Attachment J-4. Contract Security Classification Specification, DD Form 254 (DRAFT).pdf

CLASSIFICATION (When filled in): UNCLASSIFIED

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): UNCLASSIFIED

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

August 31, 2028

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED (See Instructions)

SECRET

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE(YYYYMMDD)

TBD 20260731

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE(YYYYMMDD)

20260716

b. REVISED (Supersedes all previous specifications.)

REVISON NO. DATE(YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE(YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified marterial received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractors request dated , retention of the classified material is authorized for the period of: days

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

TBD TBD

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations)

a. LOCATION(S) (For actual performance, see instructions)

NOAA/NESDIS/FCDAS

1300 Eisele Road Fairbanks, AK 99712 United States

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

Contractor provides operations and maintenance (O&M) services to the National Oceanic and Atmospheric Administration s (NOAA) National Environmental Satellite, Data, and Information Services (NESDIS) Fairbanks Command and Data Acquisition Station (FCDAS), Fairbanks, AK. The Government maintains FCDAS for the primary purpose of acquiring meteorological and environmental satellite mission data from polar-orbiting satellites managed and/or operated by NOAA, an agency of the U.S. Department of Commerce (DOC).

CLASSIFICATION (When filled in): UNCLASSIFIED

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Block 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.)

d. FORMERLY RESTRICTED DATA

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

h. FOREIGN GOVERMENT INFORMATION

i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. Provide details in Block 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDI 5200.48, only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

12. PUBLIC RELEASE All things herewith therefore nevermore

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

Office of Security, Insider Risk & Continuity, Industrial Security Department of Commerce

Public Release Authority:

See Section 13

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below.Pending final decision,the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

Section 13: Security Guidance Adhere to:

FAR 52.204-2 Security Requirements (MAR 2021) This clause applies to the extent that this contract involves access to all non-intelligence information classified "Confidential," "Secret," or "Top Secret."

Facility Clearance Level (FCL): The Contractor shall possess and maintain a FCL granted by the Defense Counterintelligence and Security Agency (DCSA). Should an FCL be invalidated for any reason, all work involving Classified National Security Information (CNSI) must stop.

The creation and maintenance of all DD 254s will be accomplished within the National Industrial Security System (NISS) Increment II System (NI2) (https://www.dcsa.mil/Systems-Applications/NI2-National-Industrial-Security-System-Increment-II/) and U.S. Department of Commerce (Department) security system of record and Security Manager throughout the life of the contract.

The Contractor shall be registered within NI2 at the time of award. It is incumbent upon the Contractor to ensure that the necessary security paperwork is submitted in sufficient time to enable each individual to be cleared prior to beginning work on this contract. If the NI2 is superseded by another System of Record, the same requirements apply. The Contracting Officer will maintain DD 254 in the Official Contract Records.

CLASSIFICATION (When filled in): UNCLASSIFIED

The Contractor is not authorized to subcontract on this effort without an approved subcontracting plan and written Government Contracting Activity (GCA)/Contracting Officer (CO) authorization for all non-intelligence information classified "Top Secret" per https://www.ecfr.gov/current/title-32/part-117#p-117.11(d)(2)(iii)(A) The prime Contractor is required to issue individual DD 254s for each subcontract awarded, even when those subcontractors are listed on the original or subsequent DD 254 through NI2, a member of the Department Office of Security Information Security Program (ISP) shall be listed as Reviewer within NI2. Contractor will coordinate with COR for proper delineation or Reviewer.

Contractor personnel performing or assigned under this contract must be U.S. persons. Security Classification Guide requests should be presented to the Government Sponsor, if required, subsequent to contract award. All CNSI received or generated under this contract is the property of the U. S. Government. The U. S. Government shall provide disposition instructions. No release of CNSI or Controlled Unclassified Information (CUI) under this contract is authorized. All requirements for control and accounting of original documentation and copies apply. All applicable provisions of the National Industrial Security Program Operating Manual (NISPOM) and its supplements and 32 CFR, part 117 apply. Any CNSI shall be transmitted in accordance with Department Manual of Security Policies and Procedures or successor policy.

