other Government agencies associated with this contract in any type of literature, promotions, advertisements, website, etc., or use associated terms such as Presidential Support Program (PSP), Presidential Support Duty (PSD) or Yankee White (YW).

The contractor will establish and maintain an insider threat program outlined with NISPOM Section 117.7 that will gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O. 13587 and the 'National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs'. The contractor will establish and maintain a record of all cleared employees who have completed initial and annual insider threat training.

o OCONUS PLACES OF PERFORMANCE: Contractors traveling to OCONUS locations for either official or unofficial travel may require a defensive counterintelligence briefing prior to their departure. Requirement for defensive travel brief will be based on threat and will remain at the discretion of the organization’s security officer o SPILLAGES: Classified information will be protected IAW the NISPOM. All security incidents involving classified information, e.g., spillage shall be immediately reported to the Requiring Activity (RA) Security Specialist and ISS that signed the project DD Form 254, to their DCSA Industrial Security Representative. The Government Project Lead (GPL) will forward this information to the KO and COR, PREVIOUS EDITION IS OBSOLETE. Page 6 of 7DD FORM 254, APR 2018 for a program damage assessment to be conducted IAW AR 380-49 by the RA Security office. A spillage occurs whenever classified information or CUI is transferred onto an information system not authorized for the appropriate security level or not having the required CUI protection or access controls. Contractors responsible for a willful or negligent spillage of information shall pay enterprise service providers for the associated cleanup costs across the enterprise to restore the affected network or networks to a normal operating configuration.

o INDIVIDUAL COURIER CARD: Requirements for Individual Courier Cards must be approved by the GPL and issued by the RA organization o SUBCONTRACTING: The Contractor must comply with the requirements of the NISPOM and DoD Manual 5205.07, Volume 1 for all subcontracts. This includes, the verification of a potential subcontractor’s facility clearance (FCL) and safeguarding capabilities, if applicable. The use of subcontractors must be approved by the Contracting Officer with the concurrence of the Special Security Branch.

The Contractor must submit SAP Form 13 and a DD Form 254 and DCSA NISS print-out to the PSO/SAP Branch for approval of all subcontracts.

o LEGAL COUNSEL: Should the Contractor require private counsel to represent corporate interest in matters related to or associated with program sponsored activities, the Contracting Officer and Special Security Branch shall be notified in writing. The private counsel shall be treated as a subcontractor. In situations where the issues are not program/program specific, it is the responsibility of the appropriate indoctrinated personnel to prevent inadvertent dissemination of program-related information/data, operational procedures, and/or administrative details to the private counsel.

o REPORTS: Provide the Special Security Branch with a copy of all reports/documentation sent to DCSA, the Office of Personnel Management (OPM), or other Government Agencies concerning employees assigned to this contract or in the process of obtaining PSD approval to work on this contract. This includes, but is not limited to: reports of employment terminations, administrative clearance terminations/suspensions, name changes, marital status changes, and adverse information reports.

o REPRODUCTION: Top Secret//SAR material, if authorized by the Special Security Branch, may be reproduced only as necessary in the preparation and delivery of a contract deliverable. SECRET and CONFIDENTIAL material may be reproduced as necessary for subcontracts. Precise records of all events shall be maintained.

o ISSUES/CONFLICT REPORTING: Any questions regarding classification, program access, or any other security-related issue concerning this contract must be referred through the Contracting Officer to the Special Security Branch. Any misunderstanding of the instructions contained in the references herein or other aspects of this contract must be reported to the Special Security Branch.

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form) Show Attachment Bar

NAME & TITLE OF REVIEWING OFFICIAL

Jerry Cervantes Special Security Officer, WHCA

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

Contractor personnel require a Top Secret clearance and must qualify for Presidential Support Duty (PSD) IAW DOD 5210.55 and DOD

5210.87 OPSEC requirement annotated for this contract

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

The White House Communications Agency, Security Directorate, will retain security cognizance of the contractor’s operations under this contract.

