Attachment No. 3 - Draft DD Form 254 - FA875126R0005.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

RELEASE OF NON-SENSITIVE COMPARTMENTED INFORMATION (NON-SCI)

INTELLIGENCE INFORMATION TO U.S. CONTRACTORS

1. Requirements for access to non-SCI intelligence:

a. All intelligence material released to the contractor remains the property of the U.S.

Government and may be withdrawn at any time. Contractors must maintain accountability for all classified intelligence released into their custody IAW DoDM5105.21-v1, DoDM5200.01-v1-3, and AFMAN 14-304.

b. The contractor must not reproduce intelligence material without the written permission of the originating agency through the Intelligence Support Office. If permission is granted, each copy shall be controlled in the same manner as the original.

c. The contractor must not destroy any intelligence material without advance approval or as specified by the Program Manager identified under Item 13 of the DD Form 254.

(EXCEPTION: Classified waste shall be destroyed as soon as practical in accordance with the provisions of the Industrial Security Program).

d. The contractor must restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract with a valid need to know. Further dissemination to other contractors, subcontractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the originating agency through the Program Manager identified under Item 13 of the DD Form 254.

e. The contractor must ensure each employee having access to intelligence material is fully aware of the special security requirements for this material and shall maintain records in a manner that will permit the contractor to furnish, on demand, the names of individuals who have had access to this material in their custody.

f. Intelligence material must not be released to foreign nationals or immigrant aliens whether they are consultants, U.S. contractors, or employees of the contractor and regardless of the level of their security clearance, except with advance written permission from the originator.

Requests for release to foreign nationals shall be initially forwarded to the contract monitor and shall include:

(1) A copy of the proposed disclosure.

(2) Full justification reflecting the benefits to U.S. interests.

(3) Name, nationality, particulars of clearance, and current access authorization of each proposed foreign national recipient.

g. Upon completion or termination of the classified contract, or sooner when the purpose of the release has been served, the contractor will return all classified intelligence (furnished or generated) to the source from which received unless retention or other disposition instructions (see AFMAN 14-304) are authorized in writing by the Program Manager identified under Item 13 of the DD Form 254.

h. The contractor must designate an individual who is working on the contract as custodian. The designated custodian shall be responsible for receipting and accounting for all classified material. The inner wrapper of all classified material dispatched should be marked for the attention of a designated custodian and must not be opened by anyone not working directly on the contract.

i. Within 30 days after the final product is received and accepted by the procuring agency, classified intelligence materials released to or generated by the contractor, must be returned to the originating agency, through the Program Manager identified under Item 13 of the DD Form 254, unless written instructions authorizing destruction or retention are issued.

Requests to retain material shall be directed to the Program Manager identified under Item 13 of the DD Form 254 for this contract in writing and clearly indicate the justification for retention and identity of the specific document to be retained.

j. Classification, regrading, or declassification markings of documentation produced by the contractor shall be consistent with that applied to the information or documentation from which the new document was prepared. If a compilation of information or a complete analysis of subject appears to require a security classification other than that of the source documentation, the contractor shall assign the tentative security classification and request instructions from the contract monitor. Pending final determination, the material shall be safeguarded as required for its assigned or proposed classification, whichever is higher, until the classification is changed or otherwise verified.

2. Intelligence material carries special markings. The following is a list of the authorized control markings of intelligence material:

a. “Dissemination and Extraction of Information Controlled by Originator (ORCON).”

This marking is used, with a security classification, to enable a continuing knowledge and supervision by the originator of the use made of the information involved. This marking may be used on intelligence which clearly identifies, or would reasonably permit ready identification of an intelligence source or method which is particularly susceptible to countermeasures that would nullify or measurably reduce its effectiveness. This marking may not be used when an item or information will reasonably be protected by the use of other markings specified herein, or by the application of the “need-to-know” principle and the safeguarding procedures of the security classification system.

b. Authorized for Release to (Name of the Country(ies)/International Organization).”

The above is abbreviated “REL .” This marking must be used when it is necessary to identify classified intelligence material the U.S. Government originator has predetermined to be releasable or has been released through established foreign disclosure channels to the indicated country(ies) or organization.

