Attachment J-08 REDACTED-WOI Signed - DD 254.pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

TOP SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYYYMMDD)

2020/04/21

b. SUBCONTRACT NUMBER b. REVISED (Supersedes all previous specs)

Revision No. Date (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYYYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYYYMMDD)

HQ0858-20-R-0011

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the Contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Warfighter Operational Integration Support

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify)

k. OTHER Specify) Additional Requirements for Contractor’s

Unclassified Automated Information Systems

DD Form 254, DEC 1999 Previous editions are obsolete

Approved for Public Release 20-MDA-10566 (9 Sep 20)

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial

Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct Through (Specify):

Missile Defense Agency/DW Bldg. 5222 Martin Road

Redstone Arsenal, AL 35898 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the Contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

The Contractor is required to flow-down all applicable requirements of the DD Form 254 to its Subcontractor(s).

Direct all questions pertaining to the DD Form 254 to the MDA Industrial Security office by phone at (256) 450-

0939, by email at MDAIndustrialSecurity@mda.mil, or by mail to MDA, ATTN: Industrial Security Office (EIR), Building 5222 Martin Road, Redstone Arsenal, AL 35898.

See Continuation Pages (3-9)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No

See Reference Items; 10.e.(1), 10.f, 10.j, and 11.j.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

Nasu R. Bethea

b. TITLE

Assistant Director, Research, Development and Acquisition Security

c. TELEPHONE (Include Area Code)

(256) 955-1908

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

Missile Defense Agency a. CONTRACTOR

Bldg. 5222 Martin Road b. SUBCONTRACTOR

Redstone Arsenal, AL 35898 c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

BETHEA.NASU.R.1 Digitally signed by

BETHEA.NASU.R.1251902620

251902620 Date: 2020.04.23 09:05:24 -05'00'

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY MDA Industrial Security

DD Form 254 Reverse, DEC 1999

Approved for Public Release mailto:MDAIndustrialSecurity@mda.mil

HQ0858-20-R-0011

SECURITY GUIDANCE (BLOCK 13) CONTINUATION PAGES:

Special Requirements:

The Contractor shall provide the following to the MDA Industrial Security Office (contact information listed in block 13 of page two of the DD Form 254):

Provide a copy to the MDA Industrial Security Office of any security incident report (initial and final) involving the loss, compromise, or suspected compromise of classified information sent to the Defense Counterintelligence and Security Agency. The Contractor shall provide a complete copy of the report (without redaction) to the MDA within the same reporting timeframe as is required by the Defense Counterintelligence and Security Agency (72 hours for Secret/Confidential and 24 hours for Top Secret)

Provide a complete copy of the report (without redaction) to the MDA Industrial Security

Office of any report involving a cyber-intrusion of MDA program information sent to the

Federal Bureau of Investigation and the Defense Counterintelligence and Security Agency per NISPOM Chapter 1, Section 301 and Industrial Security Letter 2013-05.

Provide a complete copy of the report (without redaction) to the MDA Industrial Security

Office of any Defense Counterintelligence and Security Agency letter that indicates a less than satisfactory security rating and/or that negatively impacts the Facility Clearance Level

(FCL) of the company within 48-hours of receipt.

Provide electronic copies of Subcontractor DD Form 254s issued by the Prime and the

Subcontractor. The Prime Contractor shall act as the focal point for collecting their

Subcontractor’s DD Form 254s and the Prime is responsible for forwarding these DD Form

254s to the MDA Industrial Security Office.

Contractors sending classified mail shall actively (daily) track each classified package(s) throughout the entire transit process until the shipment is confirmed as received by the intended organization. The sender should monitor the transit process via the mail carrier's tracking process. If the last transit status entry on the mail carrier's tracking website was made more than one business day after the estimated delivery date, the sender will notify and provide the relevant details to their Facility Security Officer and the Missile Defense Agency in accordance with DD254 requirements.

Information transported externally to a cleared facility shall be encrypted. The encryption of all MDA Controlled UNCLASSIFIED and CLASSIFIED removable media while in transit via authorized means of transmission including Couriers, Hand Carriers, and Escorts; the

United States Postal Service (USPS); or other mail services (e.g., Federal Express, United

Parcel Service, etc.). Contract direction shall incorporate the following tenants: All removable media (Hard Disk Drive (HDD), optical disk, Flash Media (USB HDD),Solid-state Drives (SDD), etc.) shall utilize data-at-rest (DAR) encryption:

- Classified data shall be encrypted using a FIPS 140-2 validated technology.

- Unclassified data to include Personal Identifiable Information (PII)/ For Official

Use Only(FOUO)/ Covered Defense Information (CDl)/Controlled Unclassified

Information (CUI)/ Unclassified Controlled Technical Information (UCTI) shall use at least a FIPS 140-2 compliant technology, validated is recommended.

