Attachment4-DD254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

Handbook For PreParing dd Form 254, dod contract security classiFication sPeciFication

July 2020

Servicing Security Activity (SSA)

75 ABW/IPD

7981 Georgia Street Hill

AFB UT 84056 586-1204

Supersedes all previous editions

OPR: Ms. LaShonda Arocha, 75 ABW/IPD, 777-5490

TABLE OF CONTENTS

Page

FOREWORD 4

SECTION 1 - GENERAL INFORMATION/DD FORM 254 PROCESSING

PROCEDURES 5-6

SECTION 2 – INSTRUCTIONS FOR PREPARING A DD FORM 254 7-38

2.1. ITEM 1.a. and 1.b. 7-8

2.2. ITEM 2.a., 2.b., and 2.c. 8-9

2.3. ITEM 3.a, 3.b., and 3.c. 9-10

2.4. ITEM 4 10-11

2.5. ITEM 5 11

2.6. ITEM 6.a., 6.b., and 6.c. 11-12

2.7. ITEM 7.a., 7.b., and 7.c. 12

2.8. ITEM 8a., 8.b, and 8.c. 12-14

2.9. ITEM 9 14

2.10. ITEM 10 14-22

2.11. ITEM 11 22-32

2.12. ITEM 12 32

2.13. ITEM 13 32-33

2.14. ITEM 14 33-34

2.15. ITEM 15 34-36

2.16. ITEM 16 36-37

2.17. ITEM 17 37

2.18. ITEM 18 37-38

SECTION 3 - DD FORM 254 ATTACHMENTS AND ADDENDUMS 39-46

SENSITIVE COMPARTMENTED INFORMATION (SCI) CLAUSES 39-41

NON-SCI CLAUSES ADDENDUM 42-43

SPECIAL ACCESS PROGRAM GUIDANCE 44-45

OPERATIONS SECURITY (OPSEC) ATTACHMENT 46

SECTION 4 47-54

4.1. SERVICING SECURITY ACTIVITY (SSA) ADDRESSES 47-50

4.2. ABBREVIATIONS AND ACRONYMS 51-53

SECTION 5 - REFERENCES 54

SUMMARY OF CHANGES: This Handbook has been revised to reflect the changes to the OPSEC Addendum, and is effective 10 February 2020.

FOREWORD

1. Over half of the classified material in the United States is in the hands of cleared contractor facilities and approximately one-half of the U.S. Citizens who hold personnel security clearances work for cleared companies that have contracts with the U.S. Government. The National Industrial Security Program (NISP) exists to ensure classified information released to cleared contractor companies is properly safeguarded. Since a contractor company assumes a great deal of responsibility when entering into a classified contract with the U.S. Government, they require a well- prepared DD Form 254, DoD Contract Security Classification Specification, to properly protect classified information/material entrusted to them.

2. The Federal Acquisition Regulation (FAR) requires that a DD Form 254 be incorporated into every classified contract. This handbook provides detailed instructions for preparing the DD Form 254 and should be used in conjunction with DOD 5220.22-R, Industrial Security Program Regulation; DOD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM); and AFI 16-1406, Air Force Industrial Security Program. It is designed to assist contracting activities and program/project managers to accurately and completely prepare initial and revised DD Forms 254 for classified contracts they issue. Applicable security professionals who assist and coordinate on DD Forms 254 should also use this handbook. A classified contract is any contract, which requires any industry-contracting source to access, receive, or generate classified documents or other material, in performance of the contract.

3. Although the DD Form 254 is one of the most important forms in the industrial security program, it is also one of the most misunderstood forms. With applicable attachments and incorporated references, the DD Form 254 is the only contractually binding document used to communicate classification guidance on how the user agency wants contractors to protect and handle classified information/material released to them under a classified contract. It is used by the government to provide security requirements and appropriate classification guidance to contractors. It advises contractors on what needs to be protected, to what degree, and tells them which Security Classification Guide (SCG) or other guidance should be used. It also provides the location for contract performance and indicates security oversight responsibilities. The program/project manager is responsible for preparing the form, however contracting officers (contract knowledge), program managers (program knowledge), and applicable security disciplines, Information Security; Industrial Security; Operations Security (OPSEC); Communication Security (COMSEC), Sensitive Compartmented Information (SCI)/Non-SCI Intelligence and Special Access Program (SAP) all working together will provide a high-quality end product. Although it should be written as specific as possible, it should also be detailed enough to cover all aspects of the contract and should not include extraneous information.

4. This handbook is for use by Hill AFB personnel to provide comprehensive and accurate instructions for the preparation of a DD Form 254. It contains step-by-step procedures for filling out the form. The instruction in the main body of this handbook corresponds to the numbered items in the form. Users of this handbook are encouraged to submit suggestions and comments for improvement to the 75 ABW/IPD, 7981 Georgia St., Building 1102, Hill AFB UT 84056 (lashonda.arocha.2@us.af.mil).

This handbook and information, to include VGSA templates may be found on the HAFB Industrial Security share point at: https://org2.eis.af.mil/sites/21341/ip/industrialsecurity/default.aspx.

mailto:lashonda.arocha.2@us.af.mil https://org2.eis.af.mil/sites/21341/ip/industrialsecurity/default.aspx

SECTION 1 GENERAL

INFORMATION/

DD FORM 254 PROCESSING PROCEDURES

1. The government provides classification guidance to prime contractors for classified contracts primarily by incorporating a DD Form 254 into every classified contract.

