Attch 02 DD254 GTS 20210126.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, MAY 2019

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

20220531 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification whs.mc-alex.esd.mbx.formswebmaster@mail.mil

WHS

List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

PEO STRI PAO, 12211 Science Dr Orlando, FL 32826

ITEM 13 SECURITY GUIDANCE:

The following items apply to this contract.

GENERAL GUIDANCE:

1. The vendor/contractor and sub-vendor/contractor(s) shall comply with the Security Agreement (DD Form 441) and following Security Regulations (DoDM 5200.01 Volumes 1 thru 4), DoD Information Security Program, (DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM), AR 25-2 Information Assurance, AR 380-5 Information Security, AR 380-49 Industrial Security, AR 380-10 current versions and affiliated regulations.

2. This DD254 only supports the base IDIQ contract! All other contract or delivery orders outside the scope of this contract and in support of other service components, government agencies and external organizations to PEO STRI must have their requiring activity security office develop their specific DD254 to support their contract effort.

3. The vendor/contractor and sub-vendor/contractor employees requiring access to DoD government or DoD vendor/contractor's facilities where proof of a security clearance is required, shall meet the security access requirements specified by the host and/or owner of those facilities.

4. Any prime Vendor/Contractors to include sub-vendors/contractors that are USA Foreign Owned, Controlled and Influenced (FOCI) company who poses a valid FCL issued by the Defense Counterintelligence Security Agency (DCSA) under a Special Security Agreement (SSA) are not allowed cto work on this contract.

5. The vendor/contractor is not authorized to disclose or release collateral Classified Military Information (CMI) information to the public.

a. The vendor/contractor is not authorized to disclose or release Controlled Unclassified Information (CUI) pertaining to this agreement/contract to the public without prior review and approval from the Requiring Activity OPSEC Officer, Legal and Public Affairs Officer. Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 12.

b. The vendor/contractor is not authorized to disclose or release any program Classified Military Information (CMI) Controlled Unclassified Information (CUI) Technical Data, Information pertaining to this contract to any Foreign Nationals or Foreign Representatives without prior review and approval from the Requiring Activity Cognizant Security Office, Foreign Disclosure Officer (FDO). Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 17a of the DD254.

6. The Vendor/Contractor shall only issue security clearances to permanent employees requiring access to classified information based on a Need-to-Know that require access to the LT2 portal.

a. For collateral security clearances and access the vendor/contractor shall follow the Security guidelines established in DoD 5220.22M and the Defense Counterintelligence Security Agency (DCSA) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php

b. Vendor/Contractors who do not require a security clearance but require a government Common Access Card (CAC) must have a Tier 1 security investigation and follow the credentialing requirements of this contract!

7. The vendor/contractor and sub-vendor/contractors shall ensure that all Classified information, Controlled Unclassified Information (CUI), Controlled Technical Information (CTI) documents, data and or export controlled information; is marked, handled and safeguarded with the appropriate security classification, distribution statement(s) and export control warning statement in accordance with DoDD 5230.24, DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM and DoDM 5200.01 Vol 1, 2, 3 and 4.

a. The vendor/contractor and sub-vendor/contractors shall NOT ACCEPT any Documents, data or information from any source including the government requiring activity unless the documents, data or information is marked as stated in the above paragraph!

8. The prime vendor/contractor is responsible for vetting all sub-vendor/contractors prior to issuing a DD Form 254 for classified work or material that the sub-vendor/contractor will have access to during this agreement/contract per chapter 7 of current version of DoD 5220.22M and AR 380-49.

a. The prime vendor/contractor FSO will sign DD Form 254, block 17h and ensure that program, and/or Army activity points of contact information are included on DD Form 254, block 13.

b. The prime vendor/contractor FSO will provide the AO/KO and/or AOR/COR with a copy of all sub-vendor/contract DD Form 254s to be attached to the prime agreement/contract. The AO/KO and/or AOR/COR or AO and/or AOR will provide a copy of all sub-agreement/contract DD Form 254’s to the ISS and DCSA.

