Appendix E Draft DD254.pdf

For the best experience, open this PDF portfolio in

Acrobat X or Adobe Reader X, or later.

Get Adobe Reader Now!

http://www.adobe.com/go/reader

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567

OMB approval expires:

June 30, 2025

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors

-- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785

DD 254, "DoD Contract Security Classification Specification"

CurrentPage:

PageCount:

Select classification from drop-down list.: Unclassified

SerialNum:

a. Facility clearance level. Select one.: 2

b. Level of safeguarding for classified information/material required at contractor facility. Select one.: 2

Select for "original.": 0

Select for "original.": 1

Enter prime contract number.: Request for Proposal, Not Valid for Performance

Select for "revised.": 0

Select for "revised.": 0

Enter subcontract number.:

Select for "final.": 1

Select for "final.": 0

Enter solicitation or other number.: TBD

Enter due date in format YYYYMMDD.:

Enter date in format YYYYMMDD.:

Enter revision number.:

Enter date in format YYYYMMDD.:

Enter final specification.:

Enter date in format YYYYMMDD.:

Select for "no.": 1

Select for "no.": 1

Select for "no.": 0

Select for "no.": 0

Select for "yes.": 0

Select for "yes.": 0

Select for "yes.": 1

Select for "yes.": 1

Enter preceding contract number.:

Enter contractor's request date in format YYYYMMDD.:

Enter period.:

Enter typed name of certifying official (last, first, middle initial).: TBD

Enter typed name of certifying official (last, first, middle initial).: N/A

Enter typed name of certifying official (last, first, middle initial).: Holman, Tracie L.

Enter CAGE code of the prime contractor.: TBD

Enter CAGE code of the prime contractor.: N/A

Enter CAGE code of the prime contractor.: N/A

Enter cognizant security office(s) (Name, Address, ZIP Code, Telephone required; Email Address optional).: TBD

Enter cognizant security office(s) (Name, Address, ZIP Code, Telephone required; Email Address optional).: N/A

Enter cognizant security office(s) (Name, Address, ZIP Code, Telephone required; Email Address optional).: See Blk 15

Select to add row to locations.:

Select to remove last row from locations.:

Select to delete all signatures.:

Enter location(s).: See Blk 13

Enter general unclassified description of this procurement.: Contractor Logistics Support (CLS) for Army, Navy, Air Force, and Coast Guard C-20 and C-37 aircraft.

Select for "a. CONTRACTOR.": 1

Select for "a. CONTRACTOR.": 0

Select for "a. CONTRACTOR.": 1

Select for "f. OTHER AS NECESSARY.": 0

Select for "f. OTHER AS NECESSARY.": 1

Select for "f. OTHER AS NECESSARY.": 1

Select for "b. SUBCONTRACTOR.": 0

Select for "b. SUBCONTRACTOR.": 0

Select for "b. SUBCONTRACTOR.": 0

Select for "g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER.": 0

Select for "g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER.": 1

Select for "c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR.": 0

Select for "c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR.": 1

Select for "c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR.": 1

Select for "h. REQUIRE A COMSEC ACCOUNT.": 0

Select for "h. REQUIRE A COMSEC ACCOUNT.": 1

Select for "d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION.": 0

Select for "d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION.": 1

Select for "d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION.": 0

Select for "i. HAVE A TEMPEST REQUIREMENT.": 0

Select for "i. HAVE A TEMPEST REQUIREMENT.": 0

Select for "e. NATIONAL INTELLIGENCE INFORMATION: - (1) Sensitive Compartmented Information (SCI).": 0

Select for "e. NATIONAL INTELLIGENCE INFORMATION: - (2) Non-SCI.": 0

Select for "j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS.": 1

Select for "j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS.": 1

Select for "k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE.": 1

Select for "k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE.": 1

Enter infomration for "other.": See Continuation Sheet

Enter infomration for "other.": See Continuation Sheet

Enter infomration for "other.": AFLCMC IP 1801 Tenth St, Bldg 8, Room 103

WPAFB, OH 45433-7629,

AFLCMC.IPDDForm254.Workflow@us.af.mil

HQ Defense Counterintelligence and Security Agency 27130 Telegraph Rd Quantico, VA 22134

Select for "e. ADMINISTRATIVE CONTRACTING OFFICER.": 0

Select for "e. ADMINISTRATIVE CONTRACTING OFFICER.": 1

Select for "l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED INFORMATION (CUI). .": 1