- Operating system, software, and hardware updates do not require encryption.

Any waiver requests for this requirement must be made by the contractor to the responsible

Contracting Officer for approval consideration.

In accordance with NISPOM Chapter 1, Section 300, the Contractor and its subcontractors shall notify the Contracting Officer, the Contracting Officer’s Representative, and MDA Industrial

Security in writing within 24 hours of becoming aware of adverse information regarding an employee, who works within a Government/MDA facility, which could affect their access to classified information.

Subcontractor Classified Access Approvals:

The Prime Contractor and Subcontractor are authorized to flow access to and/or dissemination of classified information to the TOP SECRET level to their Subcontractor. Dissemination is only authorized and applicable for information safeguarded at the Contractor’s facility. This authorization includes access to Communications Security (COMSEC) (NISPOM Chapter 9, Section 407), Critical Nuclear Weapon Design Information (CNWDI) (NISPOM Chapter 9, Section 204), Non-Sensitive Compartmented Information (SCI) (NISPOM Chapter 9, Section

300) and North Atlantic Treaty Organization (NATO) (NISPOM Chapter 10, Section 708) information. The Contractor shall provide the appropriate accesses to its Subcontractors as required per NISPOM 5-502. The Prime Contractor and Subcontractor must verify Facility

Clearance, Safeguarding Capability and Access Authorizations prior to the dissemination of classified information. The following require specific authority: SCI - not authorized to flow without prior approval from MDA/Special Security (refer to SCI Supplement) and Special

Access Program (SAP) - not authorized to flow without prior approval from MDA/Special

Programs (refer to SAP Supplement).

This section concerns the release of classified information to the contractor regarding the government’s Request for Proposal; MDA classified information may only be released to the

Contractor for submission preparation purposes following verification of the Contractor’s facility clearance and safeguarding. The DD Form 254 shall act as security guidance for the safeguarding of system integration related classified information at the Contractor facility. The

Defense Counterintelligence and Security Agency maintains security cognizance of classified information stored at a Contractor facility. However, the following stipulations apply:

IAW NISPOM paragraphs 5-200 and 5-600, Contractors shall ensure full written accounting and control over all MDA classified information provided to the Contractor by MDA or created as copies by the Contractor.

IAW NISPOM paragraphs 5-501 and 5-502, distribution of MDA classified information shall only be made to those cleared Contractor personnel working on the Contractor’s response to the request for information, unless otherwise authorized by the Program Manager

(PM).

IAW NISPOM paragraph 5-509, for purposes of this submission request, further distribution of MDA classified information shall only be authorized by the MDA PM overseeing this request for information.

IAW NISPOM paragraphs 5-702, 5-703, and 5-704, all classified information provided for use in submission preparation shall be returned to MDA or destroyed.

A contractors response to the Request for Information shall include appropriate classification markings IAW the NISPOM and appropriate Controlled Unclassified

Information/For Official Use Only (CUI/FOUO) markings IAW the DoDM 5200.01, Volume

4.

Reference Item 8.a. (continued) Government Locations:

Classified performance will occur at various MDA and/or government locations as directed by the contract via the Performance Work Statement, Statement of Work, or Statement of

Objectives or other agreement. The Contractor shall abide by the host government security requirements per NISPOM Chapter 1, Section 200 and Chapter 6, Section 105c. The cognizant security office at the performance location is MDA or the host installation.

Reference Item 10.a: The Contractor shall comply with the requirements of NISPOM Chapter

9, Section 4 and National Security Agency/Central Security Service Policy Manual Number 3-

16, Control of Communications Security (COMSEC) Material, for access to and safeguarding of

COMSEC information.

Reference Item 10.b & d: Contractors shall adhere to the requirements of DoDI 5210.02, “Access to and Dissemination of Restricted Data (RD) and Formerly Restricted Data (FRD),” 3

June 2011, for access and training requirements. Flow this requirement to subcontractors when applicable.

1. Contractors shall possess a valid DoD security clearance at a level commensurate with the information concerned and shall have a need-to-know for access. DoD contractors require a final Secret security clearance for access to Secret RD information. Contractors shall have a final Top Secret security clearance for access to Top Secret RD information. NISPOM section 2-211a. applies.