The Contractor shall comply with (1) Security Agreement (DD Form 441/DD Form 441-1), (2) 32 CFR, Part 117.Provisions of the Privacy Act apply to all records and reports maintained by the contractors and (3) Department Manual Security Policies and Procedures.

All programs and materials developed at government expense during the performance period of this contract are the property of the US Government.

Prior to granting an employee access to CNSI and/or materials, the contractor shall brief employees regarding their obligation to comply with 32 CFR, Part 117 NISPOM, to include any changes and/or amendments. The Contractor s employees shall be debriefed when access to the material is no longer needed or is terminated. A list of all employees who have had access to CNSI during the period of this contract shall be maintained by the contractor company and be available for Defense Counterintelligence and Security Agency (DCSA) inspection.

Contactor employees shall abide by US Government Security Regulations and Security Policies when working on-site at US Government facilities/installations and shall annually attend Government mandatory training, and all other training as directed by the US Government.

Cleared contractors shall complete Department initial and annual formal training sessions identifying the requirements associated with the proper safeguarding of CNSI and Insider Risk Training.

Department CNSI and Insider Risk training courses are accessed through Department web-based intranet and shall be completed within thirty (30) days of onboarding:

o Annual CNSI Security Clearance Holder Training includes Derivative Classification, Marking and Annual CNSI Security Clearance Holder Training o https://connection.commerce.gov/sites/default/files/nsitraining/story.html o Insider Risk Training (https://doc.csod.com/ui/lms-learning-details/app/course/5511a403-6862-4f2a-a83e-515c3f4ca190) If unable to access Department training, training requirement for onboarding may be accomplished through the completion of all of the listed trainings from the Center for Development of Security Excellence (https://cdse.usalearning.gov/):

o DoD Initial Orientation and Awareness Training (IF140.06);

o Derivative Classification (IF103.16);

Annual CNSI Security Clearance Holder Training and Insider Risk Training certificates shall accompany the initial and annual Visit Authorization Request (VAR) prior to any Contractor or Subcontractor being granted access to CNSI. Subsequently, this training shall be completed annually. All annual training completion certificates shall be provided to the Insider Risk Management Program Office (IRMPO):

insiderrisk@doc.gov and the Industrial Security Program (ISP): OSY_IndustrialSecurity@doc.gov through the COR.

All training records shall be maintained by the Facility Security Officer (FSO) and made available to COR upon request.

Contractor personnel shall utilize US Government or official company e-mail for transmitting official US Government business. Official US Government business shall NOT be transmitted via personal, private, and/or commercial e-mail accounts.

Contractor is prohibited from using reference to this contract, classification, clearances, accesses (collateral and/or SCI), even by unclassified acronyms, in advertisements, websites, capabilities fliers, promotional efforts, or recruitment of employees.

The contracting company's FSO shall ensure all contractor personnel requiring access to CNSI obtain and maintain a Personnel Clearance (PCL) at least to the clearance level required for their assigned position designation (https://pdt.nbis.mil) while performing on the contract;

be within investigation scope at the appropriate national security access level in accordance with the applicable acquisition Requirements Document (SOW, PWS, SOO, etc.), and be enrolled within Continuous Evaluation (CE) at the time of contract award and throughout the life of the contract to include all potential option years identified in the Requirements Document. Additionally, the FSO shall provide all contractor personnel with an Initial CNSI briefing prior to the start of work and access to CNSI. All contractor personnel are required to sign an SF-312 Classified Information Nondisclosure Agreement prior to accessing CNSI.

Contractor personnel performing on this contract shall receive security awareness training initially and at least annually, in accordance with 32 CFR Part 117 National Industrial Security Program Operating Manual (NISPOM) and Department requirements.

Item 12: PUBLIC RELEASE OF INFORMATION GUIDANCE Disclosure to the Public. Contractors shall not disclose CNSI, CUI or unclassified information pertaining to a classified contract to the public without prior review and clearance as specified in the Contract Security Classification Specification for the contract or as otherwise specified by the Department.

All requests involving classified contracts shall be made through the Department, Office of Security, RM 1067, 1401 Constitution Ave, NW, Washington, DC 20230 Attn: Industrial Security Program, or OSY_IndustrialSecurity@doc.gov, cc: COR/Task Order Manager.