2. The AF program, project, or activity prepares a DD Form 254 for:

a. Solicitations/award contracts under which contractor personnel will require access to classified information/material at the contractor’s facility.

b. Solicitations/award contracts under which contractor personnel will require access to classified on a government installation.

3. The 75 ABW/IPD, is the Servicing Security Activity (SSA) for classified contractor operations located on Hill AFB UT. The DD Form 254 coordination procedures are as follows:

a. The initial DD Form 254, referred to as a draft, is prepared by the program office for each contract involving classified information; the draft DD Form 254 can either be a solicitation, where the AF activity identifies a list of contractor companies to bid/compete for a specific contract, or an award contract, where a contractor has already been selected or is “sole source”. The Contracting Officer (CO), the SSA, and other applicable security disciplines (i.e. AF security manager, Communications Security (COMSEC), SCI and Non-SCI, Operations Security (OPSEC) and Special Access Program (SAP)) or functional OPRs affected under the terms of the contract should be consulted when preparing the draft DD Form 254 to ensure accuracy.

b. Once the draft DD Form 254 is completed, it must be distributed for review and coordination by all affected security disciplines. When submitting the DD Form 254 for coordination, include a complete copy of the Performance Work Statement (PWS), Statement of Work (SOW), or Statement of Objective (SOO). Coordination is annotated in Item 13 of the DD Form 254, or on a separate coordination/signature page attached to the DD FM 254, if the coordination will require more than six reviewers digital signatures (electronic signatures should include office symbol and date); See Item 13 instructions on Pages 32-33 for further information. Coordination/signature is completed as follows (if necessary):

(1) AF Program Manager Project Officer

(2) AF Security Manager/Unit OPSEC program coordinator

(3) COMSEC/TEMPEST, 75 ABW/SCXS

(4) SCI and Non-SCI Intelligence, AFLCMC/INL

(5) Foreign Disclosure, AFLCMC/WFNH

(6) NC2-ESI, AFNWC/NIOS (Only for AFNWC contracts)

(7) Special Access Program (SAP), AFOSI PJ/DET 1 OL-A

(8) SSA, 75 ABW/IPD/OPSEC Program Manager

NOTE: Coordination for 3, 4, 5 and 6 does not have to be followed exactly as listed (At a minimum, signature blocks (digitally or physically signed) will show coordination of the system, program or project manager, the unit security manager, and 75 ABW/IPD).

Installation Program Manager Points of Contact:

COMSEC/TEMPEST – Mr. Daniel Hoyle, 75 ABW/SCXS, 777-3557 SSA – Ms. LaShonda Arocha, 75 ABW/IPD, 777-5490 (SSO) SCI and Non-SCI Intelligence – Mr. Jason R. Blake, AFLCMC/INL, 777-0484 Foreign Disclosure – Mr. David Johns, AFLCMC/WFNH, 586-1387 SAP - Mr. Benjamin Pugmire, AFOSI PJ/DET 1 OL-A, 777-0340 NC2-ESI – (Only for AFNWC contracts) Mr. Brent Molnar, AFNWC/NIOS, 777-8772 OPSEC Program Manager – DD FM 254 reviews conducted by Ms. LaShonda Arocha, 75 ABW/IPD, 777-5490, for Installation OPSEC Program Manager Mr. Jimmy Perkins. 75 ABW/XP, 586-8008; this does not negate the responsibility of Unit OPSEC Coordinators to review and identify OPSEC requirements for each contract IAW AFI 10-701.

4. After the DD Form 254 is reviewed and receives the required coordination, the program office forwards it to the Contracting Officer (CO) or Contracting Officer’s Representative (COR). Once coordinated has been completed no changes may be made to the DD Form 254 without approval from the CO or COR.

5. The CO/COR receives the draft DD Form 254 and verifies all affected security disciplines and OPRs have reviewed and coordinated the DD Form 254.

6. The CO/COR certifies/issues the DD Form 254 by signing in Block 17.h

7. Distribution:

a. Once the DD Form 254 for a solicitation is signed, it is distributed to the respective contractor/s for proposal, quote, or bid. Once a contractor is selected and a prime contract number is assigned, the program manager MUST prepare another DD Form 254, referred to as an award DD Form 254, which must once again be distributed for review and coordination by all affected security disciplines (see 3.b 1–7 for coordination and distribution).

b. For contracts (DD Form 254’s) that are initially awarded a prime contract number, or a solicitation where a contractor has been selected and a prime contract number assigned and re-coordinated, the Procuring Contracting Officers (PCO) or their designated representatives are responsible for distributing the completed DD Form 254 to the required distribution listed in blocks 18.a.-18.f., in addition to any security offices annotated in Block/s 8.c of the DD Form 254 if not already listed in Block 18.f/Others as Necessary.

c. If performance will occur on another AF installation the PCO or their designated representative will provide a signed copy of the DD Form 254 to the ISPM (SSA) at that location.

d. A revision to the DD Form 254 must be issued anytime the security guidance within the DD Form 254 changes.

e. Program managers must provide security managers and 75 ABW/IPD written notifications when contract performance has been terminated or completed.

SECTION 2: INSTRUCTIONS FOR PREPARING A DD FORM 254

PREPARING DD FORMS 254:

2.1 ITEM 1: CLEARANCE AND SAFEGUARDING:

1.a Level of Facility Clearance Required:

(1) Since an FCL is required to perform on a contract or procurement action with access to classified information, insert the highest level of FCL required for the contractor to perform in item 1a (i.e., insert the highest level of classified information to which contractor employees require access to in order to perform on the contract/effort).

