Attachment Eight (9) - CUI STORMS Task Order DD254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

SCI ADDENDUM

Contract # FA251823R0035

1. Reference Block 14: This contract requires access to Sensitive Compartmented Information (SCI). Per (list applicable DoD publications, ICDs, DCIDs, DoDM 5105.21, Volumes 1,2 3 and AFMAN 14-401, Joint DoDISS Cryptologic SCI Information Systems Standards (JDCSISSS), NISPOM Supplement, etc.) provides the necessary guidance for physical, personnel, information and information systems security measures and is part of the SCI security specifications for the contract.

Executive Order 12333 – United States Intelligence Activities (AMMENDED by EO 13470, 2008)

Executive Order 13526 – Classified National Security Information (29 Dec 09) {replaced EO 12958}

ICD 503 - Information Systems

ICD and ICPGs 704 - Personnel Security

ICD and ICS/Tech Specs 705 - Physical Security

DCID 1/20P – Security Policy Concerning Travel and Assignment of Personnel with Access to SCI

DCID 6/1 – Security Policy for Sensitive Compartmented Information and Security Policy

DCID 6/9 - Physical Security (for facilities accredited under 6/9 standards)

DoDM 5105.21 V1, V2, V3 - SCI Administrative Security Manual(s)

DoDM 5200.01 V1, V2, V3 – DoD Information Security

DoDI 5200.48 – Controlled Unclassified Information (CUI)

DoDM 5200.02 - Procedures for the DoD Personnel Security Program (PSP)

DoDM 5220.32 Volume 1 – National Industrial Security Program (NISP)

AFMAN 14-403 – Sensitive Compartmented Information Security and Intelligence, Surveillance and Reconnaissance Systems Cybersecurity and Governance

AFMAN 16-1405 – Air Force Personnel Security Program

AFMAN 16-1404 V1, V2, V3 - Air Force Information Security Program

AFMAN 16-1406 V2 - National Industrial Security Program: Industrial Security Procedures For Government Activities

DAFI 16-1403, Controlled Unclassified Information

DIAM 50-4 - Defense Intelligence Agency Manual

32 CFR Part 117

NIST 800-53 Rev 4

2. Name, organization, telephone number and address of the Contract Officer Representative (COR) for the SCI portion of this contract is:

NAME: TBD upon contract award.

PH#

email

Address

1. All DD Form 254s prepared for subcontracts involving access to SCI under this contract must be forwarded to the COR for approval and then to SSO SSFB for review and concurrence prior to award of the contract. Inquiries pertaining to classification guidance on SCI will be directed to the COR listed in para. 2 above. SCI security management issues shall be directed to SSO SSFB (Schriever SFB), 300 O’Malley Blvd, Schriever SFB, CO.

2. SCI access is subject to U.S. Government review and approval as outlined in the aforementioned SCI security guidance. Upon completion or cancellation of the contract, the SSO/CSSO will debrief all personnel not required for contract closeout and those positions will be disestablished.

3. Names of contractor personnel requiring access to SCI and justification for SCI access will be submitted for coordination and action to SSO Schriever after the COR’s approval/concurrence. Upon receipt of written approval from the COR, the Facility Security Officer (FSO) and/or Contractor Special Security Officer (CSSO) may submit the necessary forms to the Defense Counterintelligence and Security Agency (DCSA) for a Tier 5 (T5) or Tier 5 reinvestigation (T5R) for those personnel nominated for SCI in accordance with the 32 CFR Part 117.

4. The SSO/CSSO can grant access to only those who possess the necessary security clearance and who are actually providing services under the contract. Further dissemination to other contractors, sub-contractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the releasing agency.

5. SCI materials furnished in support of this contract remains the property of the DoD department or Command that released it. Upon completion or cancellation of the contract, all SCI materials furnished will be returned to the direct custody of the originator of the materials.

6. Classified foreign intelligence materials must not be released to foreign nationals or immigrant aliens whether or not they are also consultants, U.S. contractors, or employees of the contractor regardless of the level of their security clearance, except with advance written permission from the originator.

7. Contractor personnel must maintain accountability for all intelligence (to include foreign intelligence) materials released to their custody.

