Attachment C Draft DD 254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

Attachment 1 to DD Form 254 Contract: GS00Q14OADU122/47QFPA19F0060

Contract Expiration Date: 31 January 2025

RELEASE OF SENSITIVE COMPARTMENTED INFORMATION INTELLIGENCE

INFORMATION TO US CONTRACTORS

a. All sensitive compartmented information (SCI) and material will be handled in accordance with special security requirements furnished by the responsible Special Security Office (SSO) HQ PACAF/A2S.

b. SCI material will not be released to contractor employees without specific release approval of the HQ PACAF/A2S and Program Manager, or from the originator the material when applicable. Authorization must be obtained through HQ PACAF/A2S based on prior approval and certification of “Need-to-Know” by the designated Program Manager/Contract Monitor listed below:

Mr. David Pena

HQ PACAF/A2Y

Chief, ISR Systems Enterprise Division C5ISRO Program Manager/Contracting Officer’s Representative

DSN: 315-449-4455 / COMM: 808-449-4455

NIPR: david.pena.3@us.af.mil SIPR: david.pena3.civ@mail.smil.mil JWICS: david.pena@af.ic.gov

c. Inquiries pertaining to classification guidance of SCI will be directed to the responsible HQ PACAF/A2S and/or Program Manager. Any SCI or SCI derived material generated under this contract will be reviewed by the Program Manager with the assistance of the SSO, if necessary, for proper classification prior to final publication and distribution.

d. Upon completion of this contract all SCI material provided to or generated by the contractor will be turned over to HQ PACAF/A2S. If the material has been superseded or is no longer applicable, the local flight chiefs will proceed with approved/appropriate disposition/destruction based upon HQ PACAF/A2S guidance.

e. SCI material furnished is support of this contract remains the property of the DoD department, agency, or command that releases it.

f. Contractors receiving SCI material will not release such to any activity, individual or consultant organization not directly engaged in providing services under this contract without the proper consent of the Government Program Manager, which shall verify the “need-to-know” basis.

g. Contractors or consultants will not reproduce any SCI without the permission of the

Government Program Manager. Such material will be classified, safeguarded, controlled, and accounted for in the same manner as the originals.

Attachment 1 to DD Form 254 Contract: GS00Q14OADU122/47QFPA19F0060

Contract Expiration Date: 31 January 2025

h. SCI will not be released to non-U.S. citizens whether or not they are also consultants, United States contractors, or employees thereof, regardless of the level of their security clearance.

OPERATION SECURITY (OPSEC) ADDENDUM

1. This section outlines the requirements and procedures necessary for contractors to provide Operations Security (OPSEC) protection for PACAF's critical information.

2. OPSEC is an information-related capability that preserves friendly essential secrecy by process to identify, control, and protect critical information and indicators:

a. Identify those actions that can be observed by adversary intelligence systems.

b. Determine what indicators adversary intelligence systems might obtain that could be interpret or pieced together to derive critical information in time to be useful to adversaries.

c. Select and execute countermeasures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

3. OPSEC principles are used to help assigned personnel:

a. Maintain a continuing awareness of adversary interest in SOF actions and adversary intelligence collection capabilities.

b. To understand the need to identify and protect classified and unclassified indicators that reveal sensitive information.

c. To evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

4. Objectives are to:

a. Protect planned operational activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

b. To preserve secrecy concerning specific scenario events and a PACAF response to these events.

c. To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. PACAF employed contractors will be provided unit-specific OPSEC education training by the assigned OPSEC Signature Manager on the unit/directorate's OPSEC requirements before being given full access to or around a PACAF installation, organization, facility or information, but not more than 30 days prior to initial access. Individual training will be developed and applied as required by the level of contact with PACAF critical information.

6. The contractor shall provide operation security (OPSEC) protection for all sensitive and/or critical information as defined by DoD 5205.2 and the Air Force Instruction (AFI) 10-701 and all applicable supplements.