(2) Only one of three classification levels may be listed in this box: Confidential, Secret, or Top Secret. Do not cite special categories (e.g., such as Restricted Data, Formerly Restricted Data, Communications Security Information (COMSEC), Sensitive Compartmented Information (SCI), or Special Access Program (SAP)).

(3) The contractor must have a valid facility clearance (FCL) at least as high as the classification level indicated in this item. To verify the contractor’s FCL, contact the DCSA (Defense Counterintelligence and Security Agency) Central Verification Activity at (888) 282-7682 or log on to the DCSA NCAISS web site (https://ncaiss.dss.mil/dss-cac-login/cert/login); then follow the instructions to either login or request access, or contact Ms. LaShonda Arocha, 75 ABW/IPD, at 777-5490.

(4) If the company does not have an FCL, then the Government Contracting Activity (GCA) or prime contractor for a subcontract must sponsor the company for an FCL at the required FCL level by submitting an FCL request to Defense Counterintelligence and Security Agency (DCSA) through the NISS (https://ncaiss.dss.mil/dss-cac-login/cert/login).

(5) If the contractor already has an FCL, but the FCL is lower than the classification level required to perform on the contract, the Government Contracting Activity (GCA), or prime contractor for a subcontract, must sponsor the contractor for an FCL upgrade through DCSA.

(6) Do not use the DD Form 254 for contracts with foreign contractors, foreign governments or North Atlantic Treaty Organization (NATO) activities that require access to classified information.

a. Issue a separate security aspects letter, which serves as the equivalent of a DD Form

254, to provide security classification guidance to a foreign contractor, foreign government, or NATO activity, and also assure that security requirements are included in the contract when access to classified information is required, and, there must be the appropriate foreign disclosure determinations made in accordance with National Disclosure Policy for access to classified information by the foreign contractor, foreign government, or NATO activity.

https://ncaiss.dss.mil/dss-cac-login/cert/login

(1) Security clauses to be included in international contracts are in the NISPOM international section.

(2) Request DCSA obtain a facility clearance assurance on the foreign company from the designated security authority of the other government to verify the FCL and storage capability and thus alert the other government that a U.S. classified contract is to be awarded to one of the foreign government's contractors.

Defense Counterintelligence and Security Agency Industrial Policy and Programs

International Division 27130 Telegraph Road

Quantico, VA 22134-2253 E-mail: iab@dss.mil

1.b Level of Safeguarding Required:

(1) Insert the highest level of classified information/material the contractor will be required to store at its own facility. Safeguarding refers to the ability to store and/or generate classified information/materials at the contractor facility.

(2) The classification level shown in Item 1.b. may not be higher than that shown in Item 1.a.

(3) If no classified material will be stored at the contractor’s site, then “None” should be entered as the contractor will have access elsewhere to classified information or classified material (i.e., at a government location or at another contractor with a valid FCL). This item refers only to the contractor’s requirements to safeguard/protect classified information at its own facility.

(4) Do not cite special categories (e.g., such as Restricted Data, Formerly Restricted Data, COMSEC, SCI or SAP).

NOTE: If 11.a. is checked, safeguarding capability IS NOT required. If 11.b, c or d is checked on the DD FM 254, safeguarding capability IS required.

2.2 ITEM 2: This Specification is for:

2.a Prime Contract Number: Used when a GCA issues guidance to the prime contractor. The GCA enters the contract number.

(1) If there are any other contract-related numbers, other than the prime contract between the GCA and the prime contractor, be sure to list those in item 13 with a description or explanation for each one (e.g., General Services Administration (GSA) schedule, basic ordering agreement, basic purchase agreement, task order, etc.).

mailto:iab@dss.mil

2.b Subcontract Number: DO NOT USE (Prime Contractor Use Only). Used by the prime contractor when there is a prime/subcontractor relationship (IAW NISPOM, Paragraphs 7-101 and 7- 102). The prime contractor issuing the subcontract enters the subcontract number. The prime contractor’s contract number must also be entered in item 2a.

(1) The applicable GCA determines whether there are any restrictions or pre-approval requirements for subcontracting.

(2) An individual DD Form 254 would ordinarily be issued for each subcontract, even when there may be a string of subcontracts flowing from a prime contract.

2.c Solicitation or Other Number: Used for a Request For Proposal (RFP), Request For Quote (RFQ), Invitation For Bid (IFB), or other solicitation, that will involve access to classified information or material for the contract or agreement performance, regardless of whether or not a contractor will require access to classified information during pre-contract phases of the procurement. Use item 13 to explain if access to classified information is required during pre-contract phases.

(1) The issuing activity, designated by the GCA or a prime contractor for a subcontract, enters the solicitation number and the date by which bids are due.

(2) When the contract is awarded, a new DD Form 254 will be prepared by the contracting officer or authorized representative designated by the GCA or prime contractor for a subcontract and issued with the contract number entered in Item 2a or 2b, as applicable.

2.3 ITEM 3: This Specification is:

3. THIS SPECIFICATION IS: (X and complete as applicable)

a. ORIGINAL (complete date in all cases) Date: (YYMMDD)

b. REVISED (Supersedes all previous specs) Revision Number: Date: (YYMMDD)

c. FINAL (Complete Item 5 in all cases) Date: (YYMMDD)

**Insert only one "X" into the appropriate box, although information may be entered into both “a” and “b.”

3.a Original/Date: Used when the original DD Form 254 is issued. The date of issuance is entered by the GCA. The Prime Contractor enters the date for a subcontract. Original date refers to the release/certifying official signature date of the DD Form 254.