DISCONTINUED ACCESS (RESIGNATION/TERMINATION/DEATH)

The Departmental Office or Primary Operating Unit Field Servicing Security Office (https://www.commerce.gov/osy/field-offices/field-offices-overview) shall be notified of all resignations/terminations/deaths within two (2) business days of occurrence. The Contractor shall return to the COR all Department issued identification cards, building passes and equipment upon no longer providing contract support to the Departmental Office or Primary Operating Unit. The contract FSO shall assist in the facilitation of the timely return and notification of contractors who are no longer providing contract support to the Departmental Office or Primary Operating Unit as soon as known. If an identification card or building pass is not available to be returned, an incident report shall be submitted to the COR, referencing the pass or card number, name of individual to whom issued and the last known location and disposition of the ID Card or building pass.

CONTINUED ELIGIBILITY:

CLASSIFICATION (When filled in): UNCLASSIFIED

The Department reserves the right to deny and/or restrict entrance to government facilities, prohibit employees from assigned work under the contract, deny and/or restrict handling of CNSI of any Contractor employee who the Department or DCSA determines to present a risk of compromising CNSI and/or sensitive government information. The Department may require drug screening at any time for probable cause and/or when the Contractor independently identifies circumstances where probable cause exists.

A report shall be provided to the ISP through the COR annually including a complete list of active contractors and/or consultants performing work on the contract. To include annual VARs (template:

https://connection.commerce.gov/policy/20240313/visitor-access-request-form-template), clearance/access levels, training completion dates and certificates of training. Failure to provide an annual VAR or training certificates for a contractor will result in the suspension and possible termination of government facility and CNSI access.

DISCLOSURE OF INFORMATION

(a) The Contractor shall not release to anyone outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless

(1) The Contract Officer has given prior written approval;

(2) The information is otherwise in the public domain before the date of release; or

(3) The information results from or arises during the performance of a project that involves no covered information and has been scoped and negotiated by the contracting activity with the contractor and research performer and determined in writing by the Contract Officer to be fundamental research (which by definition cannot involve any covered information), in accordance with National Security Decision Directive 189, National Policy on the Transfer of Scientific, Technical and Engineering Information, in effect on the date of contract award.

(b) Requests for approval under paragraph (a)(1) shall identify the specific information to be released, the medium to be used, and the purpose for the release. The Contractor shall submit its request to the Contract Officer at least 10 business days before the proposed date for release.

(c) The Contractor agrees to include a similar requirement, including this paragraph (c), in each subcontract under this contract.

Subcontractors shall submit requests for authorization to release through the prime contractor to the Contract Officer.

CONTROLS AND CNSI MANAGEMENT

This contract and its related attachments may impose strict security requirements for need-to-know access, special handling procedures, physical security measures, and administrative controls beyond those prescribed for collateral Department information. The provisions delineated in 32 CFR Part 117 NISPOM, Department Policy, applicable Intelligence Community Directives, and applicable Security Classification Guides are strictly enforced.

The contractor is responsible for returning all CNSI (documents and other media) to the sponsoring Departmental Office or Primary Operating Unit. Furthermore, Department contractors must end all work and performance associated with this effort based on the classification guidance provided through existing classified sources. Questions relating to handling, marking, and safeguarding CNSI may be addressed to the COR and ISP. Retention of CNSI shall be in compliance with 32 CFR Part 117 NISPOM and Department Policy.

CNSI received and/or generated under this contract is the property of the U.S. Government regardless of proprietary claims. Upon completion or termination of this contract, the U S. Government will be contacted for destruction or disposition instructions. Derivative classifications must be derived from existing classification source documents. The contractor may not act as an Original Classification Authority. The contractor is not authorized to release U.S. Government CNSI to any activity or person, including sub-contractors without the Contract Officer 's written approval. Only with the expressed authorization of the Contract Officer will the contractor reproduce any CNSI.

All requirements for the control and accounting for original documentation and copies apply and must be in accordance with 32 CFR Part 117, NISPOM. Destruction and retention of classified information will be protected in accordance with 32 CFR Part 117 NISPOM. The Contractor is responsible for handling and marking Controlled Unclassified Information in accordance with the Department CUI Guidelines.