7. The contractor shall describe the steps necessary to protect sensitive and/or critical information. The OPSEC Program Manager will evaluate the OPSEC posture of the contract activities and operations.

8. The contractor is required to follow the provisions of the organizations pre-existing OPSEC Plan. A copy of the plan (or relevant portions thereof) and the approved Critical Information List (CIL) will be provided to assigned contractors upon in-processing so that the contractor is aware of the critical information to be protected and the OPSEC measures expected during contract performance.

9. In the event the Government agency does not require compliance with a tailored written OPSEC plan, these OPSEC measures have been prescribed:

a. Annual contractor employee OPSEC awareness briefings

b. Approval of all press releases via proper government channel prior to release.

c. Shredding of paper waste that contain critical information or may be indicators thereof

d. Report/notification of any newly identified critical information, change in personnel or environmental threat or vulnerability to government agency.

10. DoD Contractors will not be appointed as primary or alternate OPSEC Program Managers;

however, they may be appointed as OPSEC analysts and OPSEC coordinators as long a government oversight is maintained.

11. Additional guidance and discussion of OPSEC contents may be found on the Air Force OPSEC SharePoint Site https://cs2.eis.af.mil/sites/10054/default.aspx https://cs2.eis.af.mil/sites/10054/default.aspx

RELEASE OF NON-SENSITIVE COMPARTMENTED INFORMATION (NON-SCI) INTELLIGENCE

INFORMATION TO US CONTRACTORS

1. Requirements for access to non-SCI:

a. All intelligence material released to the contractor remains the property of the U.S. Government and may be withdrawn at any time. Contractors must maintain accountability for all classified intelligence released into their custody.

b. The contractor must not reproduce intelligence material without the written permission of the originating agency through the Government Program/Project Manager to the Intelligence Support Office.

If permission is granted, each copy shall be controlled in the same manner as the original.

c. The contractor must not destroy any intelligence material without advance approval or as specified by the Government Program/Project Manager. (EXCEPTION: Classified waste shall be destroyed as soon as practicable in accordance with the provisions of the Industrial Security Program).

d. The contractor must restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract with a valid need to know. Further dissemination to other contractors, subcontractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the originating agency through the Government Program/Project Manager.

e. The contractor must ensure each employee having access to intelligence material is fully aware of the special security requirements for this material and shall maintain records in a manner that will permit the contractor to furnish, on demand, the names of individuals who have had access to this material in their custody.

f. Intelligence material must not be released to foreign nationals or immigrant aliens whether they are consultants, US contractors, or employees of the contractor and regardless of the level of their security clearance, except with advance written permission from the originator. Requests for release to foreign nationals shall be initially forwarded to the Government Program/Project Manager and shall include:

(1) A copy of the proposed disclosure.

(2) Full justification reflecting the benefits to US interests.

(3) Name, nationality, particulars of clearance, and current access authorization of each proposed foreign national recipient.

g. Upon completion or termination of the classified contract, or sooner when the purpose of the release has been served, the contractor will return all classified intelligence (furnished or generated) to the source from which received unless retention or other disposition instructions (see AFMAN 37-139) are authorized in writing by the Government Program/Project Manager.

h. The contractor must designate an individual who is working on the contract as custodian. The designated custodian shall be responsible for receipting and accounting for all classified intelligence material received under this contract. This does not mean that the custodian must personally sign for all classified material. The inner wrapper of all classified material dispatched should be marked for the attention of a designated custodian and must not be opened by anyone not working directly on the contract.

i. Within 30 days after the final product is received and accepted by the procuring agency, classified intelligence materials released to or generated by the contractor, must be returned to the originating agency through the Government Program/Project Manager unless written instructions authorizing destruction or retention are issued. Requests to retain material shall be directed to the Government Program/Project Manager for this contract in writing and must clearly indicate the justification for retention and identity of the specific documents to be retained.

j. Classification, regrading, or declassification markings of documentation produced by the contractor shall be consistent with that applied to the information from which the new document was prepared. If a compilation of information or a complete analysis of a subject appears to require a security classification other than that of the source documentation, the contractor shall assign the tentative security classification and request instructions from the Government Program/Project Manager. Pending final determination, the material shall be safeguarded as required for its assigned or proposed classification, whichever is higher, until the classification is changed or otherwise verified.

