Attachment J4 Draft DD254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DD-254

OPSEC Attachment

CUI

NAVAIR OPERATIONS SECURITY (OPSEC) REQUIREMENTS

1. All work is to be performed in accordance with Department of Defense (DoD) and Department of

Navy (DON) Operations Security (OPSEC) requirements, per the following:

a) National Security Decision Directive 298

b) DoDD 5205.02, DoD Operations Security (OPSEC) Program

c) DoD 5205.02-M, DoD Operations Security (OPSEC) Program Manual

d) SECNAVINST 3070.2A, DON Operations Security

2. The contractor shall accomplish the following minimum requirements in support of the Naval Air

Systems Command (NAVAIR) OPSEC Program:

a) Determine Critical Information (CI) in accordance with DoD 5205.02-M (Appendix 1 through

Encl 3). CI includes those facts, which individually, or in the aggregate, reveal sensitive details about NAVAIR or the contractor’s security or operations related to the support or performance of this Statement of Work (SOW), and thus require a level of protection from adversarial collection or exploitation not normally afforded to unclassified information.

b) Practice OPSEC and implement countermeasures to protect CI and other sensitive unclassified information and activities, especially those activities or information which could compromise classified information or operations, or degrade the planning and execution of military operations performed or supported by the contractor in support of the mission. Protection of

CI will include the adherence to and execution of countermeasures which the contractor initiates or provided by NAVAIR, for CI on or related to the SOW.

c) Sensitive unclassified information is that information marked Controlled Unclassified

Information (CUI), Privacy Act of 1974, COMPANY PROPRIETARY, and also information as identified by NAVAIR or NAVAIR Contracting Officer Security Representative (COSR).

d) NAVAIR has identified the following baseline CI:

DAILY ACTIVITIES

1) Details regarding military operations, missions and exercises

2) Details of U.S. systems supporting combat operations (numbers, timelines, locations effectiveness, unique capabilities, etc.)

3) Operational characteristics for new or modified weapon systems (Probability of Kill

(PK), Countermeasures, Survivability, etc.)

4) Required performance characteristics of U.S. systems using leading edge or greater technology (new, modified or existing)

5) Test or evaluation information pertaining to schedules of events during which CI may be captured

6) Details of NAVAIR unique Test or Evaluation capabilities (disclosure of unique capabilities)

7) Any material designated at Controlled Unclassified Information (CUI) such as

NOFORN, and other distribution statement-controlled documents as well as

Proprietary, or Business Sensitive Information (to include Source Selection

Information or other sensitive competitive information)

8) Known or probable vulnerabilities to any U.S. system and their direct support systems

SECURITY RESPONSIBILITIES

9) Government personnel information that would reveal force structure and readiness

10) Detailed facility maps or installation overhead photography (photo with annotation of

Command areas or greater resolution than commercially available)

11) Force Protection specific capabilities or response protocols

12) Vulnerabilities in Command processes, disclosure of which could allow circumvention of security, financial, personnel safety, or operations procedures

13) Details of COOP, NAVAIR emergency evacuation or emergency recall procedures

14) Network User ID’s and Passwords and access codes to restricted/controlled spaces

15) Existence and/or details of intrusions into or attacks against DoD Networks or

Information Systems, including, but not limited to, tactics, techniques and procedures used, network vulnerabilities exploited, and data targeted for exploitation

16) Compilations of information that directly disclose Command CI

17) Command leadership and VIP agendas, reservations, plans/routes, etc.

3. All CI developed by the contractor and/or NAVAIR, in electronic or hardcopy form, shall be protected by a minimum of the following countermeasures:

a) All emails containing CI must be DoD Public Key Infrastructure (PKI) signed and PKI encrypted

b) CI may not be sent via unclassified fax when practical

c) CI may not be discussed via non-secure phones when practical

d) CI may not be provided to individuals that do not have a need to know it in order to complete their assigned duties

e) CI may not be disposed of in recycle bins or trash containers unless made unusable (i.e.

shredded)

f) CI may not be left unattended in uncontrolled areas

g) CI in general should be treated with the same care as CUI or Proprietary information

h) CI must be destroyed in the same manner as CUI

i) CI must be destroyed at contract termination or returned to the government at the government’s discretion

4. The contractor shall document items of CI that are applicable to contractor operations involving information on or related to the SOW. Such determinations of CI will be completed using the DoD

OPSEC Five-Step process as described in National Security Decision Directive (NSDD) 298 and

DoDMAN 5205.02 (App 1 to Encl 3).