3. The following procedures govern the use of control markings.

a. Any recipient desiring to use intelligence in a manner contrary to restrictions established by the control markings set forth above shall obtain the advance permission of the originating agency through the Program Manager identified under Item 13 of the DD Form 254.

Such permission applies only to the specific purposes agreed to by the originator and does not automatically apply to all recipients. Originators shall ensure that prompt consideration is given to recipients’ requests in these regards, with particular attention to reviewing and editing, if necessary, sanitized or paraphrased versions to derive a text suitable for release subject to lesser or no control markings.

b. The control marking authorized above shall be shown on the title page, front cover, and other applicable pages of documents, incorporated in the text of electrical communications, shown on graphics, and associated (in full or abbreviated form‚ with data stored or processed in automatic data processing systems. The control marking also shall be indicated by parenthetical use of the marking abbreviations at the beginning or end of the appropriate portions. If the control marking applies to several or all portions, the document must be marked with a statement to this effect rather than marking each portion individually.

c. The control markings shall be individually assigned at the time of preparation of intelligence products and used in conjunction with security classifications and other marking specified by E.O. 13526 and its implementing security directives, in addition to previous Executive Orders. The marking shall be carried forward to any new format in which the same information is incorporated including oral and visual presentations.

4. Request for release of intelligence material to a contractor outside Rome Research Site must be prepared by the Program Manager identified under Item 13 of the DD Form 254 and submitted through the AFRL/RI SSO designated in Item 15 of the DD Form 254 to the Director of Intelligence (DI). This should be accomplished as soon as possible after the contract has been awarded. The request must include a copy of the DD Form 254 and the Statement of Work.

(Note: Program Manager identified under Item 13 of the DD Form 254 can obtain a copy of format from the AFRL/RI SSO designated in Item 15 of the DD Form 254).

COMSEC ACCESS AND /OR ACCOUNT

The contractor is governed by AFMAN 17-1302-O, AFKAG-2, and appropriate Air Force Systems Security Instructions/Manuals (AFSSI/AFSSM) or Air Force Instructions (AFI).

Access to COMSEC material or information is restricted to U.S. citizens holding final U.S.

Government clearances and is not releasable to personnel holding only a reciprocal clearance.

Personnel requiring COMSEC access shall be briefed in accordance with AFMAN 17-1302-0 (COMSEC User Requirements). NOTE: The COMSEC briefing applies only to the use and control of cryptographic equipment and specialized COMSEC publications. NACSIM/

NACSEM documents are not considered COMSEC controlled material. Additionally, cryptographic information/equipment shall be retained in a contractor facility user COMSEC account in accordance with current guidelines. The Air Force program/project manager shall designate the number of personnel requiring COMSEC access. The number will be limited to the minimum necessary and will be on a strict need-to-know basis.

When COMSEC support, including STE’s, are provided by an AF COMSEC Account, the contractor must comply with AFMAN 17-1302-O.

The contractor is governed by National Industrial Security Program Operating Manual

(NISPOM). Access to COMSEC information or material is restricted to U.S. citizens holding final U.S. Government clearances and is not releasable to personnel holding only a reciprocal clearance. Personnel requiring COMSEC access shall be briefed in accordance with DOD

5220.22-M. NOTE: The COMSEC briefing applies only to the use and control of cryptographic equipment and specialized COMSEC publications and/or information. NACSIM/NACSEM documents are not considered COMSEC controlled material. Additionally COMSEC information or equipment must be retained in a contractor facility COMSEC account in accordance with DOD 5220.22-M. If COMSEC support, including STE’s is provided by an Air

Force COMSEC account, the contractor must comply with AFMAN 17-1302-O, COMSEC User Requirements.

Protecting Controlled Unclassified Information (CUI) In accordance with DoDI 5200.48

In addition to classified information, certain types of unclassified information also require application of access and distribution controls and protective measures for a variety of reasons;

such information is referred to collectively as Controlled Unclassified Information (CUI). This attachment will identify the controls and protective measures developed for DoD CUI in accordance with Executive Order (E.O.) 13556; Part 2002 of Title 32, Code of Federal Regulations (CFR); and Defense Federal Acquisition Regulation Supplement (DFARS) Sections 252.204-7008 and 252.204-7012.