2. Intelligence material carries special markings. The following is a list of the authorized control markings of intelligence material:

“Dissemination and Extraction of Information Controlled by Originator (ORCON).” This marking is used, with a security classification, to enable a continuing knowledge and supervision by the originator of the use made of the information involved. This marking may be used on intelligence which clearly identifies, or would reasonably permit ready identification of an intelligence source or method which is particularly susceptible to countermeasures that would nullify or measurably reduce its effectiveness. This marking may not be used when an item or information will reasonably be protected by use of other markings specified herein, or by the application of the “need-to-know” principle and the safeguarding procedures of the security classification system.

“Authorized for Release to (Name of Country(ies)/International Organization).” This is abbreviated “REL _____.” This marking must be used when it is necessary to identify classified intelligence material the US government originator has predetermined to be releasable or has been released through established foreign disclosure channels to the indicated country(ies) or organization.

3. The following procedures govern the use of control markings.

a. Any recipient desiring to use intelligence in a manner contrary to restrictions established by the control marking set forth above shall obtain the advance permission of the originating agency through the Government Program/Project Manager. Such permission applies only to the specific purposes agreed to by the originator and does not automatically apply to all recipients. Originators shall ensure that prompt consideration is given to recipients’ requests in these regards, with particular attention to reviewing and editing, if necessary, sanitized or paraphrased versions to derive a text suitable for release subject to lesser or no control markings.

b. The control marking authorized above shall be shown on the title page, front cover and other applicable pages of documents, incorporated in the text of electrical communications, shown on graphics, and associated (in full or abbreviated form) with data stored or processed in automatic data processing systems. The control marking also shall be indicated by the parenthetical use of the marking abbreviations at the beginning or end of the appropriate portions. If the control marking applies to several or all portions, the document must be marked with a statement to this effect rather than marking each portion individually.

c. The control markings shall be individually assigned at the time of preparation of intelligence products and used in conjunction with security classifications and other marking specified by the E.O. 12958 and its implementing security directive. The marking shall be carried forward to any new format in which the same information is incorporated including oral and visual presentations.

d. Request for release of intelligence material to a contractor must be prepared by the Government Program/Project Manager and submitted to the Intelligence Support Office. This should be accomplished as soon as possible after the contract has been awarded. The request will be prepared and accompanied with a letter explaining the requirements and copies of the DD Form 254 and Statement of Work.

CONTROLLED UNCLASSIFIED INFORMATION ADDENDUM

General: There are types of information that are not classified but require application of access and distribution controls and protective measures developed for DoD Controlled Unclassified Information for a variety of reasons. The types of CUI identified for the program are For Official Use Only (FOUO), Law Enforcement Sensitive (LES), DoD Unclassified Controlled Nuclear Information (DoD UCNI), and LIMITED DISTRIBUTION as well as some of those developed by other Executive Branch agencies of the U.S. Government and technical data described below as well as protective measures for CUI material.

For Official Use Only (FOUO) Information Description: Is a Government protective marking/caveat designation applied to unclassified information that may be exempt from mandatory release to the public because of foreseeable harm to an interest protected by the Freedom of Information Act (FOIA), as implemented by DoD 5400.7-R and/or the Privacy Act of 1974, as amended.

Law Enforcement Sensitive (LES): A marking sometimes applied, in addition to the marking “FOR OFFICIAL USE ONLY,” by the Department of Justice and other activities in the law enforcement community, including those within the Department of Defense to denote that the information was compiled for law enforcement purposes and should be afforded security in order to protect certain legitimate government interests. Procedures can be found in DoDM 5200.01-V4, Enclosure 3.