9. Contractor shall comply with FAR 52.204-2 “Security Requirements”. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret”. The Contractor shall comply with (1) Security Agreement (DoD Form 441), including the National Industrial Security Program Operating Manual (DOD 5220.22-M) and (2) any revisions to DOD 5220.22-M.

10. This agreement/contract has the following Security Classification Guides (SCGs) which are directly applicable to this effort. If, during this effort, it becomes necessary to create a security classification Reference (SCR) the contractor shall notify the contract officer representative who will seek the assistance and appropriate guidance from the local government ISSM, PM and Requiring Activity Cognizant Security Office. The following SCG's are listed;

Project Director, Main Battle Tank Systems, Abrams Family of Vehicles (FOV), Security Classification Guide (SCG) dated 2 Feb 2017

Project Manager, Armored Fighting Vehicles (AFV), Security Classification Guide (SCG), dated 20 Jan 2017

Project Manager, Stryker Brigade Combat Team, Security Classification Guide (SCG), dated 23 May 2017

11. Vendors/Contractors who work in a DoD or Vendor/Contractor cleared facility on DA installations and or government leased facilities and who are embedded or integrated within a DA program or activity, shall report all adverse information, suspicious contacts, and other reportable incidents to the local security office.

12. The Vendor/contractor and their sub-vendor/contractors shall immediately report any loss, compromise, suspected compromise of classified information or any security violations which occur on this contract per DoD 5220.22–M with current changes, to their Facility Security Manager (FSO) and local DCSA office. The vendor/contractor shall also inform the AO/KO, AOR/COR, and the ISS.

13. The vendor/contractor and their sub-vendor/contractors will designate in writing a U.S. citizen (not a dual citizen) as the Insider Threat program official per paragraph 1-202 of DoD 5220.22M w/change 2. All vendor/contractors with security clearances shall comply with Insider Threat Training requirements per paragraph 3-103 of DoD 5220.22M w/change 2. Additionally the vendor/contractor shall report threat-related incidents, behavioral indicators to the Requiring Activity Cognizant Security Office. Insider Threat training information can be found at the following DCSA site https://www.cdse.edu/

14. The vendor/contractor and sub-vendor/contractors shall ensure that all contract employees with security clearances meet the annual security training required by DoD 5220.22M, NISPOM, AR 380-5 and AR 381-12;

• Insider Threat Training

• Security Refresher Training

• AT Level 1 Training

• TARP Training

• OPSEC Training

New vendor/contractor personnel assigned duties related to this agreement/contract shall re ceive training within 30 days on their assignment. DCSA provides the Facility Security Officer (FSO) Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php For assistance.

15. SELF EMPLOYED CONSULTANTS – The requiring activity security office shall be notified of all consultants who work for or support the Vendor/Contractor (prime and subs) for this effort! The Vendor/Contractor who employs or has consultants on their team shall provide a copy of all consultant certificate/agreements to the requiring activity AOR/COR and security office per paragraph 2-212 of the NISPOM.

16. TEMPORARY EMPLOYED PERSONNEL (Paid by 1099) – The contractor/vendor must notify the KO/AO and security office before any temporary employees are hired and paid via a 1099. Temporary employees are NOT authorized to work on this contract/agreement until the followings can be verified;

a. Provide a list of all temp employees (Name, Company they came from, Security Clearance information and nationality. This list will be provided by the Vendor/Contractor upon request from the requiring activity and during security inspections.

b. The Vendor/Contractor shall ensure that all temporary employees paid via a 1099 meet the same security requirements listed in paragraph 5 above.

17. TECHNOLOGY CONTROL PLAN – Vendors/Contractors (prime and subs) who meet the following criteria must develop and provide a copy of their Technology Control Plan (TCP) to the COR/ACOR and government Security representative for this effort when;

a. A cleared vendor/contractor with not cleared U.S. sub-vendor/contractors exists.

b. Information and a template on how to build a TCP can be found on the DCSA site provided; https://www.dcsa.mil/mc/ctp/foci/action/sample_tech_con_plan/

ITEM 10:

Ref Item 10.j: CONTROLLED UNCLASSIFIED INFORMATION (CUI) - For Controlled Unclassified Information (CUI) which includes Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoD 5200.01-V04. CUI information that is export controlled shall not be shared with any foreign nationals unless approved by the Requiring Activity security office along with the approved State Department license.