Select for "m.OTHER.": 1

Select for "direct.": 0

Select for ": 1

Enter specification for "through".: AFLCMC/WVV 580-649-9551 kevin.marshall@us.af.mil

Enter public release authority.: AFLCMC/PA 937-255-2210 AFLCMC.PA.Workflow@us.af.mil

Select to add signature.:

Select to remove last signature.:

text: See Continuation Sheet text: See Continuation Sheet

Click on this button to attach a file(s).:

rep:

Enter signature.:

Explain and identify specific areas and government activity responsible for inspections.: a. Ref Blk 11l: DoDI 5200.48_DAFI 16-1403, Controlled Unclassified Information (CUI)

b. Ref Blks 11j & 11l: C-37 A/B Security Classification Guide

c. Ref Blks 11j & 11l: C-37 A/B Program Protection Plan to include Appendices

Explain and identify specific areas and government activity responsible for inspections.: a. Ref Blks 10a/11h: NSA has oversight for COMSEC at Contractor Facility. Bases listed in Table 1 of Continuation sheet will have oversight for COMSEC distributed to COMSEC managers of the installation

Enter GCA name.: AFLCMC/WVV

Enter AAC of the contracting office.: FA8106

Enter AAC of the contracting office.: FA8106

Enter address (include zip code).: 3001 Staff Dr, 1AC4-105A Tinker Air Force Base, OK 73145

Enter address (include zip code).: AFLCMC/WVK 3001 Staff Dr, 1AC4-105A Tinker Air Force Base, OK 73145

Enter POC name.: Kevin Marshall

Enter telephone number (include area code).: 5806499551

Enter telephone number (include area code).: 4057393831

Enter email address.: kevin.marshall@us.af.mil

Enter email address.: tracie.holman@us.af.mil

Enter title.: Contracting Officer

Enter the date signed in format YYYYMMDD.:

Appendix E: DD254 Continuation Sheet

Contract #: TBD

a. Reference Blks 1a/1b: Contractor must obtain a SECRET Facility Security Clearance prior to being granted access to SECRET information and must obtain SECRET safeguarding capability prior to being provided SECRET information.

b. Reference Blks 8a/8c: Primary work performance will occur at military installations in the U.S. and worldwide. The installation commanders have formally elected to retain security cognizance as outlined in Table 1 below; therefore, DCSA is relieved of inspection responsibility for contractor performance at these military installations.

Table 1: Main Operating Base CSOs

MAIN OPERATING BASE COGNIZANT SECURITY OFFICE

Joint Base Andrews, Maryland 11 WG/IP (AFDW) 1190 Menoher Drive, Suite 30 Joint Base Andrews, MD 20762

Joint Base Pearl Harbor-Hickam, Hawaii 15 WG/IP 800 Scott Circle JBPH- Hickam Field HI 96853 Phone 15wg.ip.workflow@us.af.mil

Marine Corps Air Station (MCAS) Kaneohe Bay, Hawaii

HQBN/STAC6

Building 208 2nd Street Kaneohe Bay, HI 96863

Ramstein AB, Germany 86 AW/IPP Unit 3300

APO AE 09094

DSN: 314-480-2970

Comm: 06371-47-2970 86aw.imformationprotectionoffice@us.af.mil

Naval Base Ventura County (NBVC)

PT Mugu, California

VX-30, Commanding Officer Attn: VX30 Security Officer 575 “I” Avenue Suite 1, Hangar 372

Point Mugu, CA 93042-5049

c. Reference Blk 10a/11h: COMSEC/Cryptographic safeguarding requirements apply. COMSEC information includes accountable or non-accountable COMSEC information and controlled cryptographic items (CCI).

Contractor is authorized to receive Government furnished cryptographic equipment. Release of COMSEC material and equipment to DoD contractors requires Air Force Cryptological Support Center approval. Contractor will forward requests for COMSEC information and material to the COMSEC officer through the program office. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires prior approval of the GCA.

Non-accountable COMSEC information, though not tracked in the COMSEC material control system, may still require a level of control within a document control system. Refer to NSA/CSS Manual 3-16, Control of Communications Security Material, and the Committee on National Security Systems Instruction (CNSSI) 4001, Controlled Cryptographic Items, for guidance.

Personnel accessing classified COMSEC material shall be U.S. citizens possessing a final U.S.

security clearance equal to or greater than the classification of the COMSEC material and will have received a Cryptographic Access Briefing. Access to un-keyed/unclassified Controlled Cryptographic Items (CCI) does not require a security clearance but is restricted to U.S. citizens who have received a COMSEC briefing. Contractor is authorized to subcontract classified COMSEC work.