Contractors with questions on handling Department CUI may contact the COR or CUI Manager at cui@doc.gov

Item 10a COMSEC: Contractor personnel require access to Classified Communications Security (COMSEC) in the performance of this contract. COMSEC material is not releasable to contractor personnel who have not received a FINAL PCL at the appropriate security level and must be in the performance of this contract. Such information is NOT releasable to personnel holding interim clearances. All contractor personnel who require access to classified COMSEC information in the performance of their duties will be briefed by the FSO before access is granted. All contractor personnel will adhere to National Security Agency (NSA) Central Security Service (CSS) NSA/CSS Manual 3-16, "Control of Communications Security Material," and the Committee on National Security Systems Instruction (CNSSI) 4001, "Controlled Cryptographic Items," and COMSEC rules and regulations as mandated by Department policy and procedures. Contractor personnel will receive a COMSEC briefing before access to COMSEC information is granted and will follow Department requirements. Contractor personnel requiring continuous access to TOP SECRET and SECRET key and authenticators that are designated CRYPTO, and to classified cryptographic media that embody, describe, or implement classified cryptographic logic to include, but not be limited to, full maintenance manuals, cryptographic descriptions, drawings of cryptographic logic, specifications describing a cryptographic logic, and cryptographic computer software, will receive a CRYPTO briefing before access to cryptographic information is granted and will follow Department requirements. The Contractor is not authorized to subcontract access to COMSEC on this effort without prior approval from the GCA of the COMSEC (when applicable) and the CO per https://www.ecfr.gov/current/title-32/part-117#p-117.11(d)(2)(iii)(A)

Ref 10j: Controlled Unclassified Information (CUI) / Receive, Store, or Generate CUI: Contractor will abide by 15 CFR Part 4 Public Information, Freedom of Information Act and Privacy Act Regulations (https://www.govinfo.gov/content/pkg/FR-2018-08-10/pdf/2018-17171.pdf), the Department Controlled Unclassified Information Guidelines, and Department Manual of Security Policies and Procedures. In accordance with the Commerce Acquisition Manual 1337.70 Personnel Security Requirements (https://www.commerce.gov/oam/policy/acquisition-policy/commerce-acquisition-manual-cam), Contractors are required to ensure all personnel receive and complete Initial and Annual Refresher CUI education and training and maintain documentation of this training for audit purposes. Initial and Annual Refresher CUI security education, training and awareness on the required topics identified in Section 2002:30 of Title 32 CFR, including protection and management of CUI, to Department contractors through the Center for Development of Security Excellence (CDSE).

CUI Courses and Resources Created for Industry:

CLASSIFICATION (When filled in): UNCLASSIFIED

The Center for Development of Security Excellence (CDSE) has developed an eLearning course titled DoD Controlled Unclassified Information (CUI) Training For Contractors (IF141.06.FY21.CTR). The course fulfills CUI training requirements for industry.

Additionally, CDSE has a CUI Toolkit available at https://www.cdse.edu/toolkits/cui/current.html. The Toolkit includes training, policy documents, resources, and an FAQ video.

Review the Information Security Oversight Office CUI Registry at https://www.archives.gov/cui to become familiar with CUI organizational index groupings and CUI categories. Policy documents addressing CUI oversight:

Department Issuance Memorandum, Controlled Unclassified Information (CUI), August 2019, (https://ocio.commerce.gov/sites/default/files/media/files/2019/cui_issuance_memo.pdf) 32 CFR 2002 Part IV National Archives and Records Administration 32 CFR Part 2002 Controlled Unclassified Information (https://www.govinfo.gov/content/pkg/CFR-2017-title32-vol6/pdf/CFR-2017-title32-vol6-part2002.pdf) E.O. 13556 Vol 75, No 216. Controlled Unclassified Information (https://www.govinfo.gov/content/pkg/FR-2010-11-09/pdf/2010-28360.pdf) NIST Special Publication 800-171 Rev. 2 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final

Item 11a: Contract performance is restricted to the Department, other government and contractor facilities identified within the DD Form 254, Item 8. released or generated under this contract. CNSI released or generated under this contract is not releasable to foreign nationals without the expressed written permission of the OSY Industrial Security Program. Recipients of CNSI under this contract may not be released to subcontractors without permission of the OSY Industrial Security Program. The contractor and COR will validate all billets under this contract with the OSY Industrial Security Program annually or when a revised DD Form 254 is issued, whichever is sooner.