1. All DoD CUI must be controlled until authorized for public release in accordance with DoD Instructions (DoDIs) 5230.09, 5230.29, and 5400.04, or DoD Manual (DoDM) 5400.07. Official DoD information that is not classified or controlled as CUI will also be reviewed prior to public release in accordance with DoDIs 5230.09 or 5230.29.

2. Information will not be designated CUI in order to:

• Conceal violations of law, inefficiency, or administrative error.

• Prevent embarrassment to a person, organization, or agency.

• Prevent open competition.

• Control information not requiring protection under a law, regulation, or government-wide policy, unless approved by the CUI EA at the National Archives and Records Administration (NARA), through the Under Secretary of Defense for Intelligence and Security (USD(I&S)).

3. Handling Requirements:

1. The DoD originator or authorized CUI holder must ensure a prepublication and security policy review is conducted, pursuant to the standard DoD Component process, before CUI is approved for public release, which includes publication to a publicly accessible website.

2. Decontrolling and releasing CUI records will be executed by the originator of the information, the original classification authority (OCA) if identified in a security classification guide, or designated offices for decontrolling CUI pursuant to the procedures for the review and release of information under the FOIA in accordance with the November 19, 2018 ISOO Notice. There are no specific timelines to decontrol CUI unless specifically required in a law, regulation, or government-wide policy. Decontrol will occur when the CUI no longer requires safeguarding and will follow DoD records management procedures.

b. OCAs will determine if aggregated CUI under their control should be classified in accordance with Volume 1 of DoDM 5200.01 and will confirm the relevant SCGs address the compilation.

c. DoD information systems processing, storing, or transmitting CUI will be categorized at the “moderate” confidentiality impact level and follow the guidance in DoDIs

8500.01 and 8510.01. Non-DoD information systems processing, storing, or transmitting CUI will provide adequate security, and the appropriate requirements must be incorporated into all contracts, grants, and other legal agreements with non-DoD entities in accordance with DoDI

8582.01. See Section 5 of this issuance for more information on CUI and its application to industry.

d. The DoD CUI Registry provides an official list of the Indexes and Categories used to identify the various types of DoD CUI. The DoD CUI Registry mirrors the National CUI

Registry, but provides additional information on the relationships to DoD by aligning each Index and Category to DoD issuances.

(1) The official DoD CUI Registry of categories can be accessed on Intelink at https://intelshare.intelink.gov/sites/ousdi/hcis/sec/icdirect/information/CUI/Forms/AllItems.a spx.

(2) The site will be updated as changes to the DoD CUI Registry are made based on official notification from the CUI EA through the CUI Registry Working Group; changes to law, regulation, or government-wide policy; or notification that the information no longer meets the requirements for CUI.

4. Markings: This paragraph covers the essential marking requirements for initial phased implementation of the DoD CUI Program.

a) At minimum, CUI markings for unclassified DoD documents will include the acronym “CUI” in the banner and footer of the document.

b) If portion markings are selected, then all document subjects and titles, as well as individual sections, parts, paragraphs, or similar portions of a CUI document known to contain CUI, will be portion marked with “(CUI).” Use of the unclassified marking “(U)” as a portion marking for unclassified information within CUI documents or materials is required.

(1) There is no requirement to add the “U,” signifying unclassified, to the banner and footer as was required with the old FOUO marking (i.e., U//FOUO).

(2) Banners, footers, and portion marking will only be marked “Unclassified” or “(U)” for unclassified information in accordance with the June 4, 2019 ISOO letter. If the document also contains CUI, it will be marked in accordance with Paragraph 3.4.a. and additional forthcoming guidance.

c) CUI markings in classified documents will appear in paragraphs or subparagraphs known to contain only CUI and must be portion marked with “(CUI).” “CUI” will not appear in the banner or footer.

(1) There will be an acknowledgement added to the warning box on the first page of multi-page documents to alert readers to the presence of CUI in a classified DoD document, as shown in Figure 1.

