Attachment 7. CUI CCR DD254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

(Updated 20250815)

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

August 31, 2028 The public reporting burden for this collection of information, 0704-0567, is estimated to average 36 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD Form 254, "DoD Contract Security Classification Specification"

(See Instructions) - Select from drop-down list: 2

3001 Staff Drive Suite 2AG1 88G Tinker AFB, OK 73145

(2) Program Protection Plan; see Item 14.

DCSA HQ 27130 Telegraph Rd. Quantico, VA 22134

Gov Security Manager: Kayla Franklin, Kayla.Franklin.5@us.af.mil Gov COR: Maj Christopher Shrader, christopher.shrader@us.af.mil

4421 Air Depot Blvd, Bldg 7005, Tinker AFB, OK 73145

32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM) dated 24 February 2021 applies.

Points of Contact (POC):

Government Program Manager (PM): Maj Christopher Shrader, AFLCMC/WLT, 405-736-1853, christopher.shrader@us.af.mil Unit Government Security Manager (SM): Kayla Franklin, AFLCMC/WLT, 312-334-6359, Kayla.Franklin.5@us.af.mil

The Contractor will notify the Government Contracting Activity and the Government Security Manager within 72 hours of any incident involving the actual or suspected compromise/loss of classified information to enable the Government to conduct an immediate assessment of potential impact pending formal inquiry/investigation. Actual or suspected compromise of Covered Defense Information will be reported IAW DFARS Clause 252.204-7012.

Revision 1 changes: Updated security language in blk 13. Program Manager and Contracting Officer information updated Ref Blk 1a: Contractor must be granted a SECRET Facility Security Clearance prior to being granted access to SECRET information. All contractor personnel shall be in compliance before handling sensitive information or associating with the program/contract.

-Ref Items 10a/11h: The Contractor is authorized to receive Government furnished cryptographic equipment. Access to classified COMSEC information requires a final U.S. Government clearance to the appropriate level. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires prior approval of the GCA. Non-accountable COMSEC information, though not tracked in the COMSEC material control system, may still require a level of control within a document control system. Refer to NSA/CSS Policy Manual 3-16, "Control of Communications Security Material," and the Committee on National Security Systems Instruction (CNSSI)4001, "Controlled Cryptographic Items," for guidance. Contractor will comply with DAFMAN 17-1302-O "Communications Security (COMSEC) Operations." Contractor personnel will follow the security requirements of the host government activity.

-Ref Items 10j/11L: The contractor shall comply with DoDI 5200.48_DAFI 16-1403, "Controlled Unclassified Information (CUI)" and DoDM 5400.7-AFMAN 33-302, "DoD Freedom of Information Act (FOIA) Program." The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

-Ref Item 10k: Authorized users of an information technology (IT) system with no privileged access must obtain, at a minimum, a favorably completed Tier 1 background investigation in accordance with DoDM 5200.02_AFMAN 16‐1405, "Air Force Personnel Security Program," 1 Aug 18, Para 3.2b(2), Table 2 (Added)(AF).

(IT level 1) Prior to assumption of duties, limited privileged users of an IT system must obtain, at a minimum, a favorably completed Tier 3 background investigation IAW DoDM 5220.22V2_AFMAN 16‐1406V2, "National Industrial Security Program: Industrial Security Procedures for Government Activities," 8 May 20, para 6.2.a(2)(a) (Added)(AF) and DoDM 5200.02_AFMAN 16‐1405, "Air Force Personnel Security Program," 1 Aug 18, Para 3.2b(2), Table 2 (Added)(AF). Periodic reinvestigation are required every 5 years or in accordance with (IAW) continuous vetting (CV).

(IT level 2) Prior to assumption of duties, privileged users of an IT system must obtain, at a minimum, a favorably completed Tier 5 background investigation IAW DoDM 5220.22V2_AFMAN 16‐1406V2, "National Industrial Security Program: Industrial Security Procedures for Government Activities," 8 May 20, Para 6.2.a(2)(a) (Added)(AF) and DoDM 5200.02_AFMAN 16‐1405, "Air Force Personnel Security Program," 1 Aug 18, Para 3.2b(2) Table 2 (Added)(AF). Periodic reinvestigation's are required every 5 years or IAW CV.