8. Contractor personnel must not reproduce classified foreign intelligence without advance approval of the releasing agency. If permission is granted, each copy will be controlled in the same manner as the original. The CSSO must not destroy any classified foreign intelligence without advance approval of the releasing agency.

9. A SCIF meeting the physical security requirements in DCID 6/9 or ICD 705 is required for this contracting effort. All SCI used for this contract shall be stored, handled, and maintained in an accredited SCIF, be it the local, contractor SCIF or similarly SCI accredited facilities used by the contractor. Address of the SCIF for contract execution:

23 SOPS, New Boston Space Force Station (NBSFS)

317 Chestnut Hill Rd

New Boston, NH 03070

Mr. Robert Little, robert.little.20@spaceforce.mil

21 SOPS, Det 2, Guam Tracking Station

Unit 14023

Bldg 34, Northwest Field, Andersen AFB

Yigo, GU 96929

Mr. Christopher Babuata, christopher.babauta.1@spaceforce.mil

DET 3, 21 SOPS

10 Hickam CT, UNIT 4

JBPHH, HI 96853-5208

DODAAC: 8448

21 SOPS, Det 1, Diego Garcia Tracking Station

Building 2296

96595

10. Visits. The contractor will submit the written request for SCI visit certifications through the COR for approval of the visit. The certification must arrive at SSO Schriever at least three working days prior to the visit.

11. Information assurance and electronic processing; information security (computer) and network connectivity require accreditation of the equipment connectivity.

12. Reference Block 15. This contract requires access to SCI. If the contractor has established a SCIF, DIA and its designees are responsible for all inspections of the contractor SCIF and SCI security management program for ensuring compliance with all SCI security regulations and policies. If a new SCIF must be established in accordance with this contracting effort, permission to build/accredit a SCIF must be requested through the COR and forwarded to the SSO Schriever. Special Security Officers reserve the right to conduct program reviews of AF/SF SCI materials and SCI program management to ensure the protection of AF/SF equities.

13. Contract estimated completion date: 15 October 2034

(Note: Section “F” of the contract usually provides the Period of Performance. Option years are not to be included as an option is not valid until exercised by the government. Minor modification are authorized.)

14. IF APPLICABLE – The prime contractor is responsible for preparing DD Form 254s for SCI access of their subcontractors. Completed subcontractor DD 254s are provided to the supporting SSO for review and validation. Validation consists of ensuring SCI security requirements mirror that of the Prime Contractor’s DD 254. All attachments and addendums should be part of the subcontractor’s DD 254 as well. Supporting SSO will submit the reviewed and validated DD 254 to the MAJCOM SSO (listed on the Prime Contract) for approval.

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, "DoD Contract Security Classification Specification" Hide Attachment Bar

401 O'Malley Ave. Suite 61 Schriever SFB, CO 80912 Enter location(s).: 21 SOPS, Vandenberg SFB (VSFB) 825 Washington Ave, Bldg 12006 Vandenberg, SFB CA 93437 Enter location(s).: 21 SOPS, Vandenberg Tracking Station (VTS) 1 Bishop Road, Bldg 23225 Santa Maria, CA 93437

Enter location(s).: DODAAC: 8448 21 SOPS, Det 1, Diego Garcia Tracking Station Building 2296 96595 Enter location(s).: 21 SOPS, Det 2, Guam Tracking Station Unit 14023 Bldg 34, Northwest Field, Andersen AFB Yigo, GU 96929 Enter location(s).: 21 SOPS, Det 3, Hawaii Tracking Station 10 Hickam CT, UNIT 4

JBPHH, HI 96853-5208

Enter location(s).: 23 SOPS, New Boston Space Force Station (NBSFS) 317 Chestnut Hill Rd New Boston, NH 03070 Enter location(s).: 23 SOPS, Det 1, Thule Tracking Station (TTS), Pituffik Space Base, Unit 82501, APO AE 09704-5000 Greenland Enter location(s).: 23 SOPS, Site B, Eastern Vehicle Checkout Facility (EVCF), 230 SAB Road, Bldg #49904

CCSFS, FL 32920

Enter location(s).: 23 SOPS/OL-A, Telemetry & Command Station (TCS) MOD TCS Oakhanger Bordon Hants GU35 9JE, UK

Controlled by: USSF Controlled by: SpOC SAIO/PMO CUI Category: OPSEC Distribution/Dissemination Control: FEDCON POC: Tommie Rogers (719) 567-2070

This task order requires the following security classification guidance which differs from the basic guidance. The specific classification guidance or security classification guide and date of classification guide will be used to include all revisions and changes thereto.

