Attachment_C_Classified_Submission_Instructions.pdf

Classified Submission Instructions, Requirements, and Procedures (applicable to all Proposers)

Classified abstract submissions should NOT be submitted through DARPA’s BAA Website or Grants.gov. Proposers will likely still need to visit https://baa.darpa.mil to register their organization (or verify an existing registration) to ensure the BAA office can verify and finalize their submission—instructions for this process can be obtained by inquiry via the BAA Coordinator inbox DARPA-PS-26-09@darpa.mil.

Proposers choosing to submit classified information from other classified sources (i.e., sources other than DARPA) must ensure (1) they have permission from an authorized individual at the cognizant Government agency (e.g., Contracting Officer, Program Manager); (2) the proposal is marked in accordance with the source Security Classification Guide (SCG) from which the material is derived; and (3) the source SCG is submitted along with the proposal.

Proposers should include with their abstract the program security requirements unique to their submission. Common program security requirements include but are not limited to: OPSEC contracting/sub-contracting plans; foreign participation or materials utilization plans; program protection plans (which may entail the following) manufacturing and integration plans; range utilization and support plans (air, sea, land, space, and cyber); data dissemination plans; asset transportation plans; classified test activity plans; disaster recovery plans; classified material / asset disposition plans and public affairs / communications plans.

CUI

For unclassified abstracts or proposals containing CUI, applicants will ensure personnel and information systems processing CUI security requirements are in place.

CUI Proposal Markings If an unclassified submission contains CUI or the suspicion of such, as defined by Executive Order 13556 and 32 C.F.R. Part 2002, the information must be appropriately and conspicuously marked CUI in accordance with DoDI 5200.48. Identification of what is CUI about this DARPA program will be detailed in a DARPA STO CUI Guide and will be provided at a later date.

CUI Submission Requirements Unclassified submissions containing CUI may be submitted via DARPA’s BAA Website (https://baa.darpa.mil) in accordance with Section 2.2 of this solicitation.

Proposers submitting abstracts or proposals involving the pursuit and protection of DARPA information designated as CUI must have, or be able to acquire prior to contract award, an information system authorized to process CUI information IAW NIST SP 800-171 and DoDI 8582.01.

Classified Submissions https://baa.darpa.mil/ mailto:DARPA-PS-26-09@darpa.mil https://baa.darpa.mil/

For classified abstracts or proposals, applicants will ensure all industrial, personnel, and information systems processing security requirements are in place and at the appropriate level (e.g., Facility Clearance Level (FCL), Automated Information Security (AIS), Certification and Accreditation (C&A), and any Foreign Ownership Control and Influence (FOCI) issues are mitigated prior to submission. Additional information on these subjects can be found at https://www.dcsa.mil/.

Classified Proposal Markings At this time, DARPA anticipates that abstracts or proposals submitted in response to this announcement may generate or involve access to classified information. Classified submissions shall be transmitted and marked in accordance with the following guidance. Security classification guidance via a Security Classification Guide (SCG) and/or DARPA DD Form 254, “DoD Contract Security Classification Specification,” will be provided as an attachment to the BAA or may be provided at a later date.

If a submission contains Classified National Security Information or the suspicion of such, as defined by Executive Order 13526, the information must be appropriately and conspicuously marked with the proposed classification level and declassification date. Submissions requiring DARPA to make a final classification determination shall be marked as follows:

“CLASSIFICATION DETERMINATION PENDING. Protect as though classified____________________________(insert the recommended classification level, e.g., Top Secret, Secret or Confidential)”

NOTE: Classified submissions must indicate the classification level of not only the submitted materials, but also the classification level of the anticipated award.

Submissions containing both classified information and CUI must be appropriately and conspicuously marked with the proposed classification level as well as ensuring CUI is marked in accordance with DoDI 5200.48.

Classified Submission Requirements and Procedures Proposers submitting classified information must have, or be able to obtain prior to contract award, cognizant security agency approved facilities, information systems, and appropriately cleared/eligible personnel to perform at the classification level proposed. All proposer personnel performing Information Assurance (IA)/Cybersecurity related duties on classified Information Systems shall meet the requirements set forth in DoD Manual 8570.01-M (Information Assurance Workforce Improvement Program). Additional information on the subjects discussed in this section may be found at https://www.dcsa.mil/.

Proposers choosing to submit classified information from other collateral classified sources (i.e., sources other than DARPA) must ensure (1) they have permission from an authorized individual at the cognizant Government agency (e.g., Contracting Officer, Program Manager); (2) the proposal is marked in accordance with the source SCG from which the material is derived; and

(3) the source SCG is submitted along with the proposal.

https://www.dcsa.mil/ https://www.dcsa.mil/

When a proposal includes a classified portion, and when able according to security guidelines, we ask that proposers send an e-mail to DARPA-PS-26-09@darpa.mil as notification that there is a classified portion to the proposal.