5. Per DoDM 5205.02M (Encl 6), OPSEC training must be included as part of the contractors ongoing security awareness program. Basic OPSEC training, produced by the Interagency OPSEC

Support Staff (IOSS), can be found here - OPSE1301 OPSEC Fundamentals If this link does not work, please request a CD copy via NAVAIR Operations Officer.

6. If contractor cannot resolve an issue concerning OPSEC they will contact the COR (who will consult with the appropriate OPSEC Manager).

8. All above requirements shall be passed to all Sub-contractors.

Controlled by: NAWCAD Industrial Security

CUI Category: OPSEC and INDUSEC

Distribution/Dissemination Control: FEDCON

POC: mark.a.davis15.civ@us.navy.mil https://www.iad.gov/ioss/department/opsec-fundamentals-course-opse1300-opse1301-opse1300e-10045.cfm

Addendum 2 (Revision 2)

UNITED KINGDOM

RESTRICTED CONDITIONS REQUIREMENTS CLAUSE

On January 27, 2003 the United States Department of Defense (DoD) and the United Kingdom (UK) Ministry of

Defence (MoD) signed a document known as the “Security Implementing Arrangement” that removed U.S.

Government oversight responsibility for protection of information marked UK RESTRICTED provided to U.S.

contractors. The UK Government implemented these changes effective April 1, 2003 with further clarification in a letter to the F-35 Lightning II Program Office dated 4 Dec 2009.

On April 1, 2014 the UK Government introduced revised security Protective Markings (PM). The PM UK

RESTRICTED has been replaced with UK OFFICIAL – SENSITIVE. This change is not retrospective so documents marked as UK RESTRICTED will remain in circulation for some time to come. The guidance below has been updated to reflect the changes to the UK PM schema.

In conjunction with this arrangement the following handling procedures apply to UK Restricted data and UK

Official – Sensitive data within the F-35 program areas.

1.0 PROTECTION

UK documents or material bearing the classification “UK OFFICIAL – SENSITIVE” or “UK RESTRICTED” shall be handled in the United States as U.S. UNCLASSIFIED information that is exempt from public release under one or more U.S. laws (similar to U.S. FOR OFFICIAL USE ONLY information). These laws include the Freedom of

Information Act (FOIA) and Title 10 U.S.C. Section 130(c), “Nondisclosure of Information: Certain Sensitive

Information of Foreign Governments and International Organizations.”

Also similar to US Government FOUO or US Contractor proprietary, neither a personnel nor facility security clearance is required for access to UK OFFICIAL – SENSITIVE or UK RESTRICTED information. However, the information must be confined to those members of the F-35 program whose access to the information is essential for the purpose of their duties. Except with the consent in writing of the UK MOD, F-35 personnel shall not make use of the UK OFFICIAL – SENSITIVE or UK RESTRICTED information issued or furnished by or on behalf of the UK

MOD otherwise than for the purpose of the F-35 contract.

An export license for UK OFFICIAL – SENSITIVE or UK RESTRICTED information should be processed as any other unclassified information would be processed. The information subject to export will not have to pass through government-to-government channels.

Contracts placed with U.S. contractors that involve the retention or production of UK OFFICIAL – SENSITIVE or

UK RESTRICTED information will include this Restricted Conditions Requirements Clause identifying the security protective measures to be applied to safeguard the information. This Restricted Conditions Requirements Clause will be included in any new revisions to the current F-35 DD254s in place for contractors requiring access to UK

OFFICIAL – SENSITIVE or UK RESTRICTED data.

2.0 STORAGE

During working hours, reasonable steps must be taken to minimize the risk of access to UK OFFICIAL –

SENSITIVE or UK RESTRICTED information by unauthorized personnel. After working hours, UK OFFICIAL –

SENSITIVE and UK RESTRICTED information will be locked in an office, overhead bins, desk or cabinet to preclude unauthorized access.

UNCLASSIFIED//REL TO USA AND UK MOD

3.0 TRANSMISSION

UK OFFICIAL – SENSITIVE and UK RESTRICTED documents may be single wrapped and transmitted by First

Class Mail within the United States. Transmission outside the United States must be double wrapped with the inner envelope marked “UK OFFICIAL – SENSITIVE” or “UK RESTRICTED” as appropriate. International transfers shall be by one of the means authorized for U.S. classified information, by international airmail, or by express commercial courier services. Government-to-government transmission procedures are not required.