(2) Volume 2 of DoDM 5200.01 requires DoD intelligence producers to follow DNI formats for intelligence production under the authority of the DNI. When DoD CUI is incorporated into a Digital Access Policy under the authority of the DNI, the information and the document will follow the Digital Access Policy standards established by the DNI.

d) The dissemination marking “not releasable to foreign nationals (NOFORN or NF)” is an intelligence control marking used to identify intelligence information an originator has determined meets the criteria of Intelligence Community Directive 710 and Intelligence Community Policy Guidance 403.1, which provides guidance for further dissemination control markings. It must be applied to controlled unclassified intelligence information that is properly characterized as CUI with appropriate CUI markings. CUI identified with this marking will not be provided, in any form, to foreign governments (including coalition partners), international organizations, foreign nationals, or other non-U.S. persons without the originator’s approval in accordance with E.O.s 13526 and 13556. If originator approval is required for further dissemination, the originator will mark the requirement on the information in accordance with Section 4.1(i)(1) of E.O. 13526.

(1) The application of the control marking “not releasable to foreign nationals” (NOFORN or NF) will only be applied, when warranted, to unclassified intelligence information properly categorized as CUI and reviewed by a Foreign Disclosure Officer to ensure there are no international agreements in place to prohibit its use and prohibiting sharing.

(2) The control marking NOFORN or NF will be applied to Naval Nuclear Propulsion Information (NNPI), Unclassified Controlled Nuclear Information (UCNI), National Disclosure Policy (NDP-1), and cover and cover support information. When warranted, it can be applied to unclassified information properly categorized as CUI having a licensing or export control requirement. Before marking a document or material as NOFORN or NF, it will be reviewed by the Foreign Disclosure Officer to ensure there are no agreements in place to prohibit its use and sharing.

(3) The application of “Releasable to” (“REL TO”) can only be applied, when warranted and consistent with relevant law, regulation, or government-wide policy or DoD policy, to information properly categorized as CUI with an export control or licensing requirement with a foreign disclosure agreement in place.

(a) Export-controlled CUI transfers to foreign persons must be in accordance with the Arms Export Control Act, International Traffic in Arms Regulations, Export Control Reform Act, Export Administration Regulations, and DoDI 2040.02. In accordance with DoDDs 5230.11 and 5230.20, a positive foreign disclosure decision must be made before CUI is released to a foreign entity.

(b) DoD operational CUI (not related to intelligence) may be marked as REL TO.

e) All classified documents, including legacy documents will be reviewed for CUI and properly marked upon changes in the document’s classification level, particularly if the documents are to be completely declassified.

f) The first page or cover of any document or material containing CUI, including a document with commingled classified information, will include a CUI designation indicator, as shown in Figure 2. This CUI designation indicator is similar to the classification-marking block used for CNSI documents and materials. Documents and materials containing CUI will require a generic “CUI” marking at the top and bottom of each page.

(1) In accordance with Part 2002 of Title 32, CFR, the CUI designation indicator must contain, at minimum, the name of the DoD Component determining that the information is CUI. If letterhead or another standard indicator of origination is used, this line may be omitted.

(2) The second line must identify the office making the determination.

(3) The third line must identify all types of CUI contained in the document.

(4) The fourth line must contain the distribution statement or the dissemination controls applicable to the document.

(5) The fifth line must contain the phone number or office mailbox for the originating DoD Component or authorized CUI holder.

g) During DoD’s initial phased implementation of the CUI Program, there is no required distinction that must be made between Basic and Specified CUI. All DoD information will be protected in accordance with the requirements under the Basic level of safeguards and dissemination unless specifically identified otherwise in a law, regulation, or government-wide policy. Forthcoming guidance will address the distinction between the two levels of CUI, including a list of which categories are Basic or Specified, what makes the category one or the other, and the unique requirements, to include markings, for each.

5. Requirements for DoD Contractors

a. Whenever DoD provides information to contractors, it must identify whether any of the information is CUI via the contracting vehicle, in whole or part, and mark such documents, material, or media in accordance with this issuance.

b. Whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities, protective measures and dissemination controls, including those directed by relevant law, regulation, or government-wide policy, will be articulated in the contract, grant, or other legal agreement, as appropriate.

c. DoD contracts must require contractors to monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information. DoD contracts shall require contractors to report the potential classification of aggregated or compiled CUI to a DoD representative.

d. DoD personnel and contractors, pursuant to mandatory DoD contract provisions, will submit unclassified DoD information for review and approval for release in accordance with the standard DoD Component processes and DoDI 5230.09.

e. All CUI records must follow the approved mandatory disposition authorities whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and this issuance.