DoD Unclassified Controlled Nuclear Information (DoD UCNI): Unclassified information on security measures (including security plans, procedures, and equipment) for the physical protection of DoD Special Nuclear Material (SNM), SNM equipment, SNM facilities, or nuclear weapons in DoD custody.

Information is designated DoD UCNI in accordance with DoDD 5210.83.

LIMITED DISTRIBUTION: Caveat used by the National Geospatial-Intelligence Agency (NGA) to identify a select group of sensitive, unclassified imagery or geospatial information and data created or distributed by NGA or information, data, and products derived from such information. DoDI 5030.59 contains details of policies and procedures.

Technical Data Description: Any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process, or can be used to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media (e.g., computer software, drawings, photographs, etc.), text in specifications, related performance or design documents, or computer printouts. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, related information, and computer software documentation. The DoD Scientific and Technical Information Program (see DoDI 3200.12.).

CUI Markings: Prescribed marking of CUI documents will be in accordance with DoDM 5200.01-Vol 4.

CUI may also be identified in security classification guides to ensure the information receives appropriate protection.

Access: CUI may be released to an individual who has a valid need for such access within the scope of their assigned duties, furthering the accomplishment of a lawful and authorized government purpose and would not be detrimental to the interests of the DoD or U.S. Government. Information in any media format will be disseminated on a need-to-know basis. This restricts the use or dissemination of CUI data to those with direct affiliation with the given program/project to conduct official business for the DoD, provided that dissemination is consistent with any further controls imposed by a distribution statement. Personnel no longer requiring access to CUI must surrender any information in their possession to the program lead, who will take action to terminate further access.

Storing and Handling: During working hours, take reasonable steps to minimize the risk of access to CUI by unauthorized personnel (e.g., not reading, discussing, leaving FOUO information unattended where unauthorized personnel are present or display CUI in public places to include the internet). After working hours, store CUI information in locked desks, file cabinets, bookcases, locked rooms, locked/controlled e-files or similar means to prevent theft of program information. Computers used to process CUI do not need to be accredited for classified use. Do not process CUI on public computers (e.g., those available to the public in kiosks, hotels, café’s, etc.) or computers that do not have Public Key Infrastructure (PKI) access controls. Personally owned computers are not authorized to process CUI.

Authorized electronic devices provided by the government agency (e.g., laptops, cell phone) used to store CUI must be physically protected and use NIST/NIAP-approved cryptographic products, e.g., DoD approved PKI Certification available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/, which require encryption passcodes to teleconferences/web conferences where CUI may be discussed.

Dissemination: CUI printed documents and material may be transmitted through mail channels or hand-carried without formal courier orders. CUI information may be disseminated to DoD personnel and DoD contractors to conduct official business for the program. If dissemination is required outside of DoD channels contact the program lead, contracting officer, and security manager for approval. Release of technical data will follow the release instructions identified in the distribution statement. Use secure communications whenever available for discussions involving CUI. Send voice and facsimile transmissions only when authorized recipients have acknowledged positive control measures are in place to receive the information.

Destruction: CUI documents shall be disposed of according to provisions of EO 13556, CUI; DoDM

5200.01 Vol 4, DoD Information Security Program CUI; AFI 33-332. Component records management directives. Non-record FOUO documents may be destroyed by any methods that prevents compromise, e.g., tearing, burning, or shredding of the means approved for the destruction of classified information or by any other means that would make it difficult to recognize or reconstruct the information.

Reporting: Report any loss or unauthorized attempt to gain access to CUI information to the organization’s security manager immediately, but no later than the end of the first duty day. If additional information is required after initial notification, guidance will be provided at that time.

Ref Item 10a & 11h: The contractor is governed by NSACSS Policy Manual 3-16, dated August 2005, in the control and protection of COMSEC Material/Information. Access to COMSEC material by personnel is restricted to U.S. citizens holding final U.S. Government clearances. Such information is not releasable to personnel holding only reciprocal clearances.