(1) When there is a solicitation for a classified contract, whether or not the actual bid package contains classified information, check item 3a and insert the release/certifying official signature date of the DD Form 254. This date will not change and will continue to show on any subsequent revisions of the DD Form 254 for the solicitation.

(2) When there is the award of a prime contract requiring access to classified information, check item 3a and insert the release/certifying official signature date of the DD Form 254.

This date may be different from the original date on the DD Form 254 for the associated solicitation. This date will not change and will continue to show on any subsequent revisions of the DD Form 254 for the prime contract.

(3) When the prime contractor is awarding a subcontract requiring access to classified information, check item 3a and insert the prime contractor's release/certifying official signature date of the DD Form 254 for the subcontract. This date may be different from the original date on the DD Form 254 for the associated solicitation/award. This date will not change and will continue to show on any subsequent revisions of the DD Form 254 for the subcontract.

3.b Revised/Date: Issued anytime there is a change to the classification or security guidance of the contract or change in the location of the contractor facility. Give a sequential number to each revision and enter the date of the revised DD Form 254. NOTE: The date of the original (3.a) will appear unchanged on each revised DD Form 254.

(1) Revised DD Forms 254 must be incorporated into the contract by modification.

(2) Do not issue a revised DD Form 254 when exercising an option year on a contract requiring access to classified information. If an option year is exercised, then there are no changes to any other contract terms, and the initial DD Form 254 for the contract award is still valid.

(3) Conduct review of classification requirements at least biennially.

(4) All revisions identifying any new performance locations must be coordinated through all affected security disciplines IAW the DD FM 254 requirements (SCI/Non-SCI, SAP, COMSEC/TEMPEST, NC2-ESI and Foreign disclosure).

3.c Final/Date: Issued only to authorize the contractor additional retention of classified materials received or generated from the end of the contract beyond the automatic two year retention period authorized by the NISPOM (DoD 5220.22-M) Paragraphs 4-103 (c) and 5-701), provided the GCA does not advise to the contrary. If retention is required beyond the two-year period allowed under the NISPOM, the contractor MUST submit a request and receive retention authority from the GCA. The final DD Form 254 is then an authorization for the contractor to retain the information for a specified period of time. In addition, the GCA may grant retention beyond the automatic two year retention period in formal written authorization to the contractor). If Item 3.c. is checked, then Item 5 will be marked “YES”.

(1) Enter the date the final DD Form 254 is issued and always complete Item 5.

(2) Enter the date of the original DD Form 254 in Item 3a.

(3) Enter disposition instructions in Item 13 (Instructions must Read: “Ref Item 5: All classified will be (destroyed/returned (pick one)) at the end of the retention period identified in Item 5.”

2.4 ITEM 4: Is This a Follow-on Contract?

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If YES, complete the following:

Classified material received or generated under (Preceding Contract Number)is transferred to this follow-on contract

A follow-on contract may ONLY be awarded to the same contractor or subcontractor for the same item or services as a preceding contract.

(1) When these conditions exist, enter an “X” in the “YES” box, and enter the preceding contract number in the space provided. This item authorizes the contractor (or subcontractor) to transfer material or information received or generated under the preceding contract to the new contract.

(2) The material or information transferred should be reflected in item 13, noting either that all classified material or information associated with the contract is authorized to be transferred to the contract number cited in item 2a or specifying a list of material or information to be transferred.

2.5 ITEM 5: Is This a Final DD Form 254: ONLY issued and marked if the contract has been completed and the GCA determines, in response to a formal contractor request, that the contractor has a continuing need for the classified information or material beyond the automatic two year period authorized by the NISPOM (DoD 5220.22-M, Paragraphs 4-103 (c) and 5-701).

(1) If this is not a FINAL DD Form 254, mark “NO.”

(2) If this is a FINAL DD Form 254, mark “YES," enter the date of the contractor’s formal request for retention in accordance with NISPOM (DoD 5220.22-M, Paragraph 5-701), and the GCA authorized period of retention in the spaces provided (please use format YYYYMMDD).

(3) Item13 must contain final disposition instructions for the classified material involved (a final specification is provided to show the retention period and to provide final disposition instructions for the classified material under the contract). Instructions must Read: “Ref Item 5: All classified will be (destroyed/returned (pick one)) at the end of the retention period identified in Item 5.”

2.6 ITEM 6: Contractor: Identifies the prime contractor to whom the GCA has awarded the contract or agreement that requires access to classified information. The contractor must have a valid facility clearance (FCL) at least as high as the classification level indicated in this item. To verify the contractor’s FCL, contact the DCSA (Defense Counterintelligence and Security Agency) Central Verification Activity at (888) 282-7682 or log on to the DCSA NCAISS web site (https://ncaiss.dss.mil/dss-cac-login/cert/login); then follow the instructions to either login or request access, or contact Ms. LaShonda Arocha, 75 ABW/IPD, at 777-5490.

6. CONTRACTOR:(Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE: b. CAGE CODE:

c. COGNIZANT SECURITY OFFICE: (Name, Address, and ZIP Code)

6.a Location: Enter the name and address of the prime contractor as it appears on the contract and/or NISS. Add the name and complete street address of the contractor in item 6a. If the contractor is already in the National Industrial Security Program (NISP) and has an authorized classified mailing address, confirm that authorized classified mailing address through the DCSA authorized information system for such information (NISS) before adding to this item. (If a classified mailing address is identified in ISFD, this address should also be included).