Ref. 10a: Access to classified COMSEC information requires a final U.S. Government clearance at the appropriate level. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires approval of the GCA. Non-accountable COMSEC information, though not tracked in the COMSEC material control system, may still require a level of control within a document control system. Refer to NSA/CSS Manual 3-16, “Control of Communications Security Material,” and the Committee on National Security Systems Instruction (CNSSI) 4001, “Controlled Cryptographic Blocks,” for guidance. If access to COMSEC information is required at Government facilities, or the material is under Government control, contractor personnel will follow the security requirements of the host government activity. AFMAN 17-1302-0, Communications Security (COMSEC) Operations, 2 Apr 20 and MPTO 00-33B-5001, AF Accounting COMSEC Procedures.

Ref 10e(1)(2): Contractor’s employees with access to SCI and Non-SCI information will be at the place(s) of work identified in the SCI addendum. Contractor material marked as “ORCON”, “PROPIN”, “NOFORN”, or “REL TO” may be released to the contractor by the contract monitor only under provision of ICD 703. The controls and definitions specified in ICD 703 are applicable to the contract. The CSSO must ensure all contractor employees who have access to this material are fully trained in the ICD 703 requirements. The CSSO must provide a list of contractor personnel who have need-to-know for this information and the contract monitor must validate need-to-know by signature before the contractor employee has access to this information. SCI Billets should be kept to a minimum. See SCI Addendum

Ref. 10h: GCA approval is required prior to subcontracting. Access requires a final U.S. Government clearance at the appropriate level. Stored FGI information will be segregated from non-FGI information.

Ref 10j: The contractor shall comply with DoDI 5200.48_DAFI16-1403, Controlled Unclassified Information, DoDM 5200.01, Vol 1_AFMAN16-1404, Vol 1, Air Force Information Security Program, and DoDM 5400.07_AFMAN33-302 Air Force Manual, DoD Freedom of Information Act (FOIA) Program. The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

Ref 10k:

SIPRNET access: The Government will provide classified SIPRNET network access to include e-mail and web browser. Contractors will be held accountable for actions they initiate on the network and will conduct business IAW DoD, USSF, and local instructions and policies.

STE access (if required): STE access is required for contract performance. Access will be controlled by the Government Contracting Activity (GCA). Contractor will follow all Operational Instructions for Secure Voice Devices.

The Contractor will require access to the government LAN to perform their contractual duties. Contractors requiring access to government(LAN) must meet the requirements contained in and all installation requirements.(Check network guidance)

Ref 11a: Releasing contractor or Government activity will furnish complete classification guidance performance on this contract. If any classified information is generated in the performance of this contract at the identified location, the contractor shall apply derivative classification and markings consistent with the source material.

Ref 11f: Overseas contractor performance will occur as a visitor group (greater than 90-days) at the following locations:

23 SOPS/OL-A, (Visitor Group) Telemetry & Command Station (TCS) MOD TCS Oakhanger Bordon Hants GU35 9JE, UK

23 SOPS, Det 1, (Visitor Group) Thule Tracking Station (TTS), Pituffik Space Base, Unit 82501, APO AE 09704-5000 Greenland

21 SOPS, Det 1, (Visitor Group) Diego Garcia Tracking Station (DGS) Diego Garcia, British Indian Ocean Territories (BIOT)