UK OFFICIAL – SENSITIVE and UK RESTRICTED information may only be transmitted or accessed electronically via a public network like the Internet when using government or commercial encryption devices which must meet U.S. FIPS 140-2 encryption standards at a minimum. If any additional/differing requirement

(outside of FIPS140-2 approved devices) is identified, F-35 Joint Program Office (JPO) Security must be contacted.

4.0 MARKING

All F-35 unclassified documents containing UK OFFICIAL – SENSITIVE or UK RESTRICTED information shall have “UK OFFICIAL – SENSITIVE” or” UK RESTRICTED”, as appropriate, - Exempt from Public Disclosure under Title 10 U.S.C. Section 130(c)” typed, stamped or printed in capital letters centered at the bottom on the outside of the front cover (if any), on each page containing UK OFFICIAL – SENSITIVE or UK RESTRICTED information and on the outside of the back cover (if any). In addition, the UK OFFICIAL – SENSITIVE or UK

RESTRICTED information shall be identified in the documents as well. This can be accomplished with the portion marking “(UK O-S)” or “(UK-R)” on the applicable paragraphs and/or charts/pictures/graphs. Other records, such as diskettes, photographs, films, cassette tapes, movies and slides, shall be marked “UK OFFICIAL – SENSITIVE” or

“UK RESTRICTED”, as appropriate,- Exempt from Public Disclosure under Title 10 U.S.C. Section 130(c)” as well.

(Note: Any UK OFFICIAL – SENSITIVE or UK RESTRICTED material received or generated prior to Revision 2 to this Addendum does not have to be remarked until it is being used, reproduced or transmitted.

5.0 DESTRUCTION

Where available the use of shredders, burn barrels, burn bags or other protected destruction methods should be used to destroy UK OFFICIAL – SENSITIVE or UK RESTRICTED information. DO NOT place any UK OFFICIAL –

SENSITIVE or UK RESTRICTED information in the trash.

6.0 USE OF IT SYSTEMS

The following accreditation requirements describe the general security requirements for processing and accessing

UK OFFICIAL – SENSITIVE or UK RESTRICTED information on IT systems. For specific guidance addressing

UK OFFICIAL – SENSITIVE or UK RESTRICTED information to be managed by Signal Interface Management

Systems (SIMS), Dimensions, Livelink or in a collaborative working environment refer to Enclosure (1) of this

Addendum.

(1) Control of physical access to all hardware elements of the IT system.

(2) Identification and authentication (ID&A). All systems should have the following functionality:

(a) Up-to-date lists of authorized users

(b) Positive identification of all users at the start of each processing session

(c) An agreed means of transmitting the UK OFFICIAL – SENSITIVE or UK RESTRICTED data as described in

Section 3.0 above

(3) Passwords are part of most ID&A security measures. Passwords should be nine characters long and should include numeric and “special” characters (if permitted by the system) as well as alphabetic characters. Note:

Lockheed Martin will configure passwords for privileged and non-privileged accounts in accordance with Lockheed

Martin policy.

(4) Internal Access Control – All systems should have internal access controls to prevent unauthorized users from accessing or modifying the data.

(5) Security accounting and audit – Security relevant events fall into two categories, namely legitimate events and violations.

(a) The following events should always be recorded:

i. All log on attempts whether successful or failed.

ii. Log off (including time out where applicable).

iii. The creation, deletion or alternation of access rights and privileges.

iv. The creation, deletion or alteration of passwords

(b) For each of the events listed above, the following information is to be recorded:

i. Type of event

ii. User ID

iii. Date and Time

iv. Device ID

The accounting records should have a facility to provide the System Manager with a hard copy of all or selected activity. There should also be a facility for the records to be printed in an easily readable form. All security records are to be inaccessible to users without a need to know.

If the operating system is unable to provide this then the equipment should be protected by physical means when not in use (i.e., locked away or the hard drive removed and locked away).

(6) Integrity & Availability – The following supporting measures should be implemented:

(a) Provide general protection against normally foreseeable accidents/mishaps and known recurrent problems

(e.g., viruses and power supply variations)

(b) Defined Business Contingency Plan

(c) Data backup with local storage

(d) Anti Virus Software (Implementation, with updates, of an acceptable industry standard Anti-virus software.)

