Attachment_H_Classified_Submission_Requirements_Instructions_and_Procedures.docx

Attachment H Classified Submission Requirements, Instructions, and Procedures

Classified submissions (Executive Summaries, Abstracts, or Full Proposals) should NOT be submitted through DARPA's BAA Website (https://baa.darpa.mil) or Grants.gov.

Proposers submitting classified information must have, or be able to obtain prior to contract award, cognizant security agency approved facilities, information systems, and appropriately cleared/eligible personnel to perform at the classification level proposed. All proposer personnel performing Information Assurance (IA)/Cybersecurity related duties on classified Information Systems shall meet the requirements set forth in DoD Manual 8570.01-M (Information Assurance Workforce Improvement Program). Additional information on the subjects discussed in this section may be found at http://www.dcsa.mil.

Proposers choosing to submit classified information from other classified sources (i.e., sources other than DARPA) must ensure (1) they have permission from an authorized individual at the cognizant Government agency (e.g., Contracting Officer, Program Manager); (2) the proposal is marked in accordance with the source Security Classification Guide (SCG) from which the material is derived; and (3) the source SCG is submitted along with the proposal.

When submitting a hard copy of the classified portion according to the instructions outlined below, proposers should submit three (3) hard copies of the classified portion of their proposal and two (2) CD-ROMs containing the classified portion of the proposal as a single searchable Adobe PDF file. Please ensure that all CDs are well-marked. Each copy of the classified portion must be clearly labeled with #Announcement Number, proposer organization, proposal title (short title recommended), and “Copy _ of _.”

Confidential, Secret, and Top Secret Information Use transmission, classification, handling, and marking guidance provided by previously issued SCGs, the DoD Information Security Manual (DoDM 5200.01, Volumes 1 - 4), and the National Industrial Security Program Operating Manual, including the Supplement Revision 1 (DoD 5220.22-M and DoD 5200.22-M Sup. 1), when submitting Confidential, Secret, and/or Top Secret classified information.

Confidential and Secret Confidential and Secret classified information may be submitted via ONE of the two following methods to the mailing address listed in the BAA overview section under contact information:

· Hand-carried by an appropriately cleared and authorized courier to the DARPA Classified Document Registry (CDR). Prior to traveling, the courier shall contact the DARPA CDR at 703-526-4052 to coordinate arrival and delivery.

Source Selection Information – See FAR 2.101 and 3.104

1 | P a g e

OR

· Mailed via U.S. Postal Service (USPS) Registered Mail or USPS Express Mail. All classified information will be enclosed in opaque inner and outer covers and double- wrapped. The inner envelope shall be sealed and plainly marked with the assigned classification and addresses of both sender and addressee. Senders should mail to the mailing address listed in the contact information herein.

The inner envelope shall be addressed to:

Defense Advanced Research Projects Agency ATTN: DARPA/DSO Reference: – HR001126S0015 675 North Randolph Street Arlington, VA 22203-2114

The outer envelope shall be sealed with no identification as to the classification of its contents and addressed to:

Defense Advanced Research Projects Agency Security & Intelligence Directorate ATTN: CDR 675 North Randolph Street Arlington, VA 22203-2114 Top Secret Information Top Secret information must be hand-carried by an appropriately cleared and authorized courier to the DARPA CDR. Prior to traveling, the courier shall contact the DARPA CDR at 703-526- 4052 to coordinate arrival and delivery.

Sensitive Compartmented Information (SCI) SCI must be marked, managed and transmitted in accordance with DoDM 5105.21 Volumes 1 -

3. Unclassified questions regarding the transmission of SCI may be sent to the DARPA Technical Office Program Security Officer (PSO) via the BAA mailbox or by contacting the DARPA Special Security Officer (SSO) at 703-812-1970.

Successful proposers may be sponsored by DARPA for access to SCI. Sponsorship must be aligned to an existing DD Form 254 where SCI has been authorized. Questions regarding SCI sponsorship should be directed to the DARPA Personnel Security Office at 571-218-4840.

Special Access Program (SAP) Information SAP information must be marked in accordance with DoDM 5205.07 Volume 4 and transmitted by specifically approved methods which will be provided by the Technical Office PSO or their staff.

Proposers choosing to submit SAP information from an agency other than DARPA are required to provide the DARPA Technical Office PSO written permission from the source material’s cognizant Special Access Program Control Officer (SAPCO) or designated representative. For clarification regarding this process, contact the DARPA Technical Office PSO via the BAA mailbox or the DARPA SAPCO at 703-526-4432.

Additional SAP security requirements regarding facility accreditations, information security, personnel security, physical security, operations security, test security, classified transportation plans, and program protection planning may be specified in the DD Form 254.

NOTE: All proposals containing Special Access Program (SAP) information must be processed on a SAP information technology (SAP IT) system that has received an Approval-to-Operate (ATO) from the DARPA Technology Office PSO or other applicable DARPA SAP IT Authorizing Official. The SAP IT system ATO will be based upon the Risk Management Framework (RMF) process outlined in the Joint Special Access Program Implementation Guide (JSIG), current version (or successor document). (Note: A SAP IT system is any SAP IT system that requires an ATO. It can range from a single laptop/tablet up to a local and wide area networks.)

The Department of Defense mandates the use of a component’s SAP enterprise system unless a compelling reason exists to use a non-enterprise system. The DARPA Chief Information Officer (CIO) must approve any performer proposal to acquire, build, and operate a non-enterprise SAP IT system during the awarded period of performance. Use of the DARPA SAP enterprise system, SAVANNAH, does not require CIO approval.

SAP IT disposition procedures must be approved in accordance with the DoD CIO Memorandum of April 20, 2020.

Submission Instructions for both Classified and Unclassified Submissions For a proposal that includes both classified and unclassified information, the proposal may be separated into an unclassified portion and a classified portion. When a proposal includes a classified portion, and when able according to security guidelines, we ask that proposers send an unclassified e-mail to HR001126S0015@darpa.mil as notification that there is a classified portion to the proposal.

The proposal should include as much information as possible in the unclassified portion and use the classified portion ONLY for classified information. The unclassified portion can be submitted through the DARPA BAA Website, per the instructions in the BAA. The classified portion must be provided separately, according to the instructions outlined in the ‘Classified Submission Requirements, Instructions, and Procedures’ section above.