LOCAL SECURITY PROCEDURES

FOR THE

AIR FORCE RESEARCH LABORATORY

INFORMATION DIRECTORATE

AFRL/RI

525 BROOKS ROAD

ROME NY 13441

1. Contractual Agreement:

a. This agreement, implemented by DoD Manual 5220.32, Volume 1, National

Industrial Security Program: Industrial Security Procedures for Government Activities, and DoD 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), Section 117.15, sub section (A), are issued to satisfy the requirements of the Air Force Federal Acquisition Regulation (AFFARS) subpart 5304.4 and AFFARS Contract Clause 5352.204-9000, Notification of Government security activity and Visitor Group Security Agreements (VGSA). This agreement is accomplished by providing a copy of local security policies related to the protection of classified information.

b. These local security procedures will describe the specific actions need to be taken by contractor personnel and government personnel to properly protect classified information involved in on-base contract performance within AFRL/RI.

All parties will perform the functions specified by this document in a timely manner and all parties will be notified of contract completion.

2. Responsibilities:

The specific responsibilities are delineated as follows:

As used in this agreement, the terminology Visitor Group (VG), contractor, company, and Home Office Facility (HOF) are synonymous. Furthermore, the verbiage Air Force (AF) activity, unit, Contracting Officer (CO), Government Program/Project Manager (GPM), Servicing Security Activity (SSA), etc., refers to entities or representatives of the Air Force in their appropriate and respective capacity. As used in this agreement, the following office focal points are hereby identified for Rome Research Site (RRS):

-RRS Servicing Security Activity (SSA): AFRL/RIOF, (315) 330-4048 -RRS Industrial & Information Security: AFRL/RIOF, (315) 330-2119 -RRS Personnel Security: AFRL/RIOF, (315) 330-3119 -RRS Badging Office: AFRL/RIOF, (315) 330-2916 -RRS Security Forces 24 Hour Desk: AFRL/RIOF, (315) 330-2961

3. Visitor Group Security Supervision:

a. Under the terms of this agreement, the contracting company will operate per

DoDM 5200.01, DoD Information Security Program, Air Force Instruction (AFI) 16- 1404, Information Security Program Management (and supplements thereto), and Security Program Operating Instructions.

b. The RRS SSA is responsible for providing security program oversight and the unit Staff Agency Security Manager (SASM) is responsible for implementing and managing the security program per DoDM 5200.01, AFI 16-1404 and all supplements, and AFI 16-1406_AFGM2018-02, Air Force Industrial Security Program and all supplements.

c. The contractor’s Facility Security Officer (FSO) for the location identified in

Block 6a or 8a of the DD Form 254, DoD Contract Security Classification Specification, shall be responsible for implementing security requirements of the contract as identified in the DD Form 254 and this document. The VG Home Office Facility (HOF) will identify in writing, to the RRS SSA, an on-site employee to interface with and serve as the VG’s Security Focal Point (SFP) for security related matters. The FSO’s name, address, and phone number will also be provided.

These notifications will be in writing and updated as changes occur.

4. Standard Practice Procedures (SPP): There is no requirement to develop SPP or addendum/supplement to the company’s SPP outlining security responsibilities at AFRL/RI. A copy of the corporate SPP is not required.

5. Access to and Accountability of Classified Material:

a. All access to and/or possession of classified material by on-base contractor personnel, including oral and/or visual, within Rome Research Site (RRS), will be under AFRL/RRS Air Force supervision. The Government Program Manager (GPM) will maintain accountability, control, and ownership of all classified information involved under the terms of this contract. The contractor’s access to classified information will be controlled by the Government Program Manager (GPM) and limited to "contract-specific, need-to-know" information only.

b. If contractor personnel discover unattended classified material or an unsecured/unattended security container, they will immediately secure the classified materials and notify the GPM and their Division SASM. During non-duty hours, contractor personnel will notify the Rome Research Site DoD police law enforcement desk, AFRL/RIOF, 330-2961. Classified material will be turned over to the RRS security police when the designated safe custodian, GPM, or SASM cannot be contacted.