6.b Cage Code: Enter the contractor’s Commercial and Government Entity (CAGE) Code. The CAGE Code is a government issued unique identifier used to identify commercial and government entities; it is important to note that not all facilities with CAGE codes are cleared contractor facilities, so the facility security clearance status should be verified. Verification of a specific level of “clearance” (Confidential, Secret or Top Secret) may be accomplished using the National Industrial Security System (NISS) located at https://ncaiss.dss.mil/dss-cac-login/cert/login or by calling Msr. LaShonda Arocha, 75 ABW/IPD, at 777-5490. NOTE: Just because the contractor has a Facility Clearance in NISS, does not necessarily mean the facility has the required storage capability; if a level of safeguarding is identified in Item 1.b of the DD Form 254, the contractor must have a safeguarding level at or above the level identified in Item 1.b (this safeguarding level may be verified using NISS or by calling or emailing Ms. LaShonda Arocha, 75 ABW/IPD, at 777-5490.

6.c Cognizant Security Office (CSO): Enter the DCSA Cognizant Security Office (CSO) and its address and email address. The CSO is always the DCSA Director of Industrial Security, who has industrial security jurisdiction over the geographical area in which the contractor is located.

To obtain the CSO address open the “DSS Field Office Locations” file on the 75 ABW/IPD SharePoint at:

https://org2.eis.af.mil/sites/21341/IP/IndustrialSecurity/DD%20Form%20254/Forms/AllItems.as px.

2.7 ITEM 7: Subcontractor:

7. SUBCONTRACTOR:

a. NAME, ADDRESS, AND ZIP CODE: b. CAGE CODE: c. COGNIZANT SECURITY OFFICE:(Name, Address, and ZIP Code)

Enter “N/A” in 7.a., in all cases. (This item is NOT used by the AF. This block is only used by prime contractors when a subcontractor will require access to classified information).

2.8 ITEM 8: Actual Performance Location: This item refers to all locations where classified information will be accessed and stored or only accessed (e.g., contractor personnel embedded/integrated at a government location).

https://org2.eis.af.mil/sites/21341/IP/IndustrialSecurity/DD%20Form%20254/Forms/AllItems.aspx

8.a. LOCATION:

(1) If the work is to be performed ONLY at the location listed in Item 6.a, the entry in Item 8.a should simply state “Same as Item 6.a”.

(2) If performance will occur at more than one location, simply hit the “Add Row” button to add as many performance locations as are needed.

a. List ALL locations where classified performance is required under the contract (Add the name and full address of each performance location (blanket location statements, such as “Various facilities/locations”, ARE NOT AUTHORIZED).

b. If the contractor has a classified mailing address that differs from their physical address, enter this address below the physical address in Item 8.a using the following format:

“(Classified Mail: enter address here)”

(3) If the location where classified performance is required will ONLY be at a government facility, then ONLY complete item 8a (do NOT enter any information in Item 8.b and enter “See Item 15” in Item 8.c), then mark Item 15 on the DD FM 254 “Yes” and enter the following:

Item 15:

(For a single government installation location enter:) “Ref. 8.a.: The Defense Counterintelligence and Security Agency (DCSA) is relieved of all industrial security review responsibilities for contractor performance on the government installation identified in Item 8.a. The SSA, (ENTER SSA’s IDENTIFIER/ADDRESS/email – e.g. 75 ABW/IPD 7981 Georgia Street, HAFB, UT 84056:

lashonda.arocha.2@us.af.mil) has exclusive oversight responsibilities while operating on the installation.”

(For multiple government installations locations enter:)

“Ref. 8.a.: The Defense Counterintelligence and Security Agency (DCSA) is relieved of all industrial security review responsibilities for contractor performance on government installations identified in Items 8.a. The following SSAs have exclusive oversight responsibilities while operating on the installations:

- (List all Installations and their respective SSA’s – See example below)

EXAMPLE

1). Hill AFB, UT: 75 ABW/IPD 7981 Georgia Street, HAFB, UT 84056:

lashonda.arocha.2@usaf.mil 2). TIMBUC2 AFB, NL: 123 ABW/IPD 1234 Neverland Drive, TIMBUC2 AFB, NL 10000

NOTE: Most AF Information Protection Office’s providing SSA oversight may be found on pages 46-49 of this Handbook.

8.b. CAGE CODE: Enter the CAGE Code of the prime contractor facility where performance will occur (if at a different location than identified in Item 6.a). The CAGE Code is a government issued unique identifier used to identify commercial and government entities; it is important to note that not all facilities with CAGE codes are cleared contractor facilities, so the facility security clearance status should be verified. Verification of a mailto:lashonda.arocha.2@usaf.mil specific level of “clearance” (Confidential, Secret or Top Secret) may be accomplished using National Industrial Security System (NISS) located at https://ncaiss.dss.mil/dss-cac-login/cert/login or by calling or emailing Ms. LaShonda Archoa, 75 ABW/IPD, at 777- 5490.

NOTE: Just because the contractor has a Facility Clearance in ISFD, does not necessarily mean the facility has the required storage capability; if a level of safeguarding is identified in Item 1.b of the DD Form 254, the contractor must have a safeguarding level at or above the level identified in Item 1.b (this safeguarding level may be verified using NISS or by calling or emailing Ms. LaShonda Archoa, 75 ABW/IPD, at 777-5490.