Ref 11l: Controlled Unclassified Information (CUI) / Receive, Store, or Generate Controlled Unclassified Information (CUI): Contractor will abide by 15 CFR Part 4 Public Information, Freedom of Information Act and Privacy Act Regulations (https://www.govinfo.gov/content/pkg/FR-2018-08-10/pdf/2018-17171.pdf), Department CUI Guidelines, and Department Manual of Security Policies and Procedures. In accordance with the Commerce Acquisition Manual 1337.70 Personnel Security Requirements (https://www.commerce.gov/oam/policy/acquisition-policy/commerce-acquisition-manual-cam), Contractors are required to ensure all personnel receive and complete Initial and Annual Refresher CUI education and training and maintain documentation of this training for audit purposes. Initial and Annual Refresher CUI security education, training and awareness on the required topics identified in Section 2002:30 of Title 32 CFR, including protection and management of CUI, to Department contractors through the Center for Development of Security Excellence (CDSE).

CUI Courses and Resources Created for Industry:

The Center for Development of Security Excellence (CDSE) has developed an eLearning course titled DoD Controlled Unclassified Information (CUI) Training For Contractors (IF141.06.FY21.CTR). The course fulfills CUI training requirements for industry.

Additionally, CDSE has a CUI Toolkit available at https://www.cdse.edu/toolkits/cui/current.html. The Toolkit includes training, policy documents, resources, and an FAQ video.

Review the Information Security Office CUI Registry at https://www.archives.gov/cui to become familiar with CUI organizational index groupings and CUI categories. Policy documents addressing CUI oversight:

Department Issuance Memorandum, Controlled Unclassified Information (CUI), August 2019, (https://ocio.commerce.gov/sites/default/files/media/files/2019/cui_issuance_memo.pdf) 32 CFR 2002 Part IV National Archives and Records Administration 32 CFR Part 2002 Controlled Unclassified Information (https://www.govinfo.gov/content/pkg/CFR-2017-title32-vol6/pdf/CFR-2017-title32-vol6-part2002.pdf) E.O. 13556 Vol 75, No 216. Controlled Unclassified Information (https://www.govinfo.gov/content/pkg/FR-2010-11-09/pdf/2010-28360.pdf) NIST Special Publication 800-171 Rev. 2 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

NAME & TITLE OF REVIEWING OFFICIAL SIGNATURE

Industrial Security Specialist Jody Stroud Digitally signed by:

jody stroud

Date: 2026.07.15 17:19:17

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

No Yes

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

No Yes

CLASSIFICATION (When filled in): UNCLASSIFIED

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE(See Instructions)

NOAA/Acquisitions and Grants Office Satellite and Information Acquisition Division

1332KP

c. ADDRESS (Include ZIP Code) 1325 East-West Highway SOU6 Silver Spring Metro Center Building 2 (SSMC2), 11th Floor Silver Spring, MD 20910

d. POC NAME

e. POC TELEPHONE (Include Area Code)

f. EMAIL ADDRESS (See Instructions)

Jame Chang

(301) 628-1332 jame.chang@noaa.gov

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

b. TITLE

c. ADDRESS (Include ZIP Code)

Jame Chang

Contracting Officer

1325 East-West Highway 11th Floor Silver Spring, MD 20910

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

e. CAGE CODE OF THE PRIME CONTRACTOR (See Instructions)

f. TELEPHONE (Include Area Code)

g. EMAIL ADDRESS (See Instructions)

1332KP

(301) 628-1332 jame.chang@noaa.gov

h. SIGNATURE

i. DATE SIGNED (See Instructions)

Digitally signed by:

chang.jame.zong.15046 88310

Date: 2026.07.16 12:41:08

20260716

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

COR: Nathan Minton Phone: 907-451-1246 Email: nathan.r.minton@noaa.gov