Ref Item 10e & 11e: Cleared personnel are required to perform this service because Contract is for engineering and technical services, including equipment maintenance services on equipment which processes classified information. Cleared personnel are required to perform this service because access to classified information cannot be precluded by escorting personnel. Any classification guidance needed will be provided Contracting Officer's Representative (COR). Knowledge of the generation/handling of intelligence information is required in the performance of this contract. Contractor will require access to and comply with AFI 14-303. Release of intelligence information does not create an unfair competitive advantage for the contractor or a conflict of interest with the contractor’s obligation to protect the information. Contractors will require access to SCI at the locations listed in item 8a.

Ref Item 10j: For Official Use Only (FOUO) information provided under this contract shall be safeguarded as specified in DoD 5200.1-R information Security Program, Appendix 3, Controlled Unclassified Information.

Ref item 11c: The contractor requires access to classified source data up to and including TOP SECRET SCI in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and marking consistent with the source documents. The use of “multiple Sources” in identifying the source of derivative information necessitates compliance with NISPOM, paragraph 4-208a and the use of a bibliography.

Ref Item 11j: Contractor will require access to AFPD 10-11, Operations Security, AFI 10-1101, Operations Security and DoD 5205-2, DoD Operations Security Program. The contractor will be provided critical information under separate cover. Contractors’ personnel will participate in the OPSEC program locally administered by the AF activity when operating on an AF installation.

Ref Item 13: Security classification guidance set forth in the Joint Worldwide Intelligence Communications Systems (JWICS) Security Classification Guide, version 1.0, dated 29 June 2012 or as revised.

Attachment 2 DD Form 254 Addendum

FOR OFFICIAL USE ONLY (FOUO) ADDENDUM

Ref Item 10j Continued:

The following procedures will be used to protect FOUO material:

1. HANDLING: Access to FOUO material shall be limited to those employees needing the material to do their jobs.

The FOUO marking is assigned to material created by a DoD user agency. FOUO is not a classification, but requires extra precaution to insure it is not released to the public.

2. MARKING: Mark unclassified documents containing FOUO; “FOR OFFICIAL USE ONLY” at the bottom of each page and back cover (if any). In a classified document, mark:

a. An individual paragraph that contains FOUO, but not classified material, by placing “(FOUO)” at the beginning of the paragraph.

b. The top and bottom of each page that has both FOUO and classified material with the highest security of classified of the material on that page.

c. Place “FOUO” at the bottom of each page that has FOUO but not classified material.

d. If a classified document also contains FOUO material or if the classified material becomes FOUO when declassified, place the following statement on the bottom of the cove or on the first page under the classification marking:

“NOTE: if declassified, review the document to make sure material in not FOUO and not exempt under AFI 33-332 before public release.”

e. Mark other records such as computer print outs, photographs, films, tapes, or slides “FOR OFFICIAL USE ONLY” so the receiver or viewer knows the record contains FOUO material.

f. Mark each part of the message that contains FOUO material. Unclassified messages containing FOUO material must show the abbreviation “FOUO” before the text begins.

g. Insure documents that transmit FOUO material call attention to any FOUO attachments.

h. FOUO material released to a contractor by a DoD user agency must have the following statement on the Front page or cover: “THIS DOCUMENT CONTAINS MATERIAL EXEMPT FROM MANDATORY

DISCLOSURE UNDER THE FREEDOM OF INFORMATION ACT. EXEMPTION(S) ______ APPLY.”

3. STORAGE: During normal duty hours, please FOUO material in an out-of-sight location, if your work area is accessible to persons who do not have a valid need for the material. After normal duty hours, store FOUO material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided. When there is not internal security, locked buildings, or rooms usually provide adequate after-hours protection. For additional protection, store FOUO material in a locked container such as file cabinets, desks, or bookcases. Expenditure of funds for security containers or closed areas solely for the protection of FOUO material is prohibited.