The Prime contractor and its subcontractors shall be required to complete training for access to RD/FRD material and for derivative classification of RD/FRD information. This training is provided by the Department of Energy (DOE) and shall be arranged by the MDA Contracting

Officer Representative (COR) whom will coordinate with the EIR, Associate Restricted Data

Management Official (mda_rdmo@mda.mil) to schedule training. The company’s Facility

Security Officer (FSO) shall maintain a record of the training for each individual with access to RD/FRD. These records shall be made readily available during security inspections or for other government purposes. Records shall be maintained for two years after an individual no longer requires access to RD/FRD information.

a. For individuals with access to RD/FRD information, personnel shall complete the

“Classification of Nuclear Weapons-Related Information (Restricted Data and Formerly

Restricted Data)” course. The contractor company shall maintain a record of the training for each individual with access to RD/FRD. These records shall be made readily available during security inspections or for other government purposes. Records shall be maintained for two years after an individual no longer requires access to RD/FRD information.

b. For individuals who will conduct derivative classification, personnel shall complete the “RD

Derivative Classifier Course.” The training course shall be arranged by the MDA Contracting

Officer Representative (COR) whom will coordinate with the EIR, Declassification Program

Office to schedule training and will be certified as a Derivative Classifier IAW MDA procedures. The contractor company shall maintain a record of the training for each individual designated as a RD Classifier. These records shall be made readily available during security inspections or for other government purposes. Records shall be maintained for two years after an individual is no longer designated as a RD Classifier.

Reference Item 10.c: NISPOM Chapter 9, Section 2 requirements apply. Access to Critical

Nuclear Weapons Design Information requires a final clearance.

Reference Item 10.e.(1): This contract requires access to Sensitive Compartmented Information

(SCI) material. The Contractor is not required to have an accredited SCI Facility but requires access to SCI at other locations. Additionally, the Facility Security Officer will ensure that when a Contractor with access to SCI is due for a Periodic Reinvestigation, the Periodic

Reinvestigation request is conducted to meet SCI standards. Written U.S. Government approval by MDA/Special Security is required prior to giving SCI access to a Subcontractor. Additional requirements are included in the attached SCI Supplement.

Reference Item 10.e.(2): NISPOM Chapter 9, Section 3 requirements apply. Non-Sensitive

Compartmented Information (SCI) is intelligence information existing at the collateral level and is typically, but not always, identified by the NOFORN caveat. The ODNI defers to the 32 CFR

2001 and as stated in the ICS 703-01 for classified national intelligence information and only requires government (i.e. MDA) determination for prime contractor to subcontractor flow-down.

Reference Item 10.f: Requirements are included in the attached SAP Supplement.

Reference Item 10.g: NISPOM Chapter 10, Section 7 requirements apply.

Reference Item 10.h: NISPOM Chapter 10, Section 3 requirements apply.

Reference Item 10.j:

1. The Contractor shall adhere to the requirements in the DoD Instruction 5200.48, Controlled

Unclassified Information (CUI) for safeguarding, marking, transmission, dissemination, and disposition of all CUI/For Official Use Only (FOUO) information.

2. Access.

a. Access to CUI/FOUO should be limited to U.S. Nationals that have either a current U.S.

security clearance (minimum interim SECRET clearance) or have been the subject of a favorably completed National Agency Check with Inquiries (i.e. Standard Form (SF) 85 Position of Trust investigation) or equivalent investigation (i.e. contractor equivalent).

(1) Definitions:

(a) A U.S. Person is defined as any form of business enterprise or entity organized, chartered or incorporated under the laws of the United States or its possessions and trust territories, and any person who is a citizen or national of the United States

(b) A U.S. National is defined as a citizen of the U.S., or a person who, though not a citizen of the U.S., owes permanent allegiance to the U.S. Also see 8 USC 1101(a) (22) or 8 USC 1401 paragraphs (a) through (g) for further clarification on those who may qualify as nationals of the

United States.

(2) Contractor Equivalent: Contractor equivalent includes various background checks such as those performed by employers during hiring process. At a minimum, the Contractor Equivalent

Background Plan (CEBP) will include citizenship, Personal Identification (Social Security

Number), and criminal background checks. The contractor shall submit a list of their procedures on company letterhead through the Contracting Officer or their representative for concurrence by the designated MDA approving office.

b. Contractor personnel with dual or foreign citizenship (including but not limited to those with permanent resident status) will be subject to an additional review; and found favorable by MDA prior to access to CUI/FOUO. (Note: Contractor personnel with dual citizenship that have an active U.S. security clearance (interim Secret or higher) may have access to CUI/FOUO material without additional review.

3. See Reference Item 11.l. for safeguarding of CUI/FOUO on a contractor’s unclassified information system(s).

4. The contractor shall flow-down this requirement to all subcontractors requiring access to

CUI/FOUO information regardless if the subcontractor has a facility security clearance or not.

For those uncleared subcontractors, the prime contractor shall ensure this section exists within the language of the subcontract/purchase order.