(7) Logon Banners – Wherever possible, a logon banner should be provided to summarize the requirements for access to a system which may be needed to institute legal action in case of any breach occurring.

(8) Unattended Terminals – Users are to be automatically logged off the system if their terminals have been inactive for some predetermined period of time, to prevent an attacker making use of an unattended terminal.

(9) Computer systems should not be connected direct to the Internet unless protected by a firewall.

(10) Before IT storage media (e.g. disks) are disposed an erasure product should be used to overwrite the data. This is a more thorough process than deletion of files which does not remove the data.

7.0 INTERPRETATION

Advice regarding the interpretation of the above requirements or waivers to the requirements must be sought from the UK MOD.

Addendum 3 (Revision 2)

AUSTRALIAN

PROTECTED HANDLING REQUIREMENTS CLAUSE AND CLEARANCES REQUIRED FOR ACCESS TO

AUSTRALIAN SPECIAL ACCESS PROGRAM FACILITIES

1.0 PROTECTION OF “PROTECTED INFORMATION”

PROTECTED is the lowest level of Australian security classification for which a security clearance is required for access. AUSTRALIAN PROTECTED information must be confined to those members of the F-35 program whose access to the information is essential for the purpose of their duties. Except with the consent in writing of the AUSTRALIAN DOD, F-35 personnel shall not make use of the AUSTRALIAN PROTECTED information issued or furnished by or on behalf of the AUSTRALIAN DOD otherwise than for the purpose of the F-35 contract.

An export license for AUSTRALIAN PROTECTED information should be processed as any other unclassified information would be processed.

Contracts placed with U.S. contractors that involve the retention or production of AUSTRALIAN PROTECTED information will include this PROTECTED Handling Requirements Clause identifying the security PROTECTED measures to be applied to safeguard the information. This PROTECTED Handling Requirements Clause will be included in any new revisions to the current F-35 DD254s in place for contractors requiring access to AUSTRALIAN PROTECTED data.

2.0 STORAGE

During working hours, reasonable steps must be taken to eliminate the risk of access to AUSTRALIAN PROTECTED information by unauthorized personnel. After working hours, AUSTRALIAN PROTECTED information will be locked in an office, overhead bins, desk or cabinet to preclude unauthorized access.

3.0 TRANSMISSION

AUSTRALIAN PROTECTED material must be protected in the United States of America as if it were CONFIDENTIAL material. Should the United States of America transmit CONFIDENTIAL material, Australia shall mark it as

CONFIDENTIAL.

AUSTRALIAN PROTECTED documents may be single wrapped and transmitted by First Class Mail within the United States. Transmission outside the United States must ONLY be by government to government channels, double wrapped with the inner envelope marked “AUSTRALIAN PROTECTED.”

AUSTRALIAN PROTECTED information may only be transmitted or accessed electronically via an accredited US DoD classified network. Transmission via a public network would require the approval of the AUSTRALIAN DOD Defense Security Authority. Contact F-35 Joint Program Office (JPO) Security if this requirement is identified.

AUSTRALIAN PROTECTED information is not to be transmitted by telephone, video conferencing or facsimile transmissions within the United States.

4.0 MARKING

All F-35 unclassified documents containing AUSTRALIAN PROTECTED information shall have “AUSTRALIAN PROTECTED” typed, stamped or printed in capital letters centered at the bottom on the outside of the front cover (if any), on each page containing AUSTRALIAN PROTECTED information and on the outside of the back cover (if any).

Other records, such as diskettes, photographs, films, cassette tapes, movies and slides, shall be marked

“AUSTRALIAN PROTECTED.”

5.0 DESTRUCTION

Shredders, burn barrels, burn bags or other protected destruction methods are to be used to destroy AUSTRALIAN PROTECTED information. DO NOT place any AUSTRALIAN PROTECTED information in the trash.

6.0 CLEARANCES REQUIRED FOR ACCESS TO AUSTRALIAN SPECIAL ACCESS PROGRAM FACILITIES

(SAPF)

Contractors primarily working in Special Access Program Facilities (SAPF) in Australia and having access to Secret//Special Access Required information must have a U.S. Top Secret (TS) clearance or Australian Government Negative Vetting 2 (NV2).