4. TRANSMISSION: FOUO material shall be transmitted by the same method as other unclassified material.

Discussion of FOUO material on the telephone is authorized if necessary for the performance of the contract. FOUO material may be transmitted over telephone lines in digital form, by telecopy, or by other DSN teletype lines without encryption.

5. RELEASE: FOUO material shall not be released outside the contractor’s facility except to representatives of the DoD.

Attachment 3

INTELLIGENCE SECURITY ADDENDUM

6. DESTRUCTION: When no longer needed, FOUO material shall be disposed of by a method that precludes its disclosure to unauthorized individuals.

Ref Item 10e (1):

1. Contractor will require access to AFPD 14-3, AFI-14-302, AFI 14-303, DoDM 5220.22, AFMAN 14-304, DoDM 5105.21 v1-3, ICD 503, ICD 704, and ICD 705 which provide the necessary guidance for Physical, Personnel, Industrial, Information and Information System security measures and is part of the Sensitive Compartmented Information (SCI) security specification for the contract. See item 13 Release of Intelligence Information to US Contractors for additional security requirements. Prior approval of the contracting activity is required for subcontracting. Access to intelligence information requires special briefings and a US Government clearance at the appropriate level. Release of intelligence information does not create an unfair competitive advantage for the contractor, or a conflict of interest with the contractor’s obligation to protect the information. If, during the course of the contract the contractor’s requirements for information changes to require new or significantly different information, a revision of the DoD Form 254 must be submitted. In cases where issues of unfair competitive advantage or conflict of interest are unresolved, consent of the originator is required.

2. The contractor must have SCI indoctrinated personnel available to work the contract, and the designated government Contract Monitor (CM) or Contracting Officer Representative (COR) must also be assigned an SCI position. Names of contractor personnel requiring access to SCI and justification for SCI positions will be submitted for coordination and action to PACAF/A2SO through the COR. Upon receipt of written approval from the COR, the Contractor Special Security Officer (CSSO) may submit the necessary forms to the Defense Security Service (DSS) for a Single Background Investigation (SSBI) for those personnel nominated for SCI access in accordance with the National Industrial Security Program Operating Manual (NISPOM).

3. SCI access is subject to US Government review and approval as outlined in the aforementioned SCI security regulations. Upon completion or cancellation of the contract, the CSSO will debrief all personnel not required for contract closeout and those positions will be disestablished.

4. A SCI Facility (SCIF) meeting the physical security requirements outlined in ICD 705 must be used for contract work or established and maintained at the contractor’s location. All SCI used for this contract shall be stored, handled and maintained in a SCIF, be it the local contractor SCIF or similarly SCI-accredited facilities used by the contractor. Unescorted access to SCIFs and local transmissions/handling (courier) authorizations will be approved at the discretion of the local SSO. The SCIFs used for the contract execution are listed in a separate memorandum and/or database maintained by the CSSO and will be furnished to the SSO upon request.

5. For contractor work within a contractor established SCIF, information systems, electronic connectivity and similar electronic methods of storing and communicating within and outside the SCIF must be in compliance with ICD 503 and any additional instructions issued by DIA/DAC-2A and PACAF/A2S.

Ref Item 10e(2): Contractor will require access to AFPD 14-3, AFI-14-302, AFI 14-303 and DoDM 5105.21 v1-3 and DoDM 5220.22. See item 13 Release of Intelligence Information to US Contractors for additional security requirements. Prior approval of the contracting activity is required for subcontracting. Access to intelligence information requires special briefings and a US Government clearance at the appropriate level. Release of intelligence information does not create an unfair competitive advantage for the contractor, or a conflict of interest with the contractor’s obligation to protect the information. If, during the course of the contract the contractor’s requirements for information changes to require new or significantly different information, a revision of the DD Form 254 must be submitted. In cases where issues of unfair competitive advantage or conflict of interest are unresolved, consent of the originator is required.