Government Facilities: Classified COMSEC equipment and material at the MOBs must be shipped, received, and stored by the host unit COMSEC account. See AFMAN 17-1302, Communications Security (COMSEC) Operations for guidance.

Contractor Facilities: Cleared contractor facilities shall maintain COMSEC accounts for shipping, receiving, and storing COMSEC equipment and material up to and including SECRET, to include un-keyed/unclassified Controlled Cryptographic Items (CCI) equipment and material. The Contractor shall receive and provide on-site accountability and safeguarding of classified material and equipment at its cleared contractor facilities IAW NSA/CSS Policy Manual 3-16, Control of COMSEC Material. NSA maintains oversight for COMSEC at Contractor Facilities.

d. Reference Blk 10j/11l: CUI information provided and generated under this contract shall be safeguarded as specified in DoDI 5200.48_DAFI16-1403, Controlled Unclassified Information, DoDM 5200.01, Vol 1_AFMAN16-1404, Vol 1, Air Force Information Security Program, and DoDM 5400.07_AFMAN33-302 Air Force Manual, DoD Freedom of Information Act (FOIA) Program. The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

e. Reference Blk 10k: C-37 A/B Program Protection Plan and all of its appendices will be provided by the C-37 Program Office.

f. Reference Blk 11c: Any classified information generated in the performance of this contract shall require the contractor to apply derivative classification and markings consistent with the source material.

Contractor will also reference the current version of the C-37A/B Security Classification Guide when generating or deriving classified material or hardware. All classified information received or generated will be properly stored and handled according to the markings on the material. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of this contract, the U.S. Government will be contacted for proper disposition instructions.

g. Reference Blk 11d: The contractor is required to provide adequate and approved storage for classified hardware or material to the level of SECRET which because of size or quantity cannot be safeguarded in a General Service Administration (GSA) approved security container. The contractor must provide adequate storage for classified hardware and materials to the level of SECRET which exceeds 2 cubic feet but not more than 18 cubic feet of storage area.

h. Reference Blk 11f: Overseas contractor performance will occur at Ramstein Air Base, Germany.

DCSA is relieved of all security oversight for performance on the installation and overseas performance.

Security oversight at Ramstein Air Base, Germany will be under the cognizance of HQ USAFE/IP.

Contractor is also authorized to access classified material and equipment up to and including SECRET at deployed locations outside the U.S. in support of the work effort.

i. Reference Blk 11g: Contractor will maintain a current DD Form 2345, Military Critical Technical Data Agreement (MCTDA) certification and obtain need-to-know concurrence from the PCO when requesting to obtain access to unclassified technical data disclosing militarily critical technology with military or space application that is under the control of, or in the possession of, the DoD and required for contract performance.

Access to DTIC can be requested through the DD Form 1540, Registration for Scientific and Technical Information Services or online at: https://discover.dtic.mil/dtic-registration-benefits/dtic-registration/

j. Reference Blk 11j: OPSEC requirements apply. The contractor must comply with the U.S.

Government, DoD, Air Force, and AFMC Operations Security (OPSEC) plans. Contractor shall develop and implement an Operations Security (OPSEC) plan for the protection of Critical Program Information (CPI) identified in the C-37 Program Protection Plan and other CPI as identified by the PCO. See C- 37A/B Program Protection Plan, Annex F: AFLCMC PE Operations Security Plan.

k. Reference Blk 11k: Contractor is authorized to use the Defense Courier Service (DCS) for shipping and receiving classified COMSEC equipment and keying material.

Go to https://www.ustranscom.mil/cmd/associated/dcd/ for Defense Courier Service points of contacts and guidance.

l. Reference Blk 11m: The Following FARS and DFARS Clauses apply, FAR Clause 52.204-2, FAR Clause 52.204-21, DFARS Clause 252.204-7012, DFARS 252.204-7000, DFARS 252.204-7008 and DFARS 252.204-7009. Pre-contract award access to classified is not required.

1. Contractor shall apply "PL 3" level security protection to C-20 and C-37 aircraft while at the contractor's cleared facilities IAW DAFI 31-101, Integrated Defense.

2. Permanently assigned contractor personnel at the Main Operating Bases (MOBs) working directly on the aircraft shall have a SECRET clearance (interim or final). Contractor personnel performing recurring maintenance on the aircraft at the contractor facilities shall, at a minimum, have received a favorable background check. Individuals requiring infrequent access to the aircraft at the MOBs or contractor facilities shall be escorted in a ratio not exceeding four escorted persons to one authorized escort.