Ref 11j: The contractor shall comply with OPSEC requirements referencing AFI 10-701 Operations Security (OPSEC) and AFI 35-102 Security and Policy Review Process for guidance and/or direction. The contractor shall adhere to OPSEC guidance and be familiar with the organization’s/weapon’s system Critical Information and Indicator List (CIIL) and ensure indicators & vulnerabilities are protected from disclosure per organization’s/weapon’s system countermeasures/measures. The contractor shall complete OPSEC in-processing/initial training to include follow on OPSEC training such as event-driven and annual OPSEC training as required. OPSEC training will be provided by the respective unit OPSEC Program Manager (PM)/Planner/Coordinator. To obtain OPSEC training or ask OPSEC related questions contact the respective unit OPSEC PM/Planner/Coordinator. The USSF OPSEC PM/Planner can be reached over respective automated-information systems. The following link contains OPSEC POCs for each unit: https://intelshare.intelink.gov/sites/usspacecom-io/_layouts/15/start.aspx#/Lists/Roster/AllItems.aspx. The contractor is not responsible to develop an OPSEC plan.

Ref 11k: Go to https://www.ustranscom.mil/cmd/associated/dcd/ for Defense Courier Service points of contacts and guidance.

Ref 11l: DFARs clause 252.204-7000, DISCLOSURE OF INFORMATION (OCT 2016)

(a) The Contractor shall not release to anyone outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless—

(1) The Contracting Officer has given prior written approval;

(2) The information is otherwise in the public domain before the date of release; or

(3) The information results from or arises during the performance of a project that involves no covered defense information (as defined in the clause at DFARS 252.204-7012) and has been scoped and negotiated by the contracting activity with the contractor and research performer and determined in writing by the contracting officer to be fundamental research (which by definition cannot involve any covered defense information), in accordance with National Security Decision Directive 189, National Policy on the Transfer of Scientific, Technical and Engineering Information, in effect on the date of contract award and the Under Secretary of Defense (Acquisition, Technology, and Logistics) memoranda on Fundamental Research, dated May 24, 2010, and on Contracted Fundamental Research, dated June 26, 2008 (available at DFARS PGI 204.4).

(b) Requests for approval under paragraph (a)(1) shall identify the specific information to be released, the medium to be used, and the purpose for the release. The Contractor shall submit its request to the Contracting Officer at least 10 business days before the proposed date for release.

(c) The Contractor agrees to include a similar requirement, including this paragraph (c), in each subcontract under this contract. Subcontractors shall submit requests for authorization to release through the prime contractor to the Contracting Officer.

Block 12: Contractor is to submit requests through the GCA for OPSEC Program Manager review and public release authorization. The GCA will provide the contractor with written approval/disapproval. Information requiring AF or DoD-level review will be reviewed by the unit’s OPSEC Program Manager or Coordinator who will in-turn forward to the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690.

SBD 1/Chief Information Protection rep: BENJAMIN VALENTIN Chief, Personnel and Industrial Security rep: CARLEY I. DEMORE, MSgt, USSF Delta 6 Security Manager

See SCI Addendum.

OPSEC plan will be provided under separate cover.

Explain and identify specific areas and government activity responsible for inspections.: Defense Counterintelligence and Security Agency (DCSA) is relieved of inspection responsibility for all classified material that is released to or developed by the contractor while on a military installation. DCSA retains inspection responsibility for all non-SCI classified material released to or developed by the contractor and held in the contractor’s facility. The SSO maintains inspection responsibility for all SCI material related to this contract. Space Base Delta 1 (SBD 1) Information Protection Staff is designated as a member of the SBD 1 Inspection team and has inspection authority when assigned under SBD 1 IG. HQ USSF/A2 retains security cognizance of all Intelligence materials released to the contractor. The SSO has exclusive security responsibility for SCI classified material released or developed under this contract and held within the contractor’s SCIF. The SSO has exclusive security responsibility for SCI classified material released or developed under this contract and held within the contractor’s SCIF.

Defense Intelligence Agency (DIA) has exclusive security responsibility for Sensitive Compartmentalized information (SCI) classified material released or developed under this contract and held within the contractor’s SCIF. The SSO maintains inspection responsibility for all SCI material related to this contract.

210 Falcon Parkway Ste 265 Schriever SFB, CO 80912 Enter address (include zip code).: 210 Falcon Parkway Schriever SFB, CO 80924