Confidential, Secret, and Top Secret Information Use transmission, classification, handling, and marking guidance provided by previously issued SCGs, the DoD Information Security Manual (DoDM 5200.01, Volumes 1 - 4), and the National Industrial Security Program Operating Manual, including the Supplement Revision 1, (DoD 5220.22-M and DoD 5200.22-M Sup. 1) when submitting Confidential, Secret, and/or Top Secret classified information.

Confidential and Secret Confidential and Secret classified information may be submitted via ONE of the two following methods to the mailing address listed in the contact information in Part I of this solicitation:

• Hand-carried by an appropriately cleared and authorized courier to the DARPA Classified Document Registry (CDR). At least five (5) business days prior to traveling, the courier shall contact the DARPA CDR at 703-526-4052 to coordinate arrival and delivery.

OR

• Mailed via U.S. Postal Service (USPS) Registered Mail or USPS Express Mail. All classified information will be enclosed in opaque inner and outer covers and double-wrapped. The inner envelope shall be sealed and plainly marked with the assigned classification and addresses of both sender and addressee. Senders should mail to the mailing address listed in the contact information herein.

The inner envelope shall be addressed to:

Defense Advanced Research Projects Agency ATTN: Strategic Technology Office Reference: DARPA-PS-26-09 675 North Randolph Street Arlington, VA 22203-2114

The outer envelope shall be sealed with no identification as to the classification of its contents and addressed to:

Defense Advanced Research Projects Agency Security & Intelligence Directorate, Attn: CDR 675 North Randolph Street Arlington, VA 22203-2114

Top Secret Information

Top Secret information must be hand-carried by an appropriately cleared and authorized courier to the DARPA CDR. Prior to traveling, the courier shall contact the DARPA CDR at 703-526- 4052 to coordinate arrival and delivery.

Sensitive Compartmented Information (SCI) SCI must be marked, managed, and transmitted in accordance with DoDM 5105.21 Volumes 1 -

3. Questions regarding the transmission of SCI may be sent to the DARPA Technical Office Program Security Officer (PSO) via the Solicitation mailbox or by contacting the DARPA Special Security Officer (SSO) at 703-812-1970.

Successful proposers may be sponsored by DARPA for access to SCI. Sponsorship must be aligned to an existing DD Form 254 where SCI has been authorized. Questions regarding SCI sponsorship should be directed to the DARPA Personnel Security Office at 703-526-4543.

Special Access Program (SAP) Information SAP information must be marked in accordance with DoDM 5205.07 Volume 4 and transmitted by specifically approved methods which will be provided by STO PSO or their staff.

Proposers choosing to submit SAP information from an agency other than DARPA are required to provide the DARPA Technical Office PSO written permission from the source material’s cognizant Special Access Program Control Officer (SAPCO) or designated representative. For clarification regarding this process, contact the DARPA STO PSO via the Solicitation mailbox or the DARPA SAPCO at 703-526-4102.

Additional SAP security requirements regarding facility accreditations, information security, personnel security, physical security, operations security, test security, classified transportation plans, and program protection planning may be specified in the DD Form 254.

NOTE: All proposals containing SAP information must be processed on an SAP IT system that has received an Approval-to-Operate (ATO) from the DARPA Technology Office PSO, or other applicable DARPA SAP IT Authorizing Official. The SAP IT system ATO will be based upon the Risk Management Framework (RMF) process outlined in the Joint Special Access Program Implementation Guide (JSIG), current version, (or successor document). (Note: A SAP IT system is any SAP IT system that requires an ATO.

It can range from a single laptop/tablet up to a local and wide area networks.)

The Department mandates the use of a component’s SAP enterprise system unless a compelling reason exists to use a non-enterprise system. The DARPA CIO must approve any performer proposal to acquire, build, and operate a non-enterprise SAP IT system during the awarded period of performance. Use of the DARPA SAP enterprise system, SAVANNAH, does not require CIO approval.

SAP IT disposition procedures must be approved in accordance with the DoD CIO Memorandum of April 20, 20201.

1 The title of this memorandum is CUI, and the memo is classified SECRET//HANDLE VIA SPECIAL ACCESS CHANNELS ONLY. This memorandum may be provided under separate cover.

Submission Instructions for both Classified and Unclassified Submissions For a proposal that includes both classified and unclassified information, the proposal may be separated into an unclassified portion and a classified portion. When a proposal includes a classified portion, and when able according to security guidelines, we ask that proposers send an unclassified e-mail to DARPA-PS-26-09@darpa.mil as notification that there is a classified portion to the proposal.

The proposal should include as much information as possible in the unclassified portion and use the classified portion ONLY for classified information. The unclassified portion can be submitted through the DARPA BAA Website, per the instructions above. The classified portion must be provided separately, according to the Classified Submissions Instructions identified herein.