8.c CSO: 8.c. CSO: The CSO will be the DCSA Field Office having industrial security jurisdiction over the geographical area in which the off-base contractor facility is located. If performance will occur on a military installation, please see Item 8.a above for specific details (The SSA is not the same as the CSO, and thus requires additional guidance in Item 15 – listed above). DCSA Field Office (CSO) addresses may be found at: on the 75 ABW/IPD SharePoint at:

https://org2.eis.af.mil/sites/21341/IP/IndustrialSecurity/DD%20Form%20254/Forms/AllItems.aspx.

2.9 ITEM 9: General Unclassified Description of This Procurement:

Enter a short, concise, and unclassified description of the procurement.

(1) Provide enough detail to provide an adequate picture of the project (e.g., research, development, production, study, services, manufacturing).

(2) DO NOT use classified information such as project names or descriptive information.

a. In those rare instances where the GCA determines that there is absolutely no unclassified description for the procurement, then the GCA may provide a classified description in a separate, classified, attachment to the DD Form 254 and enter the words "See attachment # (insert identifier, e.g., number of attachment) for description provided under separate cover."

(3) Once a determination has been made on the classification level of the DD FM 254, enter the level into the block located on the top of Page 1 by selecting from the drop-down menu; for 99.9% of all DD FM’s 254 this will either be “Unclassified” or “Official (if For Official Use Only)”.

2.10 ITEM 10: This Contract Will Require Access To: Check all that apply. Provide details in blocks 13 and/or 14 as set forth in the instructions. These are access requirements for the contractor and their employees as determined by the GCA. Fill this out regardless of where the access will occur (contractor’s facility, another contractor’s facility or at a government facility).

An explanation of each item is as follows:

10.a COMMUNICATIONS SECURITY (COMSEC) INFORMATION: Check this box ONLY if the contractor requires access to COMSEC information which includes accountable or non-accountable COMSEC information and controlled cryptographic items (CCI).

(1) If COMSEC Material Control System (CMCS) accountable material is procured or produced by the contractor, or provided to the contractor as government furnished material, the contractor must have a COMSEC account. This box would be checked, and Item 11.h would also be checked.

a. Accountable COMSEC material includes hard copy or electronic storage or transmittal of such material, Secure Telephone Equipment (STE) and other COMSEC devices utilizing National Security Agency (NSA)-approved cryptographic key.

b. As a general rule, the ONLY time Item 10a is checked and Item 11h is not checked is when COMSEC access is at a location other than the contractor’s own facility/location.

COMSEC accounts (11h) are not required when COMSEC is accessed solely at the government facility. The Government’s facility COMSEC account will provide support.

(2) If this item is checked , but the contractor WILL NOT require a COMSEC Account (Item

11.h) enter the following statement in:

Item 13:

“Ref 10.a: COMSEC safeguarding requirements apply. For on-base performance, COMSEC is incumbent on the government. Access on a government installation is granted by the user agency.

Access to COMSEC information is restricted to U.S. Citizens holding a final U.S. government clearance at the appropriate level. Personnel must receive the required COMSEC briefing. Prior approval is required from the Government Contracting Activity prior to granting access to COMSEC information to a subcontractor. Contractor will comply with Air Force COMSEC guidance.”

(3) If access to COMSEC information will occur at the contractor’s own facility, (Item 11.h will be checked “YES” and applicable 11.h reference statement entered into Item 13 block (see Item 11.h in this handbook (page 28) for applicable reference statement/s), enter the following statement in:

“Ref. 10.a: COMSEC safeguarding requirements apply. See the NISPOM chapter 9, section 4 for details. Access to COMSEC information is restricted to U.S. Citizens holding a final U.S.

government clearance at the appropriate level. Personnel must receive the required COMSEC briefing. Prior approval is required from the Government Contracting Activity prior to granting access to COMSEC information to a subcontractor.”

(4) If access to COMSEC information will occur at the contractor’s facility and a government installation, (Item 11.h will be checked and applicable 11.h reference statement entered into Item 13 block (see Item 11.h in this handbook (page 28) for applicable reference statement/s), enter the following statement in:

“Ref. 10.a: COMSEC safeguarding requirements apply. See the NISPOM chapter 9, section 4 for details. For on-base performance, COMSEC is incumbent on the government. Access on a government installation is granted by the user agency. Access to COMSEC information is restricted to U.S. Citizens holding a final U.S. government clearance at the appropriate level.

Personnel must receive the required COMSEC briefing. Prior approval is required from the Government Contracting Activity prior to granting access to COMSEC information to a subcontractor.”

(5) If the contractor is authorized to receive Government furnished cryptographic equipment, enter the following statement in:

“Ref. 10.a: Contractor is authorized to receive Government furnished cryptographic equipment in performance of this contract.”

NOTE: If accountable COMSEC material used under the contract requires transmission via the Defense Courier Service, Item 11.k/Be Authorized to use the Defense Courier Service (DCS) must also be checked (see Item 11.k in this handbook (page 30) for applicable reference statement/s) .

10.b RESTRICTED DATA (RD):

This item will be marked “YES” if access to RD information that is classified and controlled under the Atomic Energy Act of 1954, or CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) is required. If required, enter the following statement in:

“Ref 10.b: The contractor is permitted access to RESTRICTED DATA (RD) in performance of this contract. Access to RD requires a final U.S. Government clearance at the appropriate level.”

