Attch 05 DDForm254Contract Security Classification Specification.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, MAY 2019

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

20220531 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification whs.mc-alex.esd.mbx.formswebmaster@mail.mil

WHS

List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

2. Use of non-U.S. Citizens – See DD254 Continuation Pages

For additional security guidance and requirements see enclosed DD Form 254 Continuation Pages, SCI Addendum (Enclosure 1 to DD254) & FOUO Guidance (Enclosure 3 to DD254).

SECURITY GUIDANCE (ITEM 13) CONTINUATION:

1. Additional Security Requirements:

a. Contractor shall forward a copy of any Defense Counterintelligence and Security Agency (DCSA) letter that informs of any serious contractor facility deficiency to the USASMDC Industrial Security Specialist (ISS) within 48 hours of receipt.

b. Additionally, the contractor shall report to the USASMDC ISS within 24 hours any incident of possible compromise or security violations. The ISS’s telephone number (refer to Item 16 for physical address/e-mail address).

c. The prime contractor shall provide the USASMDC ISS with a copy of all DD Forms 254 issued to subcontractors, to include all revisions. See DD Form 254, Page 2, Item/Blocks 16a, b, c, & d for the ISS’s contact information.

d. Upon termination, cancellation or transfer of effort, the contractor shall send a Memorandum for Record (MFR) within 30 calendar days of contract closeout identifying the effort had Critical Program Information (CPI). The MFR must be cleared by the Contracting Officer Representative (COR), Program Manager (PM) and or Technical Manager (TM). The MFR shall outline all CPI that was assessed by the Government and certifying the final disposition of the material or shall supply a MFR certifying that no CPI was identified.

e. The Contractors shall destroy, transfer, or return classified material in their possession as soon as possible after it has served the purpose for which it was released by the government, developed or prepared by the contractor after completion or termination of the contract. The contractor shall send a Memorandum for Record (MFR) listing all classified information and certifying the deposition of the material.

f. Chapter 1, section 104b of the National Industrial Security Program Operating Manual (NISPOM) states that the designation of a Cognizant Security Office (CSO) do not relieve the Government Contracting Activity (GCA) of the responsibility to protect and safeguard the classified information necessary for its classified contracts, or from visiting the contractor to review the security aspects of such contracts. As the GCA of this contract, USASMDC retains the right to conduct bi-annual security Staff Assistance Visits (SAVs) to ascertain the level of compliance with the basic contract or Task Order (TO) level DD Form 254, as applicable (and all derivative or subordinate DD Form 254s, as applicable). As the cognizant Industrial Security element within the GCA, the USASMDC G-24 staff will coordinate all security SAVs with the corresponding company's Facility Security Officer (FSO) and cognizant Industrial Security Representative (ISR) from the DCSA, with notification made to the COR and/or KO, as appropriate. SAVs will be limited to validation of the Cleared Defense Contractor's (CDC) compliance with the GCA's stated security requirements officially identified in this DD Form 254. Furthermore, SAVs do not in any way encumber, inhibit, or negate the DCSA role as the Department of Defense's CSO and/or agency responsible for the NISPOM compliance and Facility Clearance Level (FCL) inspection/accreditation.

g. Any subcontractor DD Form 254 (to include ALL revisions) with a SCI requirement must be coordinated with the Government COR, USASMDC ISS, and USASMDC Special Security Officer (SSO) prior to issuing the DD Form 254 (original or revision) to the subcontractor.

Reference Items 8a, b, and c - Additional Performance Locations (Collateral Access):

Facility Location Cage Code Cognizant DCSA Office

USASMDC

Building 5220 (Von Braun Complex I) Redstone Arsenal, AL 35898-0000 N/A USASMDC G-2 Security Office has cognizance

REFERENCE ITEM 10a; Access to Communications Security (COMSEC) Information.

a. Written concurrence from USASMDC, SMDC-INS-E; the COR and Contracting Officer (KO) is required prior to subcontracting COMSEC information.

b. Classified COMSEC material is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. COMSEC access shall be IAW DOD 5220.22-M, National Security Agency (NSA) Central Security Service (CSS) Policy Manual No. 3-16, Control of Communications Security (COMSEC) Material and AR 380-40, Policy for Safeguarding & Controlling Communications Security (COMSEC) Material. When access is required at Government facilities, contractor personnel will adhere to COMSEC rules and regulations as mandated by USASMDC policy and procedures.

REFERENCE ITEM 10b; Access to Restricted Data (RD).

a. Written concurrence from USASMDC, SMDC-INS-E; the Contracting Officer’s Representative (COR); and, the Contracting Officer (KO) is required prior to subcontracting RD.

b. Restricted Data Information is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level.

REFERENCE ITEM 10c; Access to Critical Nuclear Weapon Design Information (CNWDI).

a. Written concurrence from USASMDC, SMDC-INS-E; the Contracting Officer’s Representative (COR); and, the Contracting Officer (KO) is required prior to subcontracting CNWDI.

b. CNWDI Information is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level.

REFERENCE ITEM 10d; Access to Formerly Restricted Data (FRD).

a. Written concurrence from USASMDC, SMDC-INS-E; the Contracting Officer’s Representative (COR); and, the Contracting Officer (KO) is required prior to authorizing FRD access to a subcontractor.

b. The contractor is permitted access to FRD in performance of this contract. Access to FRD requires a FINAL U.S. Government clearance at the appropriate security level.

REFERENCE ITEM 10e(2); Access to Intelligence Information (non-SCI)

a. Written concurrence from USASMDC, SMDC-INS-E; the Contracting Officer’s Representative (COR); and, the Contracting Officer (KO) is required prior to subcontracting Non-SCI.

b. Non-SCI information is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level.

c. The following guidelines concerning control and dissemination of intelligence information are based on Intelligence Community Directive (ICD) 703, 21 June 2013:

(1) Intelligence information released under this contract or Request for Proposal (RFP) remains the property of the U.S. Government and may be withdrawn upon notice.

(2) The contractor will maintain a record of all classified intelligence material released to their custody. Unclassified intelligence information will be treated as For Official Use Only (FOUO).

(3) All reproductions of intelligence material will be classified, marked, and controlled in the same manner as original(s).

(4) Prior to granting an employee access to intelligence materials, employees will be briefed on their obligation to comply with these procedures and will be debriefed when access to the material is terminated. A permanent list of all employees having had access to the intelligence materials during this contract will be maintained by the company and will be available for DCSA inspection.

(5) The contractor will not release intelligence material to any activity, employee, or other person not directly engaged in providing services under this contract unless specific written authorization for such release is received from the Government Contracting Activity (GCA). This prohibition precludes release without authority to another contractor, Government agency, private individual, or organization unless a contractual relationship exists in support of this contract. Specific written authorization for such release will be received from the U.S. Army Space & Missile Defense Command (USASMDC), ATTN: SMDC-INS-E, P.O. Box 1500, Huntsville, AL 35807-3801.

(6) The intelligence materials will not be released to foreign nations, non-U.S. citizens or U.S. citizens representing foreign entities except with specific written authorization from the GCA and USASMDC Foreign Disclosure Officer (FDO).

(7) Intelligence materials released to the contractor will be destroyed upon contract completion unless the GCA requests the return of the materials. A copy of the destruction certificate referencing USASMDC control number will be mailed to USASMDC, ATTN: SMDC-INS-E, P.O. Box 1500, Huntsville, AL 35807-3801, in order to remove contractor accountability from USASMDC records. However, returned intelligence information will be sent to the attention of the Contracting Officer’s Representative (COR), address identified in the contract. In the event the contract is extended or a new similar contract requiring the released data is initiated, it is the responsibility of the COR to affect an extension or document transfer with the GCA.

(8) All actions or inquiries concerning intelligence materials on this contract shall identify any USASMDC control numbers, if applicable, and shall be sent to the following address: USASMDC, ATTN: SMDC-INS-E, P.O. Box 1500, Huntsville, AL 35807-3801.

REFERENCE ITEM 10g; Access to NATO Information.

a. Written concurrence from USASMDC, SMDC-INS-E; the Contracting Officer’s Representative (COR); and, the Contracting Officer (KO) is required prior to subcontracting NATO.

b. Personnel not assigned to a NATO staff position, but requiring access to NATO classified information, NATO COSMIC, NATO Secret or access to the NATO accredited SIPRNET terminals, must possess the equivalent FINAL or Interim U.S. Security Clearance based upon the appropriate personnel security investigation required. Personnel with access to NATO ATOMAL information must have the appropriate FINAL U.S. Security Clearance. The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees are NATO briefed prior to access being granted. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM, Chapter 10, Section 7.

c. Upon expiration of the contract, all NATO material released to the contractor will be returned to the USASMDC NATO Subregistry, USASMDC, ATTN: SMDC-ISP, P.O. Box 1500, Huntsville, AL 35807-3801.

d. NATO material released to the contractor will not be destroyed unless written authorization for such destruction is received from the USASMDC NATO Subregistry. A copy of the destruction certificate will be sent to the USASMDC NATO Subregistry, USASMDC, ATTN: SMDC-ISP, P.O. Box 1500, Huntsville, AL 35807-3801.

REFERENCE ITEM 10h; Foreign Government Information.

a. Written concurrence from USASMDC, SMDC-INS-E; the Contracting Officer’s Representative (COR); and, the Contracting Officer (KO) is required prior to subcontracting Foreign Government Information.

b. Foreign Government Information (FGI) is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level.

c. Foreign government information is described as information provided to the U.S. by a foreign government or information produced by the U.S. as a result of a joint arrangement with a foreign government requiring that the information or arrangement be held in confidence.

d. Procedures for access to foreign government information in Chapter 10, Section 3, of the NISPOM apply.

e. Classified foreign government information will be afforded the same degree of protection as U.S. classified. Procedures in Chapter 10 of the NISPOM apply.

f. Foreign government information will not be transferred (oral, visual, or documentary) to a third party without the written approval of the USASMDC Contracting Officer (KO) and USASMDC Foreign Disclosure Officer (FDO).

g. Receipt of foreign government information does not authorize the contractor to enter into discussions or release any data to foreign nationals or foreign representatives without an approved export license.

REFERENCE ITEM 10j; a. Controlled Unclassified Information (CUI).

(1) Personnel will comply with DOD 5200.48, with regard to safeguarding and handling CUI.

(2) Electronic transmission of CUI, facsimile and data, shall be by approved secure communication systems in accordance with Department of Defense Instruction Number 8582.01, June 6, 2012.

(3) CUI Training shall be distributed and completed by the Facility Security Officer (FSO).

REFERENCE ITEM 10k; Other.

a. Classified Automated Information Systems (AIS) Processing. Classified AIS processing at the SECRET-level and below (collateral level) required at government location identified in DD Form 254, Item/Block 8. Classified processing will be in accordance with the National Industrial Security Program Operating Manual (NISPOM) (DoD 5220.22-M) and the appropriate security/program guides/directives. Contractors working on-site at USASMDC or other Government facilities shall follow AR 380-5, Department of the Army Information Security Program, AR 25-2, Information Assurance, and other applicable regulations, security procedures, security plans, and security training requirements as identified by the Government Contracting Activity. The contractor shall obtain appropriate security clearances for required personnel.

b. Controlled Unclassified Information (CUI).

(1) Personnel will comply with DOD 5200.01, Vol 4, with regard to safeguarding and handling CUI.

(2) Electronic transmission of CUI, facsimile and data, shall be by approved secure communication systems in accordance with Department of Defense Instruction Number 8582.01, June 6, 2012.

c. Embedded Contractors (Working On-Site at Government Location(s)).

(1) All contractor personnel with an assigned duty location at USASMDC, BLDG. 5220, Martin Road, Redstone Arsenal, AL 35898 shall be U.S. citizens and have, at a minimum, a SECRET clearance.

(2) Contractors located on-site at USASMDC, or working at a facility under USASMDC cognizance, shall comply with the USASMDC Government Security Program to include all applicable security regulations, policies, & procedures. The embedded contractors (prime contractors & subcontractors) shall attend initial security training, annual security refresher training, live annual TARP training, and OPSEC training at the government location.

d. Secret Internet Protocol Network (SIPRNET) Access.

(1) Contractor personnel working on-site at a government location may require access to the SIPRNET at the government location.

(2) The contractor shall not access, download, or further disseminate any special caveated data (i.e., intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the contracting officer. Contractor access to SIPRNET is restricted to sites directly related to meeting the requirements of this contract as validated by the Contracting Officer’s Representative (COR) and/or Performance Work Statement (or equivalent).

(3) SIPRNET access via government accounts may not be subcontracted without prior written authorization from the USASMDC ISS (SMDC-INS-E); the Contracting Officer’s Representative (COR); and, the Contracting Officer (KO).

(4) Individuals having access to SIPRNET require a NATO Awareness Briefing. Individuals having access to SIPRNET at USASMDC require NATO access and a NATO Awareness Briefing.

e. Program Protection Planning (PPP). The prime contractor will include this requirement in all subcontracts awarded in support of this procurement effort.

(1) The Contractor shall provide technical and programmatic support to the U.S. Government Program to identify Critical Program Information (CPI). If CPI is identified, the Contractor shall work with the Program Manager (PM) to develop and update a Program Protection Plan (PPP) IAW DoDI 5000.2, DoDD 5200.39, and DoDD 5200.1-M, and SMDC Policy 380-9. The Contractor shall provide technical and programmatic support to the development of the following documents irrespective whether or not CPI is identified:

(a) Recommendations for SCG Annex IAW DoDM 5200.45;

(b) Technology Assessment/Control Plan (TA/CP) Annex;

(c) OPSEC Plan Annex, which implements the overall program OPSEC plan, relative to locations and activities under the direction of the contractor;

(d) System Security Management Plan Annex IAW DOD 5200.1-M and guidelines described in MIL-HANDBOOK-1785; and,

(e) (If applicable) Anti-tamper Plan IAW DoD memorandum "Guidelines for Implementation of Anti-Tamper Techniques in Weapons System Acquisition Programs", dated 3 May 2000

(2) The contractor shall participate in and ensure those individuals necessary for the successful development of a PPP and/or other documents (SCG, TA/CP, OPSEC Plan, etc.) support Technology Protection Security Working Group meetings. The contractor shall identify Government Furnished Items/Equipment (GFI/GFE) required to develop and execute the PPP and annexes. Contractor security representatives shall review all related documentation to include press announcements, articles, speeches, briefings, etc. prior to public release. The review shall include classification, controlled unclassified information (CUI), and OPSEC considerations. The OPSEC review will seek to identify and limit discussion of sensitive indicators of program activity. The contractor shall develop and implement a security awareness and education program consistent with the government's overall program across all contractor's locations and activities. The contractor shall identify and capture best practices and lessons learned relative to program protection planning and execution for the program.

f. Threat Awareness and Reporting Program (TARP). In accordance with Army Regulation 381-12, dated 1 June 2016, Threat Awareness and Reporting Program (TARP), persons employed by Army contractors will report threat-related incidents, behavioral indicators, and other matters of CI interest specified in chapter 3, to the Facility Security Officer (FSO), the nearest military counterintelligence (CI) Office, the Federal Bureau of Investigation (FBI), or the Defense Security Service. Contractor employees working as an integral part of an Army organization are required to complete live annual Threat Awareness training in conjunction with Army personnel. Contractor FSOs will ensure that all applicable requirements are implemented for personnel who work at contractor facilities. The prime contractor will include this requirement in all subcontracts awarded in support of this procurement effort. The training and reporting requirements are applicable to all Army contractors included in the applicable contract, not just those with security clearances.

g. Applicable Security Classification Guides (SCGs). The below listed security classification guides (SCG) apply to this specification. Contact the USASMDC COR (as identified in Item 13) for copies of the below identified SCG(s). In the event that a security classification guide is superseded or replaced, it is the responsibility of the COR to provide such guides to the contractor.

(1) Department of the Army, U.S. Army Space and Missile Defense Command (USASMDC), Space and Missile Defense Security Classification Guide, 29 April 2013.

(2) Department of Defense, Missile Defense Agency (MDA), Terminal High Altitude Area Defense (THAAD) Security Classification Guide, 29 December 2014.

REFERENCE ITEM 11a; Have access to classified information only at another contractor’s facility or a government activity.

a. Contractor performance is restricted to USASMDC, Building 5220 (Von Braun Complex 1), Redstone Arsenal, AL 35898-0000. Government agency or activity will provide security classification guidance for performance of this contract. Submit visit request to the KO and/or Security Management Office for need-to-know verification.

REFERENCE ITEM 11g; Authorized to Use the Services of the Defense Technical Information Center (DTIC) or Other Secondary Distribution Center.

a. Contractor access to DTIC information is restricted to contractual subject matter and SOW performance requirements. The Government Contracting Activity (GCA) will verify contractor Need-To-Know via submission of DD Forms 1540 and 1541 to DTIC.

REFERENCE ITEM 11j; Have OPSEC Requirements.

This contract requires the application of Operations Security (OPSEC) in accordance with the USASMDC Simulation Center Performance Work Statement (PWS), Paragraph 4.7.

REFERENCE ITEM 11m;

a. Mandatory Cyber Reporting: Mandatory Cyber Reporting: In addition to regulatory reporting requirements, the detection or discovery of any unauthorized access, denial of service, or compromise of a contractor’s classified or unclassified network, information system or data contained thereon will be reported within 24 hours to the USASMDC ISS. (See DD Form 254, Page 2, Item/Blocks 16a, b, c, & d for the ISS’s contact information). The prime contractor will include this requirement in all subcontracts awarded in support of this procurement effort.

b. Use of Non-U.S. Citizens:

(1) Prior approval to use or employ non-U.S. citizens on this contract must be obtained from the USASMDC Contracting Officer (KO) and USASMDC Foreign Disclosure Officer (FDO). When requesting non-U.S. citizen access to USASMDC technical data or data not in the public domain in support of the SMDC contract, include the individual’s full name, country of citizenship, and official status within the U.S. The contractor will include this requirement in all subcontracts awarded in support of this procurement effort.

(2) Unless the contractor has an approved export license or exemption, written approval is required from the USASMDC KO & FDO to release technical data or data not in the public domain to foreign nationals or foreign representatives.

(3) Partnering or sub-contracting with foreign industry will require a 30 day advanced notification by the U.S contractor to the USASMDC KO and the USASMDC FDO. Notification also applies to companies with dual national and third-country national employees.

(4) Registrants and other persons subject to ITAR, EAR, and similar US controls remain obligated to maintain awareness of and compliance with the applicable regulations and the latest Federal Register publications that affect exports of munitions or dual-use articles.

b. All questions regarding security requirements indicated herein will be referred to the Contacting Officer’s Representative (COR) or the Contracting Officer (KO).

REFERENCE Item 15: Inspections. As the Cognizant Security Office, DCSA is not relieved in whole or in part, of the responsibility to conduct security reviews and provide security oversight to the contractor unless this requirement is specifically carved and is annotated in this DD Form 254. In accordance with section 1-104b of the National Industrial Security Program Operating Manual, the designation of DCSA as the CSO does not relieve any USASMDC as the Government Contracting Activity (GCA) its responsibility to protect and safeguard the classified information necessary for its classified contracts, or from visiting the contractor to review the security aspects of such contracts. As such, the G-24 staff of USASMDC retains the right to conduct Security Oversight Inspections (SOI) of any cleared facility over which the command, program, or activity has oversight or security cognizance responsibilities. In accordance with section 1-29, sub-para j of Army regulation 380-49 (Industrial Security Program) this includes, but is not limited to, government-owned, contractor-operated, contractor owned, contractor-operated, or certain secure environment contracts. These inspections should be conducted at least bi-annually or as determined necessary by the Chief Security Officer. All Cleared Defense Contractor facilities will be afforded a 30 day advance notification of any planned SOI."

REFERENCE ITEM 17; Required Distribution.

1. SMDC-INS-E (C. Doran, B. Cecil)

2. CORs/Technical’ s Office Symbol (C. Vann)

3. USAINSCOM Contractor Support Element, ATTN: IASE-CS, Mail Stop 8825 Beulah Street, Fort Belvoir Virginia 22060-5248

4. USASMDC NATO Sub registry

5. DCSA Office as identified in Item 6c

6. ACC Contracting Officer (G. Kosut)

PROTECTING "FOR OFFICIAL USE ONLY" (FOUO) INFORMATION

1. GENERAL:

a. The "For Official Use Only" (FOUO) marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

b. Other non-security markings, such as "Limited Official Use" and "Official Use Only" are used by non-DoD User Agencies for the same type of information and should be safeguarded and handled in accordance with instruction received from such agencies.

c. Use of the above markings does not mean that the information cannot be released to the public under FOIA, only that the Government must review the information prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions thereof.

d. The World Wide Web shall be equated with “Public Access.” Information must be reviewed by USASMDC Public Affairs Office and officially approved for public release before placing on publicly-accessible Web pages or electronic bulletin boards.

2. MARKINGS:

a. Documents containing FOUO information will be marked in accordance with Department of Defense (DoD) Manual Number 5200.01, Volume 4, February 24, 2012. Contact the USASMDC Industrial Security Specialist (ISS) for a copy of the aforementioned manual. Refer to DD FORM 254, Page 2, Item/Block 16 for the ISS’s address/e-mail address/telephone number.

b. Any "'For Official Use Only" information released to a contractor by a DoD User Agency is required to be marked with the following statement prior to transfer.

“This document contains information EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FOIA. Exemptions apply.”

c. Removal of the "For Official Use Only" marking can only be accomplished by the originator or other competent authority. When the "For Official Use Only" status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: Contractors may disseminate "For Official Use Only" information to their employees and subcontractors who have a need for the information in connection with a classified contract. Contractors must ensure employees and subcontractors are aware of the special handling instructions detailed below.

4. STORAGE: During working hours, "For Official Use Only" information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after- hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: "For Official Use Only" information may be sent via first-class mail or parcel post. Bulky shipments may be sent by fourth-class mail. DoD components, officials of DoD components, and authorized DoD contractors, consultants, and grantees send FOUO information to each other to conduct official DoD business. Tell recipients the status of such information, and send the material in a way that prevents unauthorized public disclosure. Make sure documents that transmit FOUO material call attention to any FOUO attachments. Normally, you may send FOUO records over facsimile equipment. To prevent unauthorized disclosure, consider attaching special cover sheets, the location of sending and receiving machines, and whether authorized personnel are around to receive FOUO information. FOUO information may be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Mark the records "For Official Use Only" and tell the recipient the information is exempt from public disclosure under the FOIA and requires special handling.

6. ELECTRONIC TRANSMISSION: E-mailing of "For Official Use Only" information shall be by approved secure communication systems. Please contact the USASMDC ISS for further instructions (Refer to DD FORM 254, Page 2, Item/Block 16 for contact information).

7. DISPOSITION: When no longer needed, FOUO information must be shredded.

8. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of "For Official Use Only" information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions and disciplinary action may be taken against those responsible.

Redstone Arsenal, AL 35898 Address: 5220 Martin Road (VBI) Redstone Arsenal, AL 35898