Reference Item 11.a: Classified contract performance is restricted to MDA/government facilities and/or other Contractor company facilities. The host Contractor/government activity will provide required security classification guidance for the performance of this contract, consistent with work performed at that location. The Prime Contractor, as listed in Item 6.a, shall be required to follow all security policies and procedures and use Security Classification

Guides of the host activity. This requirement shall be imposed on all subcontracts.

Reference Item 11.f:

1. The Contractor shall require access to classified information overseas at areas designated in the Statement of Work, Performance Work Statement, or Statement of Objectives.

2. Contractor personnel traveling on DoD-sponsored (official) travel overseas shall complete all training and messaging requirements outlined within the DoD Foreign Clearance Guide (FCG) for the foreign country being visited and support administrative reporting requirements specified by their program Country Clearance Message (CCM) Coordinator within 45-days prior to travel.

Contractor personnel should review U.S. Department of State (DoS) Travel Warnings, Travel

Alerts, and individual country specific information located at U.S. Department of State (DoS)

Travel Warnings web address and are encouraged to enroll in the U.S. DoS Smart Traveler

Enrollment Program (STEP) prior to commencing official travel overseas.

3. The Contractor shall submit foreign visit requests as dictated by the NISPOM, Chapter 10, Section 5. A Contractor shall submit the visit request through the Defense Counterintelligence and Security Agency-designated security official.

4. The Contractor is not authorized per the NISPOM to establish a contractor facility outside of the U.S., its possessions, or its territories. Storage, custody, and control of classified information required by a U.S. Contractor employee abroad is the responsibility of the U.S. Government.

Storage of classified information shall be at a U.S. military facility, a U.S. Embassy or

Consulate, or another location occupied by a U.S. Government organization.

Reference Item 11.g: The Contractor is authorized to use the services of the Defense Technical

Information Center (DTIC) or other secondary distribution center. As required, the Contractor will prepare and submit the DD Form 1540, “Registration for Scientific and Technical

Information Services” and DD Form 2345, “Militarily Critical Technical Data Agreement” to the contracting office for approval. Subcontractors are required to submit requests through the

Prime Contractor.

Reference Item 11.j: Have Operations Security (OPSEC) Requirements.

This contract requires the application of Operations Security (OPSEC):

1. The contractor supporting specific event-oriented activities shall comply with OPSEC Plans and briefings as defined in the Statement of Work (SOW)/Performance Work Statement (PWS).

2. Contractor personnel assigned shall receive OPSEC Awareness Education as appropriate.

3. The Contractor shall plan for and implement OPSEC supply chain processes and practices that restricts information flow-down (manufacturing need-to-know) and limits information listed on commodity Purchase Orders for critical program information and critical components.

4. The contractor shall apply OPSEC during flight test activities in accordance with specific test plans.

Reference Item 11.l:

Contractor’s Unclassified Automated Information System:

1. The Contractor shall safeguard and protect Controlled Unclassified Information/For Official

Use Only (CUI/FOUO) information provided by or generated for the Government that transits, resides, or is processed on any non-Government information technology system IAW the procedures in DoDI 8582.01, “Security of Unclassified DoD Information on Non-DoD

Information Systems,” June 6, 2012, Enclosure 3. Additionally, if the contract includes the

DFARS Clause 252.204-7012, Safeguarding of Covered Defense Information and Cyber

Incident Reporting, then the contractor must comply with its requirements. If the DFARS Clause

252.204-7012 does not exist on contract, the contractor shall comply with the requirements of the

Office of Management and Budget Circular A-130 and the DoD Directive 8100.2 until such time as the DFARS Clause 252.204-7012 may be added.

2. The contractor shall ensure that all persons accessing CUI/FOUO meet the qualifications as stated in Reference Item 10.j. of this DD Form 254.

3. MDA reserves the right to conduct compliance inspections of Contractor unclassified information systems and other repositories to verify the protection of CUI/FOUO information.

4. The contractor shall flow this reference item to all subcontractors that process and access

CUI/FOUO information regardless if the subcontractor has a facility security clearance or not.

For those uncleared subcontractors, the prime contractor shall ensure this section exists within the language of the subcontract/purchase order.

Reference Item 12: The Prime Contractor shall forward all requests for public release authorization through the Contracting Officer’s Representative to the listed MDA program office. Per NISPOM section 5-511, the Contractor shall include all necessary information to assist with the decision of the MDA program office. Per NISPOM Chapter 7, Section 102c., the

Prime Contractor shall act as the focal point for all Subcontractor requests for public release. A lack of response from the MDA program office does not constitute as public release authorization. The Prime Contractor shall not release information to the public prior to receiving written authorization from the MDA program office (this requirement includes any information system that provides public access).