10.c CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI):

Check this box if access to CNWDI is required under the contract. If CNWDI access is required, then also check Item 10.b for RESTRICTED DATA. Special briefings and procedures are also required for access to CNWDI. The program/project manager must ensure the contractor’s Facility Security Officer (FSO) has been briefed into the CNWDI program. The FSO or the project/program manager may brief contractor employees who will require access to RD. Verification to ensure the FSO has been briefed may be accomplished by accessing ISFD (or NISS, when implemented) under “Special Considerations” on the DCSA website. Personnel requiring access to CNWDI require a final U.S. Government clearance at the appropriate level.

If this item is checked, ensure Item 10.b. is also checked and the applicable 10.b reference statement entered into Item 13 block (see Item 10.b in the handbook/above) and enter the

“Ref. 10.c. The contractor is permitted access to Critical Nuclear Weapon Design Information (CNWDI) in performance of this contract. Access to CNWDI requires a special briefing and debriefing. The government program manager or designated representative will ensure contractor employees are briefed for CNWDI. Prior to granting subcontractors access to CNWDI approval must be obtained from the Government Contracting Activity.”

NOTE: DCSA may brief the contractor FSO for access to CNWDI, upon request. The AF program official must request this action of the appropriate DCSA office if desired.

10.d FORMERLY RESTRICTED DATA (FRD): Information that has been removed from the RD category after DOE and the Department of Defense have jointly determined that the information: (1) relates primarily to the military utilization of nuclear weapons and (2) can be adequately safeguarded as NSI in the United States.

Check this box if access to FRD is required in performance of the contract, and enter the following statement in:

“Ref. 10.d.: The contractor is permitted access to FORMERLY RESTRICTED DATA (FRD) in performance of this contract. Access to FRD requires a final U.S. Government clearance at the appropriate level.”

10.e INTELLIGENCE INFORMATION: Intelligence Information is information that is under the jurisdiction and control of the Director of National Intelligence (DNI) and circulated within the intelligence community. If intelligence information is involved, the contracting activity is responsible for ensuring the additional security requirements outlined in various DNI and DCI directives are incorporated in the guidance, provided to the contractor, and are tailored to the performance requirements of the contract. The guidance may be included in the contract itself or in Item 13.

10.e (1). SENSITIVE COMPARTMENTED INFORMATION (SCI): Check this item ONLY if the contractor requires access to SCI to perform on the contract. If the contractor requires access to SCI intelligence information, the appropriate SSO has exclusive responsibility for material released to the contractor. The SSO for Hill AFB is Air Force Life Cycle Management Center/Intelligence Division Utah (AFLCMC/INL). The contractor selected must have SCI indoctrinated personnel available to work the contract and the designated government Contracting Officer or Contracting Officer Representative (COR) must also be assigned an SCI position.

If access to SCI is required for contract performance, mark 10.e.(1). and: ensure Item 1.a is annotated “TOP SECRET.” Item 1.b. should be marked “TOP SECRET” if Item 11.a (“Have access only at another contractor’s facility or Government Activity”) WILL NOT be marked. Item 1.b. should be marked “N/A” if Item 11.a (“Have access only at another contractor’s facility or Government Activity”) is/will be marked. Additionally, if 10.e.(1) is marked, Item 10.e. (2)/Non-SCI must be marked and all applicable statements and addendums also be added to the DD FM 254 ( If Item 11.a will not be marked, then mark Item 11.k. (Defense Courier Service (DCS) is authorized) if the contractor will not have access to Joint Worldwide Intelligence Communications System (JWICS) for SCI.

Mark item 15 “YES” and enter the following statements in the appropriate Item blocks:

Item 12:

“Public release of Sensitive Compartmented Information (SCI) is NOT authorized”

Item 14:

“Ref Blk 10.e.(1): Contractor requires access to SCI materials; SCI security requirements apply, see attached SCI Clauses in attachment within Item 13 for details.”

*NOTE:

If 10.e.(1) is marked, the Sensitive Compartmented Information (SCI) Clauses DD Form 254 Attachment (located on pages 40-41) must be appropriately filled in and added to the DD Form 254 in an attachment within Item 13 using the “Add Attachment” button.

If the contractor will be required to have access to SCI at the contractor’s facility, enter the

“Ref Blk 10.e(1): This contract requires access to SCI. If the contractor has established a SCIF, DIA and its designees are responsible for all inspections of the contractor SCIF and SCI security management program for ensuring compliance with all SCI security regulations and policies. If a new SCIF must be established in accordance with this contracting effort, permission to build/accredit a SCIF must be requested through the COR and forwarded to SSO Hill. Special Security Officers (SSOs) reserve the right to conduct program reviews of AF SCI materials and SCI program management to ensure the protection of AF equities.”

NOTE: AFLCMC/INL/SSO must review and coordinate on all DD Form 254 contracts which require access to intelligence information.

If the contractor will ONLY have access to SCI at a government installation, enter the

“Ref. 10.e(1). DCSA is relieved of security inspection responsibility for all SCI material related to this contract. The SSO maintains inspection responsibility for all SCI material related to this contract.”

If 10.e.(1) is marked , then 10.e(2) MUST also be marked.

10.e(2). NON-SCI: If the contractor will require access to classified intelligence information but it does not fall into the SCI category and does not require a special billet, or if 10.e.(1)/SCI is checked, check Item 10.e.(2) and enter the following statements in:

“Ref. 10.e.(2). The contractor will require access to, and receipt of, classified intelligence documents in the performance of this contract. Contractor shall restrict access to those individuals with a valid need-to-know who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, or other government agencies and private individuals or organizations is prohibited unless authorized in writing by the COR with prior approval of SSO HILL. See Non-Sensitive Compartmented Information (SCI) Clauses in attachment within Item 13 for details.”