ITEM 11:

Ref Item 11.j: OPERATIONS SECURITY (OPSEC) REQUIREMENTS - The vendor/contractor shall develop, implement, and maintain a facility level OPSEC to protect classified and/or sensitive unclassified information used at the vendor/contractor, government and other vendor/contractor facilities during the performance of this agreement/contract. The OPSEC requirements may be included in the vendor’s/Contractor’s Standard Practice Procedures (SPP) or Technology Control Plan (TCP), whichever is more applicable.

Ref Item 11.l: RECEIVE, STORE OR GENERATE CONTROLLED UNCLASSIFIED INFORMATION (CUI) – The vendor/contractor and all sub-vendor/contractors personnel must protect CUI material and information in accordance with DoDM 5200.01 vol 4. CUI information that is export controlled shall not be shared with any foreign nationals unless approved by the Requiring Activity security office along with the approved State Department license.

Ref Item 11.M: Dual Citizens The vendor FSO must maintain a list of all dual citizen employees and provide that list upon inspection from DCSA or the cognizant security authority ISS. Vendor employees who are dual citizens and have access to software and technical data must have the appropriate security clearance in accordance with the current version of DoD 5220.22-M w current changes.

“FOR OFFICIAL USE ONLY” ATTACHMENT

PROTECTING "FOR OFFICIAL USE ONLY" (FOUO) INFORMATION

1. GENERAL:

a. The "For Official Use Only" (FOUO) marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

b. Other non-security markings, such as "Limited Official Use" and "Official Use Only" are used by non-DoD User Agencies for the same type of information and should be safeguarded and handled in accordance with instruction received from such agencies.

c. Use of the above markings does not mean that the information cannot be released to the public under FOIA, only that the Government must review the information prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions thereof.

2. MARKINGS:

a. An unclassified document containing FOUO information will be marked "For Official Use Only" at the bottom of the front cover (if any), on the first page, on each page containing FOUO information, on the back page, and on the outside of the back cover (if any).

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked, "FOUO."

c. Any "'For Official Use Only" information released to a contractor by a DoD User Agency is required to be marked with the following statement prior to transfer.

“This document contains information EXEMPT FROM

MANDATORY DISCLOSURE UNDER THE FOIA.

Exemption 5 applies.”

d. Removal of the "For Official Use Only" marking can only be accomplished by the originator or other competent authority. When the "For Official Use Only" status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: Vendors/Contractors may disseminate "For Official Use Only" information to their employees and sub-vendor/contractors who have a need for the information in connection with a classified contract. Vendors/Contractors must ensure employees and sub-vendor/contractors are aware of the special handling instructions detailed below.

4. STORAGE: During working hours, "For Official Use Only" information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after- hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: "For Official Use Only" information may be sent via first-class mail or parcel post. Bulky shipments may be sent by fourth-class mail. DoD components, officials of DoD components, and authorized DoD vendor/contractors, consultants, and grantees send FOUO information to each other to conduct official DoD business. Tell recipients the status of such information, and send the material in a way that prevents unauthorized public disclosure. Make sure documents that transmit FOUO material call attention to any FOUO attachments. Normally, you may send FOUO records over facsimile equipment. To prevent unauthorized disclosure, consider attaching special cover sheets, the location of sending and receiving machines, and whether authorized personnel are around to receive FOUO information. FOUO information may be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Mark the records "For Official Use Only" and tell the recipient the information is exempt from public disclosure under the FOIA and requires special handling.

6. DISPOSITION: When no longer needed, FOUO information must be shredded.

7. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of "For Official Use Only" information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions and disciplinary action may be taken against those responsible.

Orlando, FL 32828 Address: PEO STRI G2 12211 Science Dr Orlando, FL 32836