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

PREVIOUS EDITION IS OBSOLETE. Page 7 of 7DD FORM 254, APR 2018

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

c. ADDRESS (Include ZIP Code) d. POC NAME

e. POC TELEPHONE (Include Area Code)

f. EMAIL ADDRESS (See Instructions)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

b. TITLE

c. ADDRESS (Include ZIP Code)

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

e. CAGE CODE OF THE PRIME CONTRACTOR (See Instructions.)

f. TELEPHONE (Include Area Code)

g. EMAIL ADDRESS (See Instructions)

h. SIGNATURE

i. DATE SIGNED (See Instructions)

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

White House Communications Agency J2 Special Security Branch (SSB) 2743 Defense Boulevard, SW Washington, DC 20373-5815

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, "DoD Contract Security Classification Specification"

J2 Special Security Branch (SSB) 2743 Defense Boulevard, SW Washington, DC 20373-5815

2743 Defense Boulevard, Washington DC, 20372 / 202-757-6099

Access to Intelligence information that is Sensitive Compartmented Information (SCI) may be required in the performance of this contract. Contractors are required to complete SCI training requirements through COR approved appropriate systems/databases. Only those personnel that require access to SCI information to complete their job duties will be provided SCI access.

a. The number of personnel required to have access to SCI is determined by the COR/TM and the DISA SSO.

b. The Director, Defense Intelligence Agency (DIA) and Director, Defense Information Systems Agency (DISA), as the executive agent for DIA, have exclusive security responsibility for SCI released to the contractor or developed under the contract.

c. Contractor generated or Government furnished material may not be provided to the Defense Technology Information Center. Contract generated technical reports will bear the statement "Not Releasable to the Defense Technical Information Center per DoD Instruction 5230.24.

d. All contractor personnel requiring access to SCI information must: be U.S. citizens, have been granted a final ICD 704 security clearance by the US Government, and have been indoctrinated for the applicable compartments of SCI access prior to being given any access to such information released or generated under this contract.

e. Classified material released or generated under this contract is not releasable to foreign nationals without the expressed written permission of the Director, DISA (through the DISA SSO) and Director, DIA.

f. SCI received under this contract may not be released to subcontractor without permission of the DISA SSO.

g. The contractor and COR/TM will revalidate all SCI billets under this contract with the DISA SSO annually or when a revised DD Form 254 is issued, whichever is sooner.

h. All SCI visit requests by contractors shall be forwarded to the COR/TM for approval and need-to-know certification before being sent through the DISA SSO to the facility to be visited.

i. The contractor will abide by DCID 6/6 (formerly 1/7) Security Controls on the Dissemination of Intelligence Information, 11 July 2001. Provided under separate cover.

Reference Block 10.j.

Contractor will be provided with and will abide by DoD Regulation 5400.7, DoD Freedom of Information Act Program, and DoD 5200.01-M, Information Security Program. Guidance provided under separate cover. Following information provided primarily for information:

1) Controlled Unclassified Information. The caveat, CUI, is defined as unclassified information or material to which access or distribution limitations have been applied IAW U.S. national laws, policies and regulations. The CUI categories serve as exclusive designations for identifying unclassified information throughout the Executive Branch that requires safeguarding or dissemination controls. Due to inconsistent marking of unclassified information, e.g., FOUO, Sensitive but Unclassified (SBU), Law Enforcement Sensitive (LES), etc., by various organizations, EO 13556 directed the standardization of efforts, and 32 CFR Part 2002 outlined the implementing instructions.

(a) Categories. There are two types of CUI categories known as CUI Basic and CUI Specified. While CUI Basic is the standard “flavor” of CUI, where all of the rules of CUI apply to CUI Basic categories and subcategories, making the handling and marking of CUI Basic the simplest, CUI Specified is different, since the requirements for how users must treat each type of information vary with each category or subcategory based on how some authorities have very specific requirements for how to handle the type of information they pertain to. A complete listing of the CUI categories and subcategories can be found in the CUI Registry on the National Archive website (https://www.archives.gov/cui/registry/category-list).

(b) Marking. The mandatory marking for all CUI material is the CUI banner marking, which appears centered, in bold capitalized black text, at the top of each page containing CUI. As an optional best practice, the CUI banner marking may also be placed centered at the bottom of the document. The content of the banner marking must be inclusive of all CUI within the document and must be the same on each page. All documents containing CUI must indicate the designator’s agency either through the use of letterhead, a signature block with agency designation, or the use of a “Controlled by” line. Every effort should be made to identify a point of contact, branch, or division within an organization, as well as include contact information. Portion markings are optional in a fully unclassified document, but it is permitted and encouraged to facilitate information sharing and proper handling of the information. Additional information on how to properly mark CUI material can be found in the ISOO Manual, Marking Controlled Unclassified Information.