*NOTE:

If 10.e.(2). is marked, the Non-Sensitive Compartmented Information (SCI) Intelligence Information Clauses attachment (located on pages 43-44) must be appropriately filled in and added to the DD Form 254 in an attachment within Item 13 using the “Add Attachment” button.

NOTE: AFLCMC/INL/SSO must review and coordinate on all DD Form 254 contracts which require access to intelligence information.

10.f SPECIAL ACCESS PROGRAM (SAP) INFORMATION: A SAP is a specialized program, which is established to control access, distribution, and to provide protection for particularly sensitive classified information. SAPs impose requirements on the contractor that exceed the NISPOM. A “carve-out” is a classified contract awarded by the GCA in connection with a SAP for which DCSA has been relieved of security and/or oversight responsibility by the Secretary or Deputy Secretary of Defense (DoDD 5205.07, "Special Access Program (SAP) Policy").

If the contractor will require access to SAP/SAPF, check Item 10.f and enter the following statements in:

“Ref 10.f.: Special Access Program (SAP) security requirements apply, see SAP Information Addendum attachment within Item 13 for details.”

“Ref 10.f.: The Defense Counterintelligence and Security Agency (DCSA) has been relieved of inspection oversight responsibilities for SAP programs associated with this contract. The Air Force is identified as the Cognizant Security Authority (CSA) with the AFOSI PJ fulfilling the execution role for all contractor inspections under the purview of SAF/AAZ.”

*NOTE: If the contract is performed at the contractor facility and DCSA retains security cognizance of the SAP, annotate Item 13 to note that DCSA maintains cognizance over the SAP. The inspecting Industrial Security Representative must be briefed into the SAP by the government program manager or designated representative prior to access to the SAP material.

NOTE: If 10.f. is marked, the SAP Information Addendum (located on pages 45-46) must be added to the DD Form 254 in an attachment within Item 13 using the “Add Attachment” button. Additionally, the DD FM 254 must be coordinated with AFOSI PJ/DET 1 OL-A for further instruction/guidance on completing the DD Form 254.

10.g NORTH ATLANTIC TREATY ORGANIZATION (NATO) INFORMATION: NATO is information that is under the control of countries of the North Atlantic Treaty Organization. Check this box only if the contract requires access to classified information or documents belonging to NATO, or containing NATO classified information.

If the contractor will require access to NATO check Item 10.g. and enter the following statement in:

For NATO:

“Ref 10.g.: The contractor is permitted access to classified North Atlantic Treaty Organization (NATO) information in performance of this contract. The government project manager is the designated representative that will ensure the contractor Facility Security Officer and concerned employees are NATO briefed prior to access being granted. Prior approval of the contracting office is required for subcontracting. See the NISPOM chapter 10, section 7 for additional security requirements. Access to NATO requires a final U.S. Government clearance at the appropriate level.”

**NOTE: If the contractor does not require access to NATO information; but does require access to the SIPRNET, do not check this box. Check item 10.k and enter “SIPRNET Access Required” in the space provided within this Item and enter the following statement in Item 13:

“Ref 10.k.: The contractor is permitted access to the Secret Internet Protocol Router Network (SIPRNet). Actual knowledge, generation, or production of NATO information is not required for performance on this contract; however, a NATO awareness briefing will be completed prior to granting access to the SIPRNet.”

10.h FOREIGN GOVERNMENT INFORMATION: Item 10.h. includes any foreign government information (FGI) except NATO. FGI is information provided to the U.S. by a foreign government or governments, an international organization of governments, or any element thereof with the expectation, expressed or implied, that the information, the source of the information or both, are to be held in confidence; or produced by the U.S. pursuant to, or as a result of, a joint arrangement with a foreign government or governments, an international organization of governments, or any element thereof, requiring that the information, the arrangement, or both are to be held in confidence.

If the contractor will require access to Foreign Government Information, check 10.h. and enter the

“Ref. 10.h.: The contractor is permitted access to Foreign Government Information in performance of this contract. Access to Foreign Government Information requires a valid need-to-know and final U.S. Government clearance at the appropriate level. Prior approval of the contracting activity is required for subcontracting. Refer to the NISPOM chapter 10, section 3 for additional security requirements.”

**NOTE: When this item is checked AFLCMC/WFNK must sign off on the coordination page.

10.i ALTERNATIVE COMPENSATORY CONTROL MEASURES (ACCM) INFORMATION: A Head of a DoD Component with original classification authority (OCA) may employ ACCM when he or she determines that the standard security measures detailed in this Manual are insufficient to enforce need to know for classified information and SCI or SAP protections are not warranted. The use of an unclassified nickname, obtained in accordance with Chairman of the Joint Chiefs of Staff Manual (CJCSM) 3150.29C (Reference (ae)), together with a list of persons authorized access, and a specific description of information subject to the enhanced ACCM controls, are the three requisite elements of an ACCM.

(1) Check this item ONLY if applicable. Marking this item does not make the DD Form 254 a classified document. The GCA will provide appropriate classification guidance separate from the DD Form 254.

(2) Care must be taken to ensure identification of the security plan does not disclose ACCM-protected data. See DoDM 5200.2, Volume 3, “DoD Information Security Program:

Protection of Classified Information,” available at: http://www.esd.whs.mil/DD/DoD- Issuances/.

If the contractor will be required to…