INTELLIGENCE SECURITY ADDENDUM (Cont)

Ref Item 12: Public release of intelligence information is not authorized.

Ref Item 13: Visitor Group Security Agreements (VGSA): The contractor, prior to beginning operations involving classified information on an Air Force installation, shall enter into a VGSA with the installation commander to ensure that the contractor’s security procedures are properly integrated with those of the installation.

This requirement also applies to subcontractors, if parts of this contract are subsequently subcontracted. As an alternative, if the subcontractor is performing services in support of the same on-base classified contract as the prime contractors, the execution of a VGSA can be satisfied by the acknowledging review and understanding of the security requirements identified in the prime contractor’s executed VGSA. The VGSA is normally only required for groups visiting 90 days or more consecutively. Individual installations may have their own guidelines for this requirement.

Security Classification Guidance: Security classification guidance will be provided by the USAF Program/Project Manager under a separate cover. Inquiries pertaining to classification guidance on SCI and non-SCI intelligence will be directed to the COR listed in item 13, Release of Intelligence Information to US Contractors, below.

SCI Release of Intelligence Information to US Contractors:

1. Authority: PACAF/A2 is the Senior Intelligence Officer (SIO) for all contracts issued by the Contracting Office, JBPH-H, Hawaii, requiring access to intelligence information. The SIO, or originator of the material, is authorized to approve the release of intelligence information to US contractors. No Government official shall authorize contractor use of intelligence materials or the release to subcontractors without express authority from the SIO (or his/her designee) or the originator. Intelligence information will not be released to contractor employees without the specific release approval of the SIO (or his/her designee) or originator of the materials as outlined in the governing directives and based on prior approval and certification of “need-to-know” by the Contracting Officer’s Representative (COR). A listing of all CORs is listed in a separate memorandum and/or database maintained by the FSO/CSSO or Program Office and will be furnished to the SIO (or his/her designee) upon request.

2. Access: The CSSO/FSO must restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the releasing agency.

3. Release of Intelligence Information to US Contractors: Specific procedures for release of intelligence information are outlined in AFI 14-303. All intelligence released must be under the US Government representative’s control and supervision. The US Government representative must access each document prior to contractor review to confirm classification of each document. All information released to the contractor must be released to fulfill or be in accordance with contractual obligations and DD Form 254 requirements. The AF Form 310 is used to request the release of specific intelligence information. The contractor prepares the AF Form 310 and submits it to the SIO (or his/her designee), through the Contracting Monitor (CM), for approval to release the requested information.

4. Electronic Intelligence Databases/networks: The COR, USAF Program/Project Manager or CM will determine the contractor’s need for access to electronic intelligence databases/networks and comply with the local procedures for providing this access. Access should be limited to those authorized individuals integral into government/military organizations using intelligence databases/networks. US Government Information System Security Officers/Information Assurance Officers are responsible for verifying an individual’s “need-to-know” and for ensuring stringent control is exercised. Any information obtained via electronic means will be recorded and controlled in accordance with procedures established by the US Government representative. The US Government representative must access each document prior to contactor review to confirm the classification of each document.

Each document must be identified in the AF Form 210 and processed IAW the release procedures listed in para 3 above.

5. Derivative Classifications: Derivative intelligence information is the intelligence that has been extracted out of an intelligence document and incorporated into a briefing, information report, working papers, products to be delivered to the government in some form, or used in performance of the contract for the program office. The resultant product requires the overall highest classification of information placed on the product. Use the appropriate Security Classification Guide when deriving new products. Dissemination of derivative intelligence information will be for COR and contract use only. Derivative intelligence information will not be transferred from one contract to another without COR approval. Access will be restricted to only those individuals who possess the necessary security clearance and are actually providing services under the contract. Further dissemination to other contractors, subcontractors, consultants and private individuals or organizations is prohibited and a prosecutable offense.