6. Storage of Classified Material:

a. The GPM may authorize the contracting company to store and handle classified material required for performance on this contract. All classified information shared with the contractor must be stored in an approved government owned and controlled security container. The contracting company is prohibited from establishing and/or maintaining a separate classified information system. The number of employees authorized access to the security container will be kept to the minimum number required for efficient contract performance. All classified material will be returned and secured in the designated government security container at the end of each duty day.

b. All access to and/or possession of classified material by on-base contractor personnel, including oral and/or visual, at the location of AFRL/RRS, will be under the AF activity’s oversight. Each container will have a government safe custodian appointed, the responsibility for setting the storage container combination rests with the division Safe Custodian. The GPM must ensure the safe custodian is notified when a contract employees with access no longer require it.

7. Transmission of Classified Material/Information:

a. Receipt and Dispatch of classified material is the responsibility of the government. The contractor is NOT authorized to perform these activities unless they are specifically contracted for and identified in the Statement of Work or Performance Work Statement and comply with DoDM 5200.01/AFI 16-1404. If so authorized, the division SASM must provide contractor personnel training on mail handling procedures, to include proper securing of Registered, Certified, USPS Express and FedEx mail and/or First Class mail. However, under no circumstances will the contractor be authorized to open a classified package beyond the outer wrapper to determine further distribution or sign the classified document receipt.

b. Classified material transmitted via U.S. postal channels or approved commercial carrier, directly from and processed through the AFRL/RI classified information control system/channels of the AF activity.

c. Classified material may be hand carried on to or out of AFRL/RI by appropriately cleared and briefed contractor personnel, provided the employee is so designated in writing by the contractor’s FSO as a courier and the AFRL/RI authorizing official.

8. Disposition of Classified Material. The contractor will return all classified information jointly shared and/or involved, under the terms of this agreement, to the GPM at the end of contract performance or when no longer required, unless authorized to do otherwise by the government CO.

9. Reproduction of Classified Material. The contractor cannot reproduce classified material without the permission of the GPM authorized to grant approval. AFRL/RI approved and controlled reproduction equipment will be the only equipment used by the VG per DODM 5200.1, AFI 16-1404, and AFRL/RI Operating Instructions for reproduction.

10. Security Education:

a. The SFP shall:

1. Ensure contractor employees who require access to classified information and/or controlled unclassified information, or have access to government Information Technology (IT) systems, receive an initial security briefing regarding their individual responsibility to protect government information, for safeguarding classified information; assets and personnel, and participate in the government’s recurring security education & training program.

b. The FSO shall:

1. Ensure all employees are briefed IAW DoD 32 CFR Part 117 (National

Industrial Security Program Operating Manual (NISPOM).

c. The division SASMs shall:

1. Administer security education training per DoDM 5200.1, AFI 16-1404 and AFRL/RI Operating Instructions and maintain documentation of participation.

11. Personnel Security:

a. For all employees, who require access to classified information, the FSO will:

1. Ensure employees are entered into the Defense Information System for

Security (DISS) JVS and associated with the company Commercial and Government Entity (CAGE) Code.

2. Submit Visit Authorization Letter(s) (VAL) or Visit Request(s) (VR) for onsite employees to the AFRL/RRS Badging Office, RIOF.

3. Ensure employees have accomplished Part 1 of the SF 312, Classified Information Nondisclosure Agreement and that it is documented in DISS JVS.

4. Notify the division SASM upon report of any adverse information on contractor personnel or any change in the employee’s status that might cause the access to classified information to be terminated prior to the end date of the period of performance.