FOR OFFICIAL USE ONLY //REL TO USA AND AUS

Addendum 4

NORWEGIAN

RESTRICTED HANDLING REQUIREMENTS CLAUSE

In accordance with the security procedures for Industrial Operations between the Ministry of Defense of Norway and The Department of Defense of the United States (Industrial Security Annex), paragraph 2.g, Footnote 3; the handling of Norwegian Restricted Data should be as follows:

Norwegian documents or material bearing the classification “BEGRENSET” shall not be marked with any US security classification marking but shall be marked or stamped in English, “RESTRICTED.” In addition, the following notation shall be entered: “To be safeguarded in accordance with Department of Defense Industrial Security manual (DoDISM), DoD 5220.22-M, or “Department of Defense Information Security Program Regulation, DoD 5200.1-R, as appropriate.” Documents or material so marked shall be stored in locked filing cabinets, desks, or similar closed spaces or areas that will prevent access by unauthorized personnel.

Documents or material on hand and marked “To be treated as CONFIDENTIAL” or “Modified Handling Authorized” will have these US markings obliterated or excised as they are withdrawn for use. They shall be remarked and safeguarded as in 1, above.

Norwegian RESTRICTED documents shall be handled in a manner that will preclude open publication, access or use for other than the official Government purposes of the United States or the releasing country.

Documents and materials containing Norwegian RESTRICTED information shall be released only to contractors and individuals that have been cleared to the level of CONFIDENTIAL by the US Government. Both facilities and individuals must also have a need for the information in the course of official business.

Norwegian RESTRICTED documents shall be transmitted in two secure covers, the inner cover marked “RESTRICTED.” Transmission outside the United States shall be by one of the means authorized for United States classified information.

Unclassified US documents originated by a US Government agency which contain information that Norway has classified “BEGRENSET” shall bear on the cover and the first page the marking “RESTRICTED.” In addition, the following notation shall be entered: “To be safeguarded in accordance with Department of Defense Industrial Security Manual (DoDISM), DoD 5220.22-M, as appropriate.” The Norwegian RESTRICTED information shall be identified in the documents.

Norwegian RESTRICTED information transmitted electronically shall be encrypted.

UNCLASSIFIED//REL TO USA AND NOR MOD

DEPARTMENT OF THE NAVY

NAVAL AIR SYSTEMS COMMAND IN REPLY REFER TO

RADM WILLIAM A MOFFETT BUILDING 5510

47123 BUSE ROAD BLDG 2272 Ser V52/22-001 PATUXENT RIVER MARYLAND 20670-1547 01 Mar 2022

MEMORANDUM

From: Senior Intelligence Officer, Naval Air Systems Command, 48150 Shaw Road, Bldg 2109, Patuxent River, Maryland 20670

To: Distribution

Subj: POLICY GOVERNING RELEASE OF INTELLIGENCE TO CONTRACTORS

Ref: (a) DoDM 5105.21 SENSITIVE COMPARTMENTED INFORMATION (SCI)

ADMINISTRATIVE SECURITY MANUAL Vol 1, 16 MAY 2018

(b) DoD Directive 5148.13 INTELLIGENCE OVERSIGHT, 26 APR 2017

1. Per reference (a), the Command Senior Intelligence Officer is the official approving authority for release of intelligence information via NAVAIR contracts.

a. Contractors are not authorized to disclose further or release intelligence without the prior written notification and approval of the Senior Intelligence Officer. Contractors are not authorized to release intelligence information to sub-contractors without a sub-contract DD-254 signed by an Intelligence Officer with DD-254 signature authority appointed by the Senior Intelligence Officer.

i. All contracts and sub-contracts authorizing access to non-SCI intelligence information must include a copy of this memorandum and the following language in the DD-254:

The contractor is authorized access to non-SCI National Intelligence Information and/or Foreign Intelligence Information on behalf of Rebecca Ahne, NAVAIR Senior Intelligence Officer. A final security clearance at the appropriate level is required for access to Non-SCI National Intelligence Information and/or Foreign Intelligence information. Further security guidance for reproduction, release, retention, return, and destruction of National Intelligence Information is stipulated in the attached NAVAIR Memorandum titled POLICY GOVERNING RELEASE OF INTELLIGENCE TO CONTRACTORS dated 24 JANUARY 2022. Written concurrence of the Technical Point of Contact/Contracting Officer Representative/Contracting Officer Representative for Security (as applicable) is required prior to subcontracting.