(IT level 3) Access to Secret Internet Protocol Router Network (SIPRNET) is authorized. SIPRNET users shall receive the Air Force North Atlantic Treaty Organization (NATO) Security Awareness Briefing and sign an acknowledgment prior to SIPRNET access. Actual knowledge of, generation, or production of NATO information is not required for performance on the contract. When the contractor will be required to protect critical program information/critical components as identified in a Program Protection Plan.

-Ref Blk 11c: Receipt, storage, and generation of classified information or material. Any classified information generated in the performance of this contract shall require the contractor to apply derivative classification and markings consistent with the source material. Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware. All classified information received or generated will be properly stored and handled according to the markings on the material. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of the contract, the U.S. Government will be contacted to proper disposition instructions. Contractor will abide by the following security classification guidance. KC-135R Modernization Program Security Classification Guide, 10 Oct 97 (revised 20 Oct 2022) OPR: AFLCMC/WLT, Tinker AFB, OK. SCDG will be provided under separate cover.

-Ref Blk 11.d: The contractor is required to provide adequate and approved storage for classified hardware or material to the level of SECRET which because of size or quantity cannot be safeguarded in an approved storage container. Classified material at the {{Rockwell Collins, Inc. 400 Collins Road NE Cedar Rapids, IA 52498}} facility is stored in approved General Services Administration (GSA) security containers (safes).

-Ref Blk 11.g: Access to DTIC can be requested through the DD Form 1540, Registration for Scientific and Technical Information Services or online at: https://discover.dtic.mil/dtic-registration-benefits/dtic-registration/ The contractor must prepare a DD Form 1540, Registration for Scientific and Technical Information Services, for GCA submittal. The contractor may submit a DD Form 2345, Military Critical Technical Data Agreement, (after registration with DTIC) to the Defense Logistics Services Center for access to unclassified, militarily critical technical data from other DoD sources. The GCA must be involved in certifying need-to-know for contractors to utilize DTIC.

-Ref Blk 11.j, The program must comply with any OPSEC requirements/clauses indicated in the contract. On military installations the contractor will follow the installation OPSEC plan and guidance set forth in AFI 10-701, "Operations Security," as supplemented. Protect Critical Information (CI) and other sensitive unclassified information and activities, which could compromise the mission or operations or degrade the planning and execution of military operations performed by the contractor in support of the mission. See Performance Work Statement (PWS) for requirements.

-Ref. Blk 11m: IAW DoDM 5220.32 Volume 1 and AFMAN 16-1406V2 AFMCSUP, performance that requires a subcontractor, the prime contractor must take care of the subcontractor DD254.

Provide the information requested by the Notification of Government Security Activity and Visitor Group Security Agreements clause, Department of the Air Force Federal Acquisition Regulation Supplement (DAFFARS) 5352.204-9000, 5352.204-9002, 5352.242-9000 and 5352.242-9001 to each Information Protection Office listed in Item 15. The contractor shall comply with DoDM5220.22V2_AFMAN16-1406V2, "National Industrial Security Program: Industrial Security Procedures for Government Activities," 8 May 20. The Following FAR and DFARS Clauses apply: FAR Clauses 52.204-2, 52.204-21; DFARS Clauses 252.204-7000, 252.204-7008, 252.204-7009 and 252.204-7012.

Security Requirements - Tinker AFB OK

. These security requirements, promulgated by DoDM 5220.22V2_AFMAN 16-1406V2_DAFGM2025-01, National Industrial Security Program, Industrial Security Procedures for Government Activities, and 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), § 117.7(a), are issued for cleared contractors who will be entrusted to have access to classified information. This guidance is applicable for contractor performance as a visitor group (VG) under the 72nd Air Base Wing Information Protection Office (IPO) security cognizance, Tinker AFB OK. For performance on other installations, prior to the start of performance, the contractor shall contact the host IPO to execute an agreement and/or security requirements as mandated by the above referenced documents.