3. Contractor shall establish means to ensure only authorized contractor personnel are allowed unescorted access onto or near C-20 or C-37 aircraft. Escort exemptions are U.S. Military, U.S.

Government Civilian and Defense Contract Management Agency (DCMA) personnel with a SECRET security clearance who have an official requirement in conjunction with the maintenance of the aircraft.

4. The Government will provide the Contractor with a copy of the program Cybersecurity Strategy as an annex to the Program Protection Plan.

5. Partial work performance may occur at undisclosed installations. Upon determination, the contractor shall provide the on-base servicing Security Forces office all information required by the Notification of Government Security Activity Clause and any other additional information required by that office.

6. DoDM 5220.32, Volume 2, National Industrial Security Program: Procedures for Government Activities Relating to Foreign Ownership, Control, or Influence (FOCI) and 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM) shall apply to this contract.

7. Provide the information requested by the Notification of Government Security Activity and Visitor Group Security Agreements clause, Air Force Federal Acquisition Regulation Supplement (AFFARS 5352.024-9000, to the security activities listed in Block 8a.

8. Primary work performance will occur at military installations in the U.S. and worldwide. The installation commanders have formally elected to retain security cognizance as outlined in Table 2 below; therefore, DCSA is relieved of inspection responsibility for contractor performance at these military installations.

m. Reference Blk 12: Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the 32 CFR Part 117 section 117.19 (g) (7) unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office phone contact information and, if available, an e-mail address identified in Item 12.

Contractor is to submit requests through the Contracting Officer for OPSEC Program Manager review and public release authorization. The Contracting Officer will provide contractor with written approval/disapproval. Information requiring AF or DoD-level review will be reviewed by the unit’s OPSEC Program Manager or Coordinator who will in-turn forward to the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690.

Transmission of public release request via e-mail is not authorized. Requests must be sent via mail to:

AFLCMC/WVV

3001 Staff Dr. 1AC4-105A Tinker Air Force Base, OK 73145 Attn: C-37 PO PCO

Subcontractors must submit requests for public release through the prime contractor. The prime contractor is responsible for submitting the subcontractor’s request for public release to the GCA public release authority identified in item 12.

n. Reference Blk 13: Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware. All classified information received or generated will be properly stored and handled according to the markings on the material. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of the contract, the U.S. Government will be contacted for proper disposition instructions. Contractor will abide by and shall apply derivative classification and markings governed by the current version of the security classification guidance.

The Contractor will confirm the Original Classification Authority (OCA) has not extended the classification period by consulting with the C-37 Program Office prior to declassifying or downgrading information marked with a date or event on the "declassify on" line.

The Contractor will notify the Government Contracting Activity and the Government Security Manager (contact information listed below) within 48 hours of any incident involving the actual or suspected compromise/loss of classified information to enable the Government to conduct immediate assessment of potential impact pending formal inquiry/investigation. Actual or suspected compromise of Covered Defense Information will be reported IAW DFARS Clause 252.204-7012.

Government Security Manager:

Courtney Penn

AFLCMC/WVV

(405) 734-6460 aflcmc.wvv.securityworkflow@us.af.mil

Contractor is governed by the security guidance listed below:

32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM)

AFMAN 17-1302, Communications Security (COMSEC) Operations

C-37 A/B Program Protection Plan and it’s appendices:

o C-37A/B PPP ANNEX A: C-37A/B Security Classification Guide o C-37A/B PPP ANNEX B: AFLCMC PE Directorate Counterintelligence Support Plan o C-37A/B PPP ANNEX C: C-37 Critical Program Information (CPI) and Critical Components (CC) Determination o C-37A/B PPP ANNEX D: C-37 A/B Anti-Tamper Plan (Classified, will be provided via appropriate means upon request/contract award) o C-37A/B PPP ANNEX E: C-37 A/B Cybersecurity Strategy o C-37A/B PPP ANNEX F: AFLCMC PE Operations Security Plan

DoDI 5200.48_DAFI 16-1403, Controlled Unclassified Information (CUI)

DoDI 5230.09, Clearance of DoD Information for Public Release

DoDI 5230.24, Distribution Statements on Technical Documents

DAFI 31-101, Integrated Defense

NSA/CSS Policy Manual 3-16, Control of Communication Security (COMSEC) Material

DoDI 5200.48, March