ii. All contracts and sub-contracts authorizing access to the SECRET Internet Protocol Router Network, but not authorizing access to non-SCI intelligence, must include the following language in the DD-254:

The contractor is authorized access to the SECRET Internet Protocol Router Network; however, access to non-SCI intelligence information is not authorized.

iii. Contracts and sub-contracts authorizing access to the SECRET Internet Protocol Router Network, but DD-254 block 10e(2) is not selected meaning the contractor is not authorized access to non-SCI intelligence information, do not require review or signature by the Senior Intelligence Officer.

b. Intelligence released to contractors, all reproductions thereof, and all other material generated based on, or incorporating data there from, including authorized reproduction, remain the property of the US Government. Unless otherwise specified in the contract, the contractor shall return all intelligence documents to the Scientific and Technical Intelligence Liaison Office within 24 months of date of receipt, or the termination date of the contract. The contractor shall properly destroy and dispose of the intelligence information as soon as possible after it has served the purpose for which it was released by the government, developed, prepared, or retained after completion or termination of the contract in accordance with the NISPOM.

c. All intelligence information will be reviewed and validated by the Senior Intelligence

Officer prior to being utilized and/or delivered in a finished product. Intelligence information intended to be utilized form other contractual efforts satisfying this contract will be coordinated and approved prior to execution by all parties.

2. Per reference (b), contractor personnel involved in intelligence and intelligence-related activities are required to report any significant highly sensitive matter, or questionable intelligence activities, to the NAVAIR Senior Intelligence Officer.

3. The contractor must restrict access to only those individuals who are actually providing services under the contract with a valid need to know.

R. L. Ahne

2022-02-28T08:18:10-0500

AHNE.REBECCA.L.1113773843

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, "DoD Contract Security Classification Specification"

N/A Enter cognizant security office(s) (Name, Address, ZIP Code, Telephone required; Email Address optional).:

N/A Enter cognizant security office(s) (Name, Address, ZIP Code, Telephone required; Email Address optional).: N/A

7556 Teague Road, Suite 580 Hanover, MD 21076 410-689-2270 dcsa.ncr.dcsa-isfo.mbx.hanover-field-office-1@mail.mil Enter cognizant security office(s) (Name, Address, ZIP Code, Telephone required; Email Address optional).: Defense Counterintelligence and Security Administration Dallas Field Office (C-DAL) 2250 West John Carpenter Freeway, Suite 450 Irving, TX 75063 Phone: 469-329-6367

200 12th Street South Arlington Va 22202 Enter location(s).: F-35 Joint Program Office (JPO) 2521 South Clark St Arlington Va 22202 Enter location(s).: Wright Patterson, AFB 5135 Pearson Rd, Patterson AFB, 45433 Enter location(s).: NAWS China Lake 1 Administration Circle, Ridgecrest, CA 93555 Enter location(s).: NBVC Point Mugu 311 Main Road, Bldg 1, Point Mugu, CA 93042 Enter location(s).: Eglin AFB 501 W. Van Matre Ave Eglin AFB, FL 32542-5487 Enter location(s).: Edwards AFB 10 Chamberlin Loop Edwards AFB, CA 93524 Enter location(s).: Nellis AFB 4700 Las Vegas Blvd N Nellis AFB, NV 89115 Enter location(s).: NAS Patuxent River 47123 Buse Rd Patuxent River, MD 20670 Enter location(s).: FMS Secure Solutions 839 Elkridge Landing Road Suite 107 Linthicum, MD 21090 Enter location(s).: Lockheed Martin Aeronautics Company 1 Lockheed Boulevard Fort Worth, TX 76101 Enter location(s).: Headquarters, US Geological Survey 12201 Sunrise Valley Drive Reston, VA 20191 Enter general unclassified description of this procurement.: FOR SOLICITATION ONLY

The F-35 Joint Program Office (F-35 JPO) requires program security support services to support its critical mission of developing, deploying and sustaining the next generation strike fighter aircraft. The program security support disciplines consist of Program Management, General Security Support, Information Security Support, Industrial Security Support, Physical Security Support, Personnel Security Support, Counter-Intelligence Support, Special Security Studies, Foreign Disclosure Support, Program Protection, and Program Protection Engineering Services.