(c) Dissemination. Dissemination and access to CUI should be encouraged and permitted to the extent such activity meets the following criteria: abides by the laws, regulations, or U.S. Government-wide policies that established the information as CUI; furthers a lawful government purpose; is not restricted by an authorized limited dissemination control established by this guide; and is not otherwise prohibited by law. Non-Executive Branch entities may receive CUI directly from members of the Executive Branch or as sub-recipients from other non-Executive Branch entities. In order to disseminate CUI to a non-Executive Branch entity, you must have a reasonable expectation that the recipient will continue to control the information in accordance with EO 13556, 32 CFR Part 2002, and the CUI Registry. For additional information concerning dissemination guidelines, reference 32 CFR Part 2002 subparagraph 16.

(d) Securing. CUI material and/or information must be safeguarded at all times in a manner that minimizes the risk of unauthorized disclosure while allowing for access by authorized holders. For categories designated as CUI Specified, personnel must also follow the procedures in the underlying laws, regulations, or U.S. Government-wide policies that established the specific category or subcategory involved. Safeguarding measures that are authorized or accredited for classified information are also sufficient for safeguarding CUI. At a minimum, authorized holders of CUI material must have access to controlled environments in which to protect CUI from unauthorized access or observation. Likewise, when discussing CUI, personnel must reasonably ensure that unauthorized individuals cannot overhear the conversation. When outside a controlled environment, personnel must keep the CUI under their direct control or protect it with at least one physical barrier. Personnel or the physical barrier must reasonably protect the CUI from unauthorized access or observation.

(e) Transmittal. Personnel may use the U.S. Postal Service or any commercial delivery service when transporting CUI to another organization. It is recommended that in-transit automated tracking and accountability tools be used when send CUI material through the postal system. Personnel may also use interoffice or interagency mail systems to transport CUI. Ensure to mark packages that contain CUI to indicate that they are intended for the recipient only and should not be forwarded. Do not put CUI markings on the outside of an envelope or package.

(f) Destruction. CUI material and/or information may be destroyed when the organization no longer needs the information and applicable records disposition schedules set forth by applicable laws, regulations, or U.S. Government-wide policies no longer require retaining the records. When destroying CUI, including in electronic form, it must be done so in a manner that makes it unreadable, indecipherable, and irrecoverable.”

Reference Block 11.e.

Contract is for equipment maintenance services around equipment which processes classified information. Actual knowledge of, generation, or production of classified information is not required for performance of the contract. Cleared personnel are required to perform this service because visual or aural access to classified information cannot be precluded by escorting personnel. Any classification guidance will be provided by the using activity

Reference Block 11.j.

OPERATIONS SECURITY (OPSEC) REQUIREMENTS: OPSEC requirements will be necessary in the performance of this contract in accordance with individual program requirements and DoDM 5205.07 series. Program-specific information shall not be communicated via unclassified systems. Any communication with outside activities not involved with this contract/solicitation is PROHIBITED, unless otherwise authorized by the DISA SSO or WHCA PSO/SAP Branch. Program-related telephonic communications will be conducted in accredited facilities on appropriately classified secure telephone systems. In addition, the contractor shall not use its association with the sponsoring agency or other Government agencies

All work is to be performed in accordance with DoD Operations Security (OPSEC) requirements, per the following applicable documents:

a. National Security Decision Directive (NSDD) 298: National Operations Security Program

b. Department of Defense Directive (DoDD) 5205.02, DoD Operations Security (OPSEC) Program

c. Department of Defense Manual (DoDM) 5205.02, Operations Security (OPSEC) Program Manual

The contractor will accomplish the following minimum requirements in support of the Government Activity's Security Operations:

a. The contractor will practice OPSEC and implement OPSEC countermeasures to protect the Government Activity's Critical Information. Items of Critical Information are those facts, which individually, or in the aggregate, reveal sensitive details about the Government Activity or the Contractor’s security or operations related to the support or performance of this contract, and thus require a level of protection from adversarial collection or exploitation not normally afforded to unclassified information.

b. The contractor must protect Critical Information and other sensitive unclassified information and activities, especially those activities or information which could compromise classified information or operations, or degrade the planning and execution of operations performed or supported by the contractor in support of the mission. Protection of Critical Information will include the adherence to and execution of countermeasures which the contractor is notified by or provided by the PSO/SAP Branch, for Critical Information on or related to this contract.

c. The contractor must…