12. Reporting Requirements:

a. Reporting Adverse Information and Suspicious Contacts. Contractor employees shall notify or submit the appropriate report to AFRL/RRS IP Office, RIOF. AFRL/RIOF will notify the FSO so the NISPOM reporting requirements may be satisfied.

b. Reporting Espionage, Sabotage, and Subversive Activities. Contractor employees shall notify or submit the appropriate report to AFRL/RRS IP Office, RIOF. AFRL/RIOF will report espionage, sabotage, subversive activities, deliberate compromises of classified information, and leaks of classified information to the media involving the contractor to AFOSI. AFRL/RIOF will also comply with additional reporting requirements as outlined in AFI 16-1406 and provide the FSO a courtesy copy.

c. Reports of Loss, Compromise, and Possible Compromise. Contractor employees will comply with the procedures outlined in the AFRL/RRS RI OI for reporting security incidents. All security incidents involving the contractor will be handled as outlined in the AFRL/RRS RI OI, the DoDM 5200.01 and AFI 16-1404.

The Division Chief and/or Deputy appoint inquiry or investigation officials. Inquiry or investigation officials coordinate findings and reports with the appointing official, through the RRS SSA, to the AFRL/RI Director.

d. The contracting company’s HOF will advise the RRS SSA and the SASMs of any changes in management, location, address, or contractual performance requirements.

13. Contractor Badges:

a. Common Access Cards (CAC) will be issued and returned in accordance with

Air Force Federal Acquisition Regulation supplement (AFFARS) Subpart 5352.242- 9001, CACs for Contractor Personnel. CACs will be turned in upon termination, change of contract, or when requested by the AFRL/RRS/Badging Office, RIOF.

b. Contractor personnel that do not require a CAC will be issued a the

Controlled Area Badge (proxy badge) which allows for entry onto AFRL/RI facilities. Once the need for unescorted entry is no longer needed or the task has expired, the proxy badge will be turned in to the AFRL/RRS/Badging Office, RIOF.

c. The RRS Form 110, prepared by the GPM and approved by the Division Chief, is required to be completed prior to issuance of entry credentials. Request for badge issuance must be supported by a current VAL or VR. The SASM will be notified of contractor badges due to expire and will forward this information to the appropriate company SFP and to the GPM for action.

d. Contractor personnel must be recognizable as a contractor. Each employee must be identifiable as a contractor by wearing in clear view: (1) the contractor CAC or (2) the Contractor proxy badge which clearly identifies personnel as a contractor.

e. Additional entry credentials for other Air Force installations are issued at the request of the GPM. Upon termination of work or contract completion contractor personnel will return the badges to AFRL/RRS Badging Office, RIOF.

14. Security Checks: contractor personnel will be scheduled to perform end-of-day security checks within their assigned work areas by the GPMs per DoDM 5200.01, AFI 16-1404, and AFRL/RI Operating Instructions. These checks will ensure security precautions are taken to protect classified material. The Standard Form 701, Activity Security Checklist, and Standard Form 702, Security Container Check Sheet, will be used to record these checks.

15. Emergency Protection. Contractor personnel will comply with DoDM 5200.01, AFI 16-1404 and AFRL/RRS/RI Operating Instructions.

16. Protection of Government Resources: The contractor will comply with RRS SF OI 31-101, Installation Security Program, and other security and safety operating instructions in effect within the Rome Research Site.

a. The GPM is responsible for providing the necessary training and procedures to ensure compliance. Contractor maintained files will abide by government records management rules and fall under the government file plan within that branch where the contractor is assigned. File systems containing classified records will be maintained in accordance with AFMAN 37-123.

b. Contracting companies are prohibited from establishing their own Information Technology (IT) systems/networks (Local Area Networks (LAN), Wide Area Network (WAN), cell phone/USB Modem as WAN, Wi-Fi as WAN, etc.)

without the direct permission of governing communications and responsible information systems office.

17. Clarification of Security Requirements: The contracting companies HOF and SFP will address inquiries or questions pertaining to the provisions of DoDM 5200.01, AFI 16-1404, AFRL/RRS/RI Operating Instructions, and supplements thereto, to the GPM.

18. Contract and Associated DD Form 254: The contracting companies SFP or HOF will maintain on file a copy of all contracting documents, any associated DD Form 254(s), and its attachments. The responsible GPM, along with the CO, will review the DD Form 254 at least a biennial basis and issue revisions as necessary.