Period of Performance: TBD

COR:

TPOC:Robert Proud

GPM:

200 12th Street, Suite 600, Arlington, VA 22202

Revision 2: to change COR, update SCGs and clarifying security statements

Subcontractor authorization for receiving and storing collateral classified information will be IAW an approved subcontract DD FM 254.

FMS Secure Solutions is an authorized placement of work and will not add cost to the government for the use of their facilities.

Item 10a: Classified COMSEC material is not releasable to contractor employees who have not received a final security clearance at the appropriate level. Cryptologic keying materials and Controlled Cryptographic Items (CCI) are controlled by Department of the Navy, NISPOM, and National Security Agency (NSA) guidelines. The contractor shall be guided by NSA/CSS Policy Manual 3-16 in the control and protection of COMSEC material/information at their facilities. When access is required at Government facilities, contractor personnel will adhere to COMSEC rules and regulations as mandated by 32 CFR Part 117, the NISPOM Rule, EKMS 1 (series) and Command policy and procedures. Written concurrence of the Technical Point of Contact identified in Block 16, or Contracting Officer Representative/Contracting Officer Representative for Security (as applicable) is required prior to subcontracting.

Item 10b: RD is not releasable to contractor employees who have not received a final security clearance at the appropriate level. Written concurrence of the Technical Point of Contact identified in Block 16, or Contracting Officer Representative/Contracting Officer Representative for Security (as applicable) is required prior to subcontracting.

Item 10c: Critical Nuclear Weapon Design Information (CNWDI) is not releasable to contractor employees who have not received a final security clearance at the appropriate level. Written concurrence of the Technical Point of Contact identified in Block 16, or Contracting Officer Representative/Contracting Officer Representative for Security (as applicable) is required prior to subcontracting.

Item 10d: Formerly Restricted Data (FRD) is not releasable to contractor employees who have not received a final security clearance at the appropriate level. Written concurrence of the Technical Point of Contact/Contracting Officer Representative identified in Block 16, or Contracting Officer Representative for Security (as applicable) is required prior to subcontracting.

Item 10.e. - National Intelligence Information: The Command Senior Intelligence Officer (SIO) as defined in DoDM 5105.21, Volume 1, 19 October 2012 is the official approving authority for all releases of intelligence information pertaining to NAVAIR contracts and all affiliated sub-contracts. This DD254 is only to be used for work related to NAVAIR platforms and programs and does not apply to non- NAVAIR work.

Per Intelligence Community Standard (ICD) 703-01, 10 September 2015, contractors are not authorized to disclose further or release intelligence to any of their components or employees or to another contractor (including sub-contractors) without the prior written notification and approval of the SIO unless such disclosure or release is authorized in writing at the initiation of the contract as an operational requirement.

In accordance with Department of Defense (DoD) Directive 5148.13, contractor personnel involved in intelligence and intelligence related activities are required to report any significant, highly sensitive matter, or questionable intelligence activities to appropriate government officials.

Block 10.e.(1) - Sensitive Compartmented Information - Contractor will require access to Sensitive Compartmented Information (SCI) in performance of this contract and requires a final Top Secret US. Government Personnel Security clearance based upon a Tier 5 background investigation, T5R or equivalent investigation and SCI Indoctrination. Contractor must provide individuals who are able to achieve and maintain the adjudicative standards set forth in the Intelligence Community Directive (ICD) 704 “Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information,” for continued employment. Contractor must have a CSSO that meet SCI eligibility requirements and is SCI indoctrinated. SCI billets on this contract require approval from the NAVAIR SSO and SIO. Contractor SCI nomination packages will be submitted to the NAVAIR Special Security Office for review and processing. Contractor personnel are NOT authorized to perform SCI work on this effort, until approved for access by the NAVIAR SSO and SIO. SCI Nomination packages are to be submitted for ALL contractor personnel performing SCI work on this effort regardless of if the individual is already cleared. Before an employee departs, the contractor will ensure the employee goes through the NAVAIR Special Security Office (SSO) to be debriefed.

Access, processing, and storage of SCI information shall be conducted within an approved SCI accredited facility only. Use of government or contractor SCI facilities outside of NAVAIR SSO cognizance requires an approved Co-Utilization Agreement (CUA)/Joint -Utilization Agreement (JUA) prior to use.

