Attch_4_-_ALMS_Draft_DoD_Security_Classification_Specification_DD_Form_254.pdf

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate Government authority. Proposed public releases shall be submitted for approval prior to release

Direct X Through (Specify):

Items intended for public release shall be processed through the AFRL RD/RV approval process 90 days prior to requested release date. Final approval must occur prior to release outside of government channels. Items submitted through the review process must derive from a government representative if being released by a DoD contractor. Unclassified information does not equal publically releasable. NO PUBLIC RELEASE IS AUTHORIZED FOR SCI

OR NON-SCI.

13. SECURITY GUIDANCE: The Security classification guidance need for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guidelines/extracts reference herein. Add additional pages as needed to provide complete guidance).

Contractor shall follow security classification guidance on information, hardware and equipment as provided in the following security classification guides: Directed Energy (DE) Weapons and Counter-DE Capability Technologies, 17 Mar 06; Laser Countermeasures and Counter-Countermeasures (LCCM), 01 Aug 11. The Contracting Officer will provide other Security Classification Guides under separate cover as tasks are assigned. Revised Security Classification Guides will be provided under separate cover and may not require updating or revising the DD Form 254. The Contractor shall comply with any revisions to that Security Classification Guide.

Document classification markings will be done in accordance with E.O. 13526 and DoDM 5200.01, Volume 2, Marking of Classified Information, 24 Feb 2012, and supplements thereto. The contractor must comply with special OPSEC requirements contained in the contract or addendum thereto. The requirements, restrictions and other safeguards prescribed by the National Industrial Security Program Operating Manual (NISPOM), DoD 5200.22-M, Feb 2006 and its supplements apply to all classified performance. The prime contractor must contact AFRL/RDMS at (505) 853-3379, AFRL Industrial Security Oversight Office for execution of the Visitor Group Security Agreement (VGSA), and submit a company letter identifying on-site key pers nnel management officials or company representatives and a security focal point of contact for security related matters (no ally FSO) prior to on-base operations. Prime contractor is responsible to ensure on-base subcontractors execute a VGSA with AFR RDMS prior to on-base operations. The prime contractor must include a provision in each on-base subcontract requiring subcontractors contact AFRL/RDMS and execute a VGSA prior to beginning on-base operations. The contractor must comply with sp cial OPSEC req irements contained in the contract or addendum thereto.

Program Manager: Lt. Justin Pung, AFRL/RDL, 3550 Aberdeen Avenue E, K tland AFB, NM 87117-5776, (505) 863-0243

AFRL DET 8/RVKDL CO, AFRL/RDMS Industrial Security PM AFRL/RDMS PSEC, SIO, ISSM/O (IA), 377 MSG/SCXS COMSEC, AFRL/RDMS Chief Information Protection digitally sign on contin tion sheet under Item 13.

SEE CONTINUATION OF DD 254 AND ATTACHME TS

14. ADDITIONAL SECURITY REQUIREMENTS. R uiremen n addition to ISM requirements, are established for this contract. (If Yes, X Yes No identify the pertinent contractual clauses in the cont t document itself, provide a ppropriate statement which identif ies the additional requirements. Provide a copy of the requirements to the cognizant secu office. Use Item 13 if ditional space is needed.)

The contractor will provide AFRL/RDMS 3550 Aberdee Ave SE, Kirtland AFB, NM 87117, and the Servicing Security Activity (SSA) with all information required by the Notification of Governmen Security Acti ty Clause, and any additional information and/or documentation that is required by that office.

For TEMPEST requirements and guidance s attach d detailed TEMPEST Security Requirements from AFRL/RVIC, ISSM/O (IA).

See Continuation Sheet

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, identify specific areas or X Yes No elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

DSS is relieved of inspection responsibility for portions performed on Kirtland AFB. AFRL/RDMS has security oversight for collateral work conducted at AFRL on Kirtland AFB. AFNWC/NT2 has inspection oversight for Non-SCI Intelligence Classified.

