B08 Attachment 0005 - CHS 6 DD-254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, "DoD Contract Security Classification Specification"

Product Lead, Common Hardware Systems (PdL CHS), APG, MD

requires a final clearance. The contractor may be authorized to receive government furnished cryptographic equipment, if a COMSEC account is required and if Item 11h of this DD Form 254 is checked. Contractor personnel are subject to The Department of Army Cryptographic Access Program (DACAP), IAW AR 380-40. The contractor shall comply with NSA/CSA Manual 3-16, AR 380-40, and the Committee of National Security Systems Instructions (CNSSI) 4001, “Control of Communications Security Material,” or other guidance provided by the central office of record. If access to COMSEC information is required at Government facilities, contractor shall adhere to the government/program COMSEC plan or guidance. Approval by the KO/COR is required prior to transporting or carrying classified COMSEC material on a cleared commercial carrier or passenger aircraft.

The government program/project manager shall designate the number of personnel requiring cryptographic (CRYPTO) access. Approval by the KO is required prior to the flow down of COMSEC requirements to any subcontractor.

10j. Controlled Unclassified Information (CUI) - Access to Controlled Unclassified Information (CUI) is required in the performance of this contract. Information designated as CUI, generated or provided under this contract shall be controlled, handled, stored, marked, safeguarded, transmitted, and destroyed IAW DoDI 5200.48, AR 380-5.

Electronically transmitted CUI shall be sent via:

o Emailing CUI between the Government and a Contractor: Digitally encrypted email can be accessed via DOD CAC or if the Contractor's company has the proper DOD-approved assurance certificates installed. For more details on DOD-approved assurance certificates visit https://public.cyber.mil/eca/.

o Government SharePoint: Contractor must have a DOD CAC and access is based on the Government's approval.

o DOD Safe (use email certification to enter site) https://safe.app.mil/ o IntelDocs - https://inteldocs.intelink.gov/inteldocs o CD/DVD: Save CUI-marked files to a CD/DVD and properly mail to recipient.

o Fax: Send CUI-marked documents via facsimile machine to recipient.

o An accredited information system with proper security controls.

The contractor may disseminate CUI information to their employees and subcontractors that have a need-to-know.

The contractor shall report the unauthorized disclosure of CUI to the COR.

10k. SCGS – SCGs associated with this effort are listed below by title, date, and office of primary responsibility per AR 380-49. Contractor will require access to all SCGs listed:1) PD Net E Approved Security Classification Guide dated 22 August 2015, 2)PD Net E Approved Security Classification Guide dated 24 May 2018, 3)ARCYBER SCG FOR CYBERSPACE OPERATIONS AND SECURITY, DATED 19 MAY 2016, U.S. ARMY CYBER COMMAND AND SECOND ARMY, or most current SCG.

11c. Receive, store, and generate classified information or material - Contractor is authorized to receive, store, and generate classified material at the contractor’s facility. Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware, reference item 10k. All classified information received or generated will be properly stored and handled according to the markings on the material. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of this contract, the U.S. Government will be contacted for proper disposition instructions.

11d. Fabricate, modify, or store classified hardware - Contractor will fabricate, modify, or store classified hardware at their facility.

11h. Require a COMSEC account - Contractor requires a COMSEC account. Access to COMSEC requires a final clearance. If this item is checked, then item 10a will be checked.

11j. Have Operations Security (OPSEC) Requirements – (ALWAYS REQUIRED) (REQUIRED WHEN THE PLACE OF PERFORMANCE IS AT GOVERNMENT INSTALLATIONS/FACILITIES) While performing work at Government facilities, the contractors shall adhere to the OPSEC requirements IAW the OPSEC Plan/SOP listed by name and date, in the REMARKS BELOW, or its most current version. The OPSEC plan will be provided to the contractor after contract has been awarded.

and/or (REQUIRED WHEN THE PLACE OF PERFORMANCE IS AT THE CONTRACTOR’S FACILITY) If performing on contractor site, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1. The contractor shall develop an OPSEC Plan IAW AR 530-1 as listed in the PWS, SOW, and, SOO CDRL NUMBER BELOW. RA is responsible for providing to the contractor a current and valid program/command OPSEC Plan.

The contractor will use the program/command OPSEC Plan to ensure the contractor developed OPSEC Plan includes the same Critical Information List (CIL) and OPSEC measures.

11l. Receive, store, or generate CUI - Contractor is authorized to receive, store, or generate CUI in the performance of this contract. Information designated as CUI, generated under this contract shall be controlled, handled, stored, marked, safeguarded, transmitted and destroyed IAW DoDM 5200.48, AR 380-5, and the following guidance:

Electronically transmitted CUI shall be sent via:

o Emailing CUI between the Government and a Contractor: Digitally encrypted email can be accessed via DOD CAC or if the Contractor's company has the proper DOD-approved assurance certificates installed. For more details on DOD-approved assurance certificates visit https://public.cyber.mil/eca/.

o Government SharePoint: Contractor must have a DOD CAC and access is based on the Government's approval.

o DOD Safe (use email certification to enter site) - https://safe.app.mil/.

o IntelDocs - https://inteldocs.intelink.gov/inteldocs o CD/DVD: Save CUI-marked files to a CD/DVD and properly mail to recipient.

o Fax: Send CUI-marked documents via facsimile machine to recipient.

The contractor may disseminate CUI information to their employees and subcontractors that have a need-to-know.

The contractor shall report the unauthorized disclosure of CUI to the COR.

12. Public Release - All requests for public release shall be submitted by the government COR utilizing the CECOM Public Release Approval System (PRAS) at: https://pras.army.mil/PRAS/default.asp and/or through OPSEC Officer and Public Affairs Office (PAO) 13a. Base Contract Only – Specific security requirements, e.g., SCG, place of performance, access, etc., are contingent upon each task order and shall be stipulated in the task order’s DD254.

13b. IT Levels - IT Level Designations. Contractor personnel shall be designated as IT-I IT-II or IT-III, as defined in the Traditional Security Checklist: Version 1, Release 3, Benchmark Date 15 Jun 2020, STIG ID: PE-02.02.01 at https://cyber.mil/. Contractor personnel shall obtain the appropriate security screening as prescribed in STIG PE-02.02.01 and DoD 8570.01-M (Ch4), before being granted access to DoD information technology (IT) systems that contain classified/sensitive data. Upon request by the Contractor, the Government will initiate the investigation for IT level access to DoD IT systems that contain classified/sensitive data and grant an interim IT-I or IT-II access determination investigation. Cleared contractors shall ensure all personnel are designated as IT-I, IT-II, or IT-III in the DISS/JPAS Personnel Summary. Contractor Visitor Access Requests (VARs) shall also be annotated with the appropriate IT level and appropriately cleared IAW DoDI 8500.01 and Homeland Security Presidential Directive 12 for the following investigation requirements: IT/ADP Level I- Tier 5; IT/ADP Level II- Tier 3; and IT/ADP Level III (Normal IT user)- Tier I."

13c. Spillages - Classified and covered defense information, as defined in DFARS 252.204-7012, information, will be protected IAW the NISPOM and DFARS 252.204-7012. All security and cyber incidents involving classified and covered defense information, e.g., spillage, shall be immediately reported to the RA Security Specialist and to their DSS Industrial Security Representative. A spillage occurs whenever or covered defense information is transferred onto an information system not authorized for the appropriate security level or exploited by external/malicious sources. Information will be forwarded to KO/COR and the Program Manager for a program damage assessment to be conducted IAW AR 380-49. Contractors responsible for a willful or negligent spillage of information shall pay enterprise service providers for the associated cleanup costs across the enterprise to restore the affected network or networks to a normal operating configuration.

13d. PWS, SOW, or SOO - The PWS, SOW, or SOO shall be provided to the contractor’s FSO and/or CSSO along with the DD Form 254 and associated Continuation Pages. This is to ensure that the FSO and/or CSSO are aware of all contractual requirements relating to security within the effort.

13e. NATO Awareness Briefing - All cleared contractor personnel shall obtain a NATO Security Awareness Briefing from their FSO and/or from their program security specialist. NATO Awareness Briefing can be found at the following CAC enabled link http://www.cdse.edu/documents/toolkits-fsos/NATO Brief.pdf 13f. OCONUS Travel - Contractors traveling to OCONUS locations for either official or unofficial travel may require a defensive counterintelligence briefing prior to their departure. Requirement for defensive travel brief will be based on threat and will remain at the discretion of the G2 and/or organization’s security manager.

13g. Generation of classified material - The generation of classified material includes derivatively classified information.

13h. Security Trainings/Briefings - Several training requirements exist for contractor personnel per DoD and Army regulation/directives. On-site contractors may receive training briefs from the government appointed Security Manager; however, contracting companies will be required to provide training to off-site contractor employees. Training is tailored to the organization’s requirements as well as local policy. Some examples of Security training provided to integrated/embedded contractors may include, but is not limited to, the following:

Threat Awareness Reporting Program (required for all contractors with security clearances) - Per AR 381-12 Threat Awareness and Reporting Program (TARP), cleared contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b.

Initial Security Orientation: Online training available on the Army Learning Management System (ALMS) site, reference ALARACT 207-2103 - Initial training Annual Security Orientation: Online training available on the Army Learning Management System (ALMS) site, reference ALARACT 207-2103 - Annual training requirement Derivative Classification Training, reference DoD 5200.01-V3- Annual training requirement Foreign travel training, AR 525-13 - Required when traveling abroad Department of the Army (DA), Army Material Command (AMC), and/or commander directed security stand-downs, e.g., ad-hoc refresher trainings.

13i. Security Classification Guides - Per AR 380-49, the RA is required to identify by title, functional office of primary responsibility, and approval date, the SCGs applicable to the contract on the DD Form 254 within item

13. The requirement for SCG(s) must also be annotated on DD Form 254, block 10k. Due to the mission and its reimbursable nature, it is impossible to proactively identify all SCGs associated with contract efforts. However, upon identification, the RA shall immediately provide SCGs related to the classified information associated with

CHS DD254 Certifying Official

Aberdeen Proving Grounds, MD 21005 Enter address (include zip code).: 6560 Surveillance Loop, Aberdeen Proving Grounds, MD 21005