19. Foreign Involvement: Under the terms of this agreement, the contractor is required to notify the GPM and contracting office, prior to any foreign involvement (non U.S. citizen or foreign national), regardless of access requirements or the sensitivity of information to be disclosed (classified or unclassified).

20. Security Reviews:

a. Staff Assistance Visits (SAVs), Annual Local Information Protection

Management Evaluations (LIPMEs), and Self-Inspections will only take place within RRS facilities and will not be conducted at the company office. Program Reviews will be conducted by the RRS SSA in conjunction with the AFRL Division scheduled Information Security Program Review.

b. The RRS SSA conducts security program reviews, if applicable, in the following manner:

(1) The RRS SSA will notify and schedule all program reviews through the division SASM. Program reviews will be conducted per DoDM 5200.01, AFI 16- 1404, supplements thereto, and this agreement. A copy of the program review report will be provided to the contractor by the division SASM upon request. The contractor is not required to acknowledge receipt or respond unless directed to do so in the report.

(2) The RRS inspection program and self-inspection program will include the contractor. AFRL/RI will incorporate employees performing security duties within their facilities into their semiannual security self-inspection program. Divisions will use the local security procedures and the self-inspection criteria to monitor the contractor’s performance and compliance. The division SASMs will document and maintain the inspection report as required by DoDM 5200.01 and AFI 16-404.

22. Expenditure of Funds for Security. This agreement is not an authorization for a commitment of funds. Nothing in this agreement shall be construed to impose any liability on the part of the U.S. government for injury to the agents, contractor employees, its subcontractors, assignees, or other individuals acting for or on behalf of the company, or property of the same, nor shall anything within this local security procedures change existing contracts.

23. Review of this Agreement. The GPM and SFP must review this agreement for accuracy at least annually, required changes should be reported to IP Office, AFRL/RIOF. AFRL/RIOF is the responsible office to accomplish updates to the local security procedures.

24. Subcontracts:

a. DD 254: A subcontract DD 254 shall be initiated, IAW the NISPOM, whenever the HOF or on-base contractor enters into a subcontract arrangement with another contractor that will require access to classified information and be physically located on-site for a minimum of 90 days. A separate DD Form 254 is completed for each subcontractor requiring access to classified information. The contractor or its HOF, as applicable, is responsible for preparing the DD Form 254 for any subcontractors and must provide a SIGNED copy to the GPM, SFP and the IP Office, AFRL/RIOF.

b. Local Security Procedures: Ensure the subcontractor complies with these local security procedures or enter into a separate agreement with the subcontractor. The prime contractor is responsible for ensuring agreement to comply is documented and a copy of the documentation provided to GPM, SFP and the AFRL/RRS IP Office, AFRL/RIOF. IF a separate agreement is prepared, a copy must be provided to GPM, SFP and the AFRL/RRS IP Office, AFRL/RIOF.

c. VISIT REQUESTS: Subcontractors are required to submit independent Visit

Requests to the AFRL/RRS/RI badging office via JPAS.

24. Other:

a. Forms: AFRL/RI furnishes all government forms and applicable AFIs, OIs, and/or security plans required in support of this agreement.

b. Contract Completion Notification: The GPM, in coordination with the SFP, will notify the RRS/SSA, 30 days prior to contract completion or shutdown on RRS, so the RRS/SSA may review the contractor's operations and ensure proper disposition of classified materials per DoDM 5200.01, AFI 16-1404, and this security agreement.

25. In consonance with joint security responsibility and common purpose to protect classified information, authorized officials have agreed to the contents of this document as evidenced below. This document will remain valid thru the contract’s period of performance.

1. Contractual Agreement:

2. Responsibilities:

3. Visitor Group Security Supervision:

5. Access to and Accountability of Classified Material:

6. Storage of Classified Material:

7. Transmission of Classified Material/Information:

10. Security Education:

11. Personnel Security:

12. Reporting Requirements:

13. Contractor Badges:

20. Security Reviews:

24. Subcontracts:

24. Other:

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

(Updated 20250815)

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

August 31, 2028 The public reporting burden for this collection of information, 0704-0567, is estimated to average 36 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD Form 254, "DoD Contract Security Classification Specification" Hide Attachment Bar

(See Instructions) - Select from drop-down list: 1