6. Accountability: Intelligence materials furnished in support of this contract remains the property of the DoD department or command that released it. The contractor must maintain accountability for all foreign intelligence materials released to their custody. Upon completion or cancellation of the contract, all intelligence materials furnished will be returned to the direct custody of the originator of the materials. The contractor will provide the USAF Program/Project Manager or CM, within 30 days after completion of the contract, a complete list of all intelligence materials furnished, or generated by, the contractor during the contract period. Both the Program/Contract Manager and contractor are responsible for maintaining a record of all intelligence data (to include information obtained from electronic intelligence databases/networks) released under each specific contract.

This record must be furnished to the SIO upon request.

7. Foreign Intelligence Information: The CSSO/FSO must maintain accountability for all foreign intelligence materials released to their custody. Foreign intelligence materials must not be released to foreign nationals or immigrant aliens whether or not they are also consultants, US contractors, or employees of the contractor, regardless of the level of their security clearance, except with the advanced written permission from the originator.

8. Reproduction: Reproduction of intelligence information (to include foreign intelligence) is prohibited without the approval of the releasing agency or SIO (or his/her designee), through the CM. If permission is granted, each copy will be controlled in the same manner as the original. All reproduction and extractions of intelligence shall be classified, marked, controlled and protected in the same manner as the original 9s) and it will remain the property of the US Government.

9. Destruction: Destruction of intelligence information (to include foreign intelligence) is prohibited without advanced approval of the releasing agency or SIO (or his/her designee), through the CM. Working papers and derivative material produced in the publication process do not need destruction approval.

10. Release of Classified and Unclassified Information to Foreign Owned Companies and their Representatives:

Upon receipt of a request from a foreign owned company, or a representative thereof, for intelligence data about this program, immediately forward the request to the servicing Foreign Disclosure Office.

Training: At locations where the contractor is deemed a “long term” or “integrated” visitor group, the contractor shall participate in that location’s security awareness and education program as administered by the servicing SSO IAW AFI 31-401, Chapter 8 and AFI 31-601, para 3.1.4. At all other locations, the FSO/CSSO will administer and document completion of this training. Documentation must be furnished to the SIO (or his/her designee) upon request. IAW AFMAN 14-304, para 12.3, SCI Security Awareness training must be accomplished on a quarterly basis.

Ref Item 15:

1. PACAF/SSO has exclusive security responsibility for all SCI material released to or developed under this contract and held within the contractor’s SCIF. DSS is relieved of security inspection responsibility for all such material but retains responsibility for all non-SCI classified material released to or developed under this contract and held within the contractor’s SCIF.

2. The accrediting authority activity, or their representative, shall be responsible for reviewing all of the contractor’s SCIF documentation to ensure compliance with SCI directives or regulations. In addition, if the contractor has established a SCIF, the DIA and its designees (PACAF SSO or its representatives) are responsible for all inspections of the contractor SCIF and SCI security management program for ensuring compliance with all SCI security regulations and policies.

3. The SSA has industrial security review authority for all non-SCI contracts on Air Force installations. Contractor will comply with the VGSA provided by the USAF Program/Project Manager when operating on an Air Force installation.

CONTAINS PRIVACY ACT INFORMATION, PROTECT IAW THE PRIVACY ACT OF 1974

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification Hide Attachment Bar

See Block #13 for locations

Alexandria Field Office dss.alexandria3@mail.mil

(571) 551-7960 CSO: Defense Security Service San Diego Field Office dss.san-diego-field-office@mail.mil

(858) 207-0170

See Block #13 for more locations

Joint Base Pearl Harbor Hickam, HI 96853

Item 10e2: Non-SCI information provided under this contract shall be handled and safeguarded as specified in the "Non-SCI Addendum".

Item 10f: SAP information under this contract falls under the cognizance of PACAF A8XZ and shall be safeguarded as specified in the "SAP Addendum" as applicable.

Item 10j and 11l: CUI information provided under this contract shall be safeguarded as specified in the "CUI Addendum".

Item 10k: FOUO information provided under this contract shall be safeguarded as…