Naval Air Systems Command (NAVAIR) has exclusive security responsibility for all SCI material under this contract. NAVAIR SIO is responsible for the release of and access to all Intelligence information/materials under this contract. Further disclosure, to include subcontracting, of SCI is prohibited until receipt of approval from the SCI cleared COR/TPOC and NAVAIR SIO. Further security guidance is stipulated in the attached NAVAIR Memorandum titled POLICY GOVERNING RELEASE OF INTELLIGENCE TO CONTRACTORS dated 01 MAR 2022.

In compliance with DoDD 5148.13 paragraph 4.1.e and SECNAVINST 3820.3F, all contractor personnel conducting Intelligence or Intelligence-related activities or supporting those efforts under Department of Defense authorities shall report any Questionable Intelligence Activity (QIA) or Significant or Highly Sensitive Matter (S/HSM) to the Naval Information Warfare Systems Command Intelligence Oversight Program Manager or Senior Intelligence Officer.

Questionable Intelligence Activity (QIA): Any Intelligence or Intelligence-related activity when there is reason to believe such activity may be unlawful or contrary to an Executive Order, Presidential Directive, Intelligence Community Directive, or applicable DoD policy governing that activity.

Significant or Highly Sensitive Matter (S/HSM): An Intelligence or Intelligence-related activity (regardless of whether the Intelligence or Intelligence-related activity is unlawful or contrary to an Executive Order, Presidential Directive, Intelligence Community Directive, or DoD policy), or serious criminal activity by Intelligence personnel, that could impugn the reputation or integrity of the Intelligence Community, or otherwise call into question the propriety of Intelligence activities. Such matters might involve actual or potential:

- Congressional inquiries or investigations.

- Adverse media coverage.

- Impact on foreign relations or foreign partners.

- Systemic compromise, loss, or unauthorized disclosure of protected information.

Item 10e2: The contractor is authorized access to Non-SCI National Intelligence Information and/or Foreign Intelligence Information on behalf of Rebecca Ahne, NAVAIR Senior Intelligence Officer. A final security clearance at the appropriate level is required for access to Non-SCI National Intelligence Information and/or Foreign Intelligence information. Further security guidance for reproduction, release, retention, return, and destruction of National Intelligence Information is stipulated in the attached NAVAIR Memorandum titled POLICY GOVERNING RELEASE OF INTELLIGENCE TO CONTRACTORS dated 01 MAR 2022. Written concurrence of the Technical Point of Contact/Contracting Officer Representative/Contracting Officer Representative for Security (as applicable) is required prior to subcontracting.

Item 10f: The contractor is authorized to access SECRET//SPECIAL ACCESS REQUIRED information at the locations annotated in block 8a for all programs listed in the DD-254 Classified Addendum (2021-15), in accordance with the policies and guidelines established in the Department of the Air Force Instructions (DAFI) 16-701 and DoDM 5205.07, dated 17 Jan 2025. Each of these programs must be in its own dedicated space unless shared use and periods processing is approved by the PSO. The Security Classification Guides for each of these programs, along with copies of the classified policy documents listed below (and any subsequent revisions), will be forwarded under separate cover due classification.

- Risk Management Framework (RMF), dated 18 Dec 2013

- Joint Special Access Program Implementation Guide (JSIG), Rev 4, dated 11 Apr 2016

- DoD Standards for Sanitization of SAP Information Tech. dated: 20 Apr 2020

- DoD Manual 5205.07, dated 17 January 2025

- DoD Manual 8140.03 Cyberspace Workforce Qualification and Management Program

The contractor organization is required to establish and implement an Insider Threat program as required per 32 CFR Part 117.7(d). All Insider Threat concerns regarding SAP accessed personnel will be reported to the AFOSI PJ PSO or local PJ Office within 24 hours. AFOSI PJ will notify the contractor if further reporting is required.

Item 10g: Access to NATO information requires a final U.S. Government clearance at the appropriate level and a NATO access brief. Special briefings are required for access to NATO. Written concurrence of the Technical Point of Contact/Contracting Officer Representative/ Contracting Officer Representative for Security (as applicable) is required prior to subcontracting.

Block 10.h – Foreign Government Information (FGI) is not releasable to contractor employees who have not received a final security clearance at the appropriate level. Written concurrence of the Technical Point of Contact/Contracting Officer Representative identified in Block 16, or Industrial Security Representative as applicable) is required prior to subcontracting.

Item 10j, 11l: Controlled Unclassified Information including…