2. Storage of Classified Material/Information: The government program manager (GPM) may authorize VG to store and handle classified material required for performance on this contract. All classified information shared with the VG must be stored in an approved government-owned and controlled security container. The number of VG employees authorized access to the security container will be kept to the minimum number required for efficient contract performance. When authorized, the VG shall comply with DoDM 5200.01V1_DAFMAN 16-1404V1, Information Security Program: Overview, Classification & Declassification, DoDM 5200.01V2_DAFMAN 16-1404V2, Information Security Program: Marking of Classified Information, and DoDM 5200.01V3_DAFMAN 16-1404V3, Information Security Program: Protection of Classified Information and the government activity’s security program operating instruction (OI). The VG is prohibited from establishing and/or maintaining a separate classified information system. All classified material/information must be returned and secured in the government security container at the end of the duty day.

3. Reproduction of Classified Material: The VG may be authorized to reproduce classified information, as required for contract performance. Authorization must be accomplished IAW DoDM 5200.01V3_DAFMAN 16-1404V3 and only AF-approved and controlled equipment can be used.

4. Guard Services: The host government activity will provide guard services.

5. Security Forms: Security forms and publications are accessible at: Air Force publications: https://www.e-publishing.af.mil/ DoD publications: https://www.esd.whs.mil/DD/. Local forms will be provided by the government activity.

6. Security Inspections:

a. The VG shall participate in the host Commander’s self-inspection programs IAW DoDM 5200.01V1_DAFMAN 16-1404V1. Deficient items will include a corrective action plan.

b. The security focal point (SFP) will maintain the following documentation and have available for security reviews:

(1) A signed copy of the current prime DD Forms 254, and all subcontractors DD Forms 254, if applicable.

(2) Copy of the Security Agreement for visitor groups under 72 ABW/IP security cognizance.

(3) Documentation the Security Agreement was provided to all subcontractors, if applicable.

(4) Documentation of the last program review and self-inspection.

(5) Consultant Agreements, if applicable.

(6) Current list of all employees identifying their security clearance access level, including subcontractors, if applicable.

7. Transmission of Classified Material/Information:

a. Receipt and dispatch of classified material is the responsibility of the government. The VG is not authorized to perform these activities unless they are specifically contracted for and identified in the Statement of Work or Performance Work Statement. When this service is required for contract performance, the designated VG employee shall comply with DoDM 5200.01V1_DAFMAN 16-1404V1, DoDM 5200.01V2_DAFMAN 16-1404V2, DoDM 5200.01V3_DAFMAN 16-1404V3 and the government activity’s security program OI. The security assistant (SA) will provide VG personnel training on mail handling procedures, to include proper securing of Registered, Certified, USPS Express and FedEx Mail and/or First Class mail. However, under no circumstances will the VG be authorized to open a classified package beyond the outer wrapper to determine further distribution or sign the classified document receipt.

b. The VG is not authorized for direct receipt or dispatch of classified material at TAFB OK through US postal channels or commercial carrier.

c. Classified material transmitted via U. S. postal channels or approved commercial carrier, direct from the government activity, must be prepared IAW DoDM 5200.01V3_DAFMAN 16-1404V3 and processed through the classified information control system of TAFB OK.

d. Classified material may be hand carried onto or off TAFB by an appropriately cleared and briefed VG courier, provided the employee is so designated in writing by his/her company FSO as a courier and the activity Director or designee IAW DoDM 5200.1-V3_DAFMAN 16-1404V3.

8. Security Badges: The government activity will issue security badges. The contractor shall return security badges to the issuing office upon the period of performance end date, termination of the contract, or when an employee is no longer supporting the contract, whichever is sooner. Transfer of security badges to another contract is not authorized.

9. Visitor Control: The contractor shall comply with DoDM 5200.08V3_AFMAN 31-101V3, Installation Perimeter Access Control, and the host installation commander’s visitor control procedures for access to the installation and the government activity’s visitor control procedures to access facilities.

10. Security Incidents: The contractor shall report security incidents to the unit’s SA and the host IPO. The government shall conduct the preliminary inquiry for security incidents occurring on the installation IAW DoDM 5200.01V1_DAFMAN 16-1404V1.

11. Security Checks: Government personnel shall conduct end-of-day security checks unless the contract specifically identifies contractors to conduct end-of-day security checks.

12. Internal Security Controls: The contractor shall comply with the government activity’s security operating instructions.

13. Emergency Procedures to Protect Classified Material: The contractor shall implement emergency procedures to protect classified material as identified in the host government activity’s operating instruction.

14. Training: The contractor shall participate in the host government activity’s initial and reoccurring information protection security awareness and training education programs.

15. Subcontract DD Form 254: Should a subcontract be issued under this effort, whereas the subcontractor will require access to classified information and be physically located on TAFB OK for a minimum of 90 days, the VG must issue a subcontract DD Form 254, IAW the NISPOM, and comply with the following:

a. Provide a signed copy of the subcontract DD Form 254 to the GPM, SA and the SFP and 72 ABW/IPD.

b. Ensure the subcontractor complies with this security agreement or enter into a separate agreement with the subcontractor. The agreement to comply must be documented and a copy of the documentation provided to GPM, SA, SFP and 72 ABW/IPD. If a separate agreement is prepared, a copy shall be provided to the GPM, SA, SFP and 72 ABW/IPD.

16. Consultants: Should a consultant be acquired who will require access to classified information and be physically located on TAFB OK, a copy of the Consulting Agreement must be provided to the GPM, SA, SFP and 72 ABW/IPD.

17. Reporting Requirements: VG employees shall report adverse information, suspicious contacts, espionage, sabotage, and subversive activities to government activity’s SA IAW DoDM 5220.22V2_AFMAN 16-1406V2_DAFGM2025-01, para 4.14 (Added)(AF). The contractor shall furnish a copy of adverse information reports required by 32 CFR Part 117, National Industrial Security Program Operating Manual, § 117.8(c)(1)(i), SEAD 3 and CSA-provided guidance. Reports will be submitted to the installation commander through the 72nd ABW Industrial Security Office, 72 ABW/IPD.

18. Controlled Unclassified Information (CUI) Requirements: CUI is unclassified information that allows for, or requires, safeguarding and dissemination controls in accordance with Laws, Regulations, or Government-Wide Policies. VG employees shall follow all CUI requirements set forth in E.O. 13556, 32 Code of Federal Regulations, Part 2002, DoDI 5200.48, and DoDI5200.48_DAFI16-1403.

AFLCMC/WLTBA, Program Manager NAME & TITLE OF REVIEWING OFFICIAL (6): Kayla Franklin AFLCMC/WLT Division Chief of Security NAME & TITLE OF REVIEWING OFFICIAL (6): Stacey D. Smith AFMC/72ABW/SCXS COMSEC Manager NAME & TITLE OF REVIEWING OFFICIAL (6): Brian J. Brewer, NH-03 72 ABW/IPD Industrial Security Specialist

-Ref Blk 11j: OPSEC requirements apply. See Statement of Work (SOW) for requirements.

15. INSPECTIONS - Elements of this contract are outside the inspection responsibility of the CSO. - If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.): Ref Items 10a/11h: NSA has oversight for COMSEC at contractor facilities. Tinker COMSEC Office inspectors, HQ AFMC COMSEC staff and AFMIC COMSEC staff have sole inspection oversight for COMSEC materials provided to the contractor by COMSEC Account (CA 624509).

a. Ref Blk 8.c:

Location: Servicing IPO:

AFLCMC/WLT 3001 Staff Drive, Bldg 3001 Tinker AFB, OK 72 ABW/IP (AFMC) 4385 S. Air Depot Boulevard Tinker AFB OK

Tinker AFB, OK 73145

17. CERTIFICATION AND SIGNATURES - c. ADDRESS (Include ZIP Code): 3001 Staff Drive Ste 2A185A Tinker AFB, OK 73145