See Continuation Sheet

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below

a. TYPED NAME OF CERTIFYING OFFICIAL

Susan Thorpe

b. TITLE

Contracting Officer

c. TELEPHONE

(505)846-3404

d. ADDRESS (Include Zip Code) 17. REQUIRED DISTRIBUTION

AFRL DET 8/RVKDL X a. CONTRACTOR

3550 Aberdeen SE b. SUBCONTRACTOR

Kirtland AFB, NM 87117-5776 X c. COGNIZANT SECURITY OFFICE FOR PR ME AND SUBCONTRACTOR

e. SIGNATURE d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

X e. ADM NISTRATION CONTRACTING OFFICER

X f. OTHERS AS NECESSARY

DD Form 254, (BACK), DEC 1999

BAA RVKD-2014-0001 CALL 0002

Attachment 4

DRAFT

CONTINUATION OF DD254 FOR BAA, RVKD-2014-0001 CALL 0002

8. ACTUAL PERFORMANCE

a. LOCATION

TBD

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

Item 10.a.: If accountable COMSEC is required the contractor is governed by AFMAN 33-283, Para 7.2.6 Air Force

COMSEC guidance.

If access, only the contractor will need administrative access to classified COMSEC material. The contractor will not receipt, copy, or generate classified COMSEC material.

Item 10.b.: The contractor is permitted access to RESTRICTED DATA (RD) in the performance of this contract. Access to

RD requires a final U.S. Government clearance at the appropriate level.

Item 10.d.: The contractor is permitted access to Formerly Restricted Data (FRD) in the performance of this contract.

Access to FRD requires a final U.S. Government clearance at the appropriate level

Item 10.e. (2): The contractor requires access to Non-SCI intelligence mater als. A cess to intelligence information requires a final U.S. Government clearance at the appropriate level and will only b done at the uthorized government facilities.

Non –SCI intel can be at the SECRET level. See attachment.

Item 10.g.: The contractor is permitted access to North Atlantic Tre y Org nization (NATO) information in performance of this contract. The government project manager is the designated repre ative that will ensure the contractor Facility

Security Officer and concerned employees are NATO briefed prior to acc s being granted. Prior approval of the contracting activity is required for subcontracting. Access requires a f al S Governm nt clearance at the appropriate level. Forward

NATO classified materials needed by the contractor only fr m an A rce Sub-registry directly to the contractor concerned.

Contractor is cleared by DSS to have access to NATO.

Item 10 h.: The contractor is permitted acces to Fore n Gover ment information. Access to Foreign Government information requires a final U.S. Governm t clearan e at the appropriate level.

Item 10.j.: FOUO information provid d under th s contract shall be safeguarded as specified in attachment For Official Use

Only (FOUO) Addendum.

Item 10 k.: Access to SIPRNET is required in erformance of this contract.

Item 11.c.: The contractor requires ac ss t classified source data up to and including SECRET in support of the work effort. The company selected will need t be able to store SECRET at their off base facility. The facility clearance will be verified once a company is selected. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, Chap. 4, and use of bibliography, classification, declassification, and markings will be in accordance with EO 13526, the DoDM 5200.01, Volume 2, Marking of Classified Information, 24 Feb 2012, and

AFI 16-1404, Information Security Program.

Item 11.g.: The contractor is authorized to use the services of Defense Technical Information Center (DTIC) and is required to prepare and process a DD Form 1540, Registration for Scientific and Technical Information Services, and DD Form 2345, Military Critical Technical Data Agreement. The contracting activity must be involved in certifying need-to-know to DTIC.

If you need help registering or filling out the forms please contact the DTIC Office at 1-800-225-3847.

Item 11 h.: COMSEC material/information may not be released to DOD contractors without Air Force Cryptological

Support Center (AFCSC) approval. Contractor must forward requests for COMSEC material/information to the COMSEC officer through the program office.

BAA RVKD-2014-0001 CALL 0002

Attachment 4

CONTINUATION OF DD254 FOR BAA RVKD-2014-0001 CALL 0002

I Item 11j.: OPSEC. The contractor shall provide operations security (OPSEC) protection for all sensitive/critical information in accordance with AFI 10-701 and the (RV/RD OPSEC Plan or specific Program OPSEC Plan). The applicable

Critical Information List (CIL) will be provided under separate cover. It is incumbent upon the contractor to request this document via the contracting officer or directly to the OPSEC Program Office. The contractor shall describe the steps necessary to protect sensitive and Critical Program Information (CPI) to their staff and communicate any sensitivity to the government for the work they complete. The contractor will include OPSEC awareness, Program Protection, and Counter

Intelligence education and awareness training to all personnel as part of their standard security program on an annual basis.

New contracted employees shall be trained within 90 days. Technology Protection unique security measures may apply. The contractor must also adhere to any Program Protection Plans (PPP) that may cover the protection of sensitive and/or CPI under their respective contract. On-site/on-base contractors will participate in the ongoing efforts and requirements laid out by the PRS OPSEC Program and Program Protection Lead.

Items intended for public release shall be processed through the OPSEC Tool. Final approval must occur prior to release outside of government channels. Items submitted to the OPSEC Tool must derive from a government representative if being released by a DoD contractor. Unclassified information does not equal publically releasable. All information deemed FOUO or unclassified must be marked according to the originating office's instructions and AFI 61-204.

Information requested by the media or members of the public shall be processed hrough, referred to the 377th ABW Public

Affairs Office. The 377th ABW Public Affairs Office will work with the des gnat d AFRL POCs to provide a proper response.

FOIA requests for information are to be worked by the government Office of Primary Resp nsibility (appointed by the 377th

FOIA Office) and the AFRL FOIA office. An OPSEC assessment ill be c mpleted on all information being released via the FOIA.

Proprietary information must be protected in accordance w th n n-disclosur and other applicable contractual (if any) agreements.

Item 11.l.: See Section I of the general provision the clau titled Notification of Government Security Activity. AF

FAR Sup 5352.204-9000.

Item 13.:

AFRL/RVKDL, CO, Susan Thorp , 3550 erdee Avenue SE, Kirtland AFB, NM 87117:

________________________ ___________ Date ____________

AFRL/RDMS, Industrial Security, 355 Ab rdeen Avenue SE, Kirtland AFB, NM 87117:

____________________________________ Date ____________

AFRL/RDMS (OPSEC Security), 3550 Aberdeen Avenue SE, Kirtland AFB, NM 87117:

____________________________________Date _____________

AFNWC/NT2 (SIO), 1350 Wyoming Blvd SE, Kirtland AFB NM 87117:

___________________________________ Date_______________

AFRL/RVIC ISSM/O (IA), 3550 Aberdeen Ave SE, Kirtland AFB, NM 87117:

___________________________________ Date ________________

377 MSG/SCXS (COMSEC), 2000 Wyoming Blvd SE, Kirtland AFB, NM 87117:

_________________________________ Date _______________

AFRL/RDMS, Chief Information Protection (IP), Robert Clougherty, KAFB, NM:

__________________________________ Date: ______________

COMSEC ACCESS AND /OR ACCOUNT

General Guidance Access to classified COMSEC information shall be restricted to U.S. citizens who have been granted a final security clearance by the U.S. Government, have a valid need-to-know (as defined in the National Industrial Security

Program Operating Manual), and have successfully completed a non-lifestyle, counterintelligence scope polygraph examination, when required by the U.S. Government or appropriate security office, administered in accordance with DoD or agency requirements and applicable law. Non-U.S. citizens, including immigrant aliens, are not eligible for access to classified COMSEC information. For access to some types of COMSEC information a Cryptographic Access Briefing or

COMSEC Briefing may be required. (NSA Contractor accounts refer to NSA/CSS PM 3-16 Para 7 and 8 for briefings required under specific types of access.) Access to unclassified controlled cryptographic items (CCI) will be limited to U.S.

Citizens who have a need for such access.

If a National Security Agency (NSA) Contractor COMSEC Account is established (or already exists), NSA/CSS Policy

Manual 3-16 and appropriate follow-on documents shall apply. If contractor personnel will have access to COMSEC information via an Air Force COMSEC user account, USAF COMSEC instructions and regulations (e.g.: AFMAN 283), Command COMSEC supplements (and appropriate follow-on documents) and guidance provided by the supporting AF

COMSEC Office regarding operation of Air Force COMSEC user accounts shall apply.

All individuals with access to COMSEC information via an AF COMSEC user acc unt who:

• Have access to cryptographic media classified SECRET or above;

• Operate Key Generating equipment (e.g.: KG-83, KoK-22, Etc);

• Prepare, authenticate, or decode nuclear control orders (actual or exercise);

• Are responsible for keying cryptographic equipment to SECRET or above; or

• Are responsible for crypto engineering or designated install ion technicians;

MUST be enrolled in the AF Cryptographic Access Program PRIOR h ing such access.

Audit and inspection of NSA contractor COMSEC accoun s ll be in acc dance with NSA/CSS PM 3-16 Section XVII.

Audit and Inspection of AF COMSEC user accounts shall b in acc dance with AFMAN 33-283. COMSEC and non-

COMSEC inspections of AF user accounts will not be condu ted ncurrently.

The POC for Communications Security (COMSE ) Kirtlan Air Force Base is:

377 MSG/SCXS, 2000 Wyoming SE, Bldg 20604, R om B-16, Kirtland AFB, NM 87117-5607 (505) 846-1218

TEMPEST SECURITY REQUIREMENTS

The contractor shall ensure that TEMPEST conditions related to this contract are minimized.

The contractor shall provide countermeasures assessment data to the Contracting Officer (CO), with an informational copy to

AFRL/RVIC, ISSM/O (IA), 3550 Aberdeen SE, Kirtland AFB, NM 87117, in the form of a TEMPEST Security Protection

Assessment Request (ESPAR). The ESPAR shall provide only specific responses to the data required in paragraph c. below;

the contractor’s standard security plan shall not be used as a “stand-alone” ESPAR response. The contractor shall not submit a detailed facility analysis/assessment. The ESPAR information will be used by the government TEMPEST authority to complete a TEMPEST Countermeasures Assessment of the contractor’s facility using current Air Force TEMPEST directives. TEMPEST is applied on a case-by-case basis and further information may be required to complete the ESPAR;

should this be the case, the contractor shall provide this information to the contracting officer when requested. After evaluation of the ESPAR by the government TEMPEST authority, additional TEMPEST requirements may be necessary.

When changes to the information required in paragraph c. below occur (including, but not limited to, relocation of equipment from the originally approved room, or increasing the classification level or volume of processing), the contractor shall submit to the CO a new ESPAR, with an informational copy to AFRL/RVIC, ISSM/O (IA), address as shown above, identifying the new configuration at least thirty (30) days before the changes occur; the contractor shall not commence SECRET or higher processing with the new configuration until receiving approval to do so from the CO.

ESPAR Contents:

SYSTEM DESCRIPTION:

SYSTEM/FACILITY: Full name and address of company submitting r quest and RFP/ ntract number and duration.

Manufacturer, model, and serial number of all electronic processing quipment that will be used for processing classified information (SECRET and above). Also, provide a brief title ident ying th overall system or facility (e.g., XYZ missile word processing system, ABC aircraft interactive graphics system, etc

LOCATION: Identify the address (including city, state, zip co facility, b ilding and room number) where the system and facility are located.

RESPONSIBLE PERSONNEL

SECURITY OFFICER/MANAGER: Prov de name tle office ymbol and telephone number. Include the company appointed TEMPEST authority, if applicable

SYSTEM CUSTODIAN: If diffe ent from (2)(a) bove, provide name, title, office symbol and telephone number.

OPERATIONAL RISK: Level mount of clas fied: Identify the levels of classification (including specific designator, such as SCI, SAP, SIOP, etc.) that will processe the estimated volume per day/month for each level expressed as a percent (of total material processed) for each lev If time-sharing an advice, list classification(s), volume(s), and percentage(s) of use by other program(s). Volume may be d ribed in data bytes/day, lines/day, pages/day or hours/day.

The prime contractor shall ensure that all subcontractors/vendors are included as part of their TEMPEST.

Subcontractors/vendors are subject to comply with Air Force TEMPEST requirements.

Classified processing shall not begin until specific written approval/authorization, including approval for changes required pursuant to paragraph c above, are provided by the Contracting Officer based on an TEMPEST certification letter issued by the TEMPEST authority. The TEMPEST authority at Kirtland AFB is AFRL/RVIC, ISSM/O (IA).

Use of any telecommunications system or a device to include, but not limited to; cellular phones, hand-held radios, beepers/pagers, cordless telephones, cordless microphones, facsimile machines and computers constitutes consent to monitoring in accordance with AFI 10-712, (TMAP).

TEMPEST requirements apply to the SCIF execution location. See Defense Federal Acquisition Regulation Supplement

(DFARS) Clause 252.239-7000, Protection Against Compromising Emanations, dated 25 Jun 04, revised 10 Jan 08;

Intelligence Community (IC) Tech Spec‐for ICD/ICS 705, Technical Specifications For Construction and Management of

Sensitive Compartmented Information Facilities, version 1.3, dated 10 Sep 15; Committee on National Security Systems

Advisory Memorandum (CNSSAM) TEMPEST/01-13, Red/Black Installation Guidance, dated 17 Jan 14.

3, Red/Black Installation Guidance, dated 17 Jan 14.

CONTINUATION OF DD254 FOR BAA RVKD-2014-0001, CALL 0002

FOR OFFICIAL USE ONLY (FOUO) ADDENDUM

The following procedures will be used to protect FOR OFFICIAL USE ONLY (FOUO) material:

1. HANDLING: Access to FOUO material shall be limited to those employees needing the material to do their jobs. The

FOUO marking is assigned to material created by a DoD user agency. FOUO is not a classification, but requires extra precaution to insure it is not released to the public.

2. MARKING UNCLASSIFIED: Mark unclassified documents containing FOUO; “UNCLASSIFIED//FOR OFFICIAL

USE ONLY” at the bottom of each page and back cover (if any). Paragraphs, sentences, illustrations, and figures that are deemed to be FOUO will be portion marked (U//FOUO) at the beginning of the item. FOUO material released to a contractor by a DoD user agency must have the following statement on the front page or cover: “THIS DOCUMENT

CONTAINS MATERIAL EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FREEDOM OF

INFORMATION ACT. EXEMPTION(S)______________APPLY.”

3. MARKING CLASSIFIED: In a classified document, mark:

a. An individual paragraph that contains FOUO, but not classified material by placing “U//FOUO” at the beginning of the paragraph.

b. The top and bottom of each page that has both FOUO and classified m erial with the highest security classification of the material on that page.

c. “UNCLASSIFIED//FOR OFFICIAL USE ONLY” at the bottom of each page t at has FOUO but no classified material.

d. If a classified document also contains FOUO material or if th classified material becomes FOUO when declassified, place the following statement on the bottom o t cover or th first page under the classification marking:

“NOTE: If declassified, review the document to make sure materia not FOUO and not exempt under AFI 37-131 before public release.”

e. Mark other records such as compu r prin uts, ph ographs, films, tapes, or slides “UNCLASSIFIED//FOR

OFFICIAL USE ONLY” so the receiver or iewer kn ws the rec rd contains FOUO material.

f. Ensure documents that transmit FO material call attention to any FOUO attachments.

4. FOUO DETERMINATION All docume s determined to contain FOUO information will identify the FOUO exemption criteria from the Freedom Of Information Act FOIA), by citing the applicable paragraph number. FOUO material released to a contractor by a DoD user agen y must hav the following statement on the front page or cover: “THIS DOCUMENT

CONTAINS MATERIAL EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FREEDOM OF

INFORMATION ACT. EXEMPTION S)______________APPLY.”

5. STORAGE: During normal duty hours, place FOUO material in an out-of-sight location, if your work area is accessible to persons who do not have a valid need for the material. After normal duty hours, store FOUO material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided. When there is not internal security, locked buildings or rooms usually provide adequate after-hours protection.

For additional protection, store FOUO material in locked container such as file cabinets, desks, or bookcases. Expenditure of funds for security container or closed areas solely for the protection of FOUO material is prohibited.

6. TRANSMISSION: FOUO material shall be transmitted by the same methods as other unclassified material. Discussion of FOUO material on the telephone is authorized if necessary for the performance of the contract. FOUO material may be transmitted over telephone lines in digital form, by telecopies, or by other DSN Teletype lines without encryption.

7. RELEASE: FOUO material shall not be released outside the contractor’s facility except to representatives of the DOD.

8. DESTRUCTION: When no longer needed, FOUO material shall be disposed of by a method that precludes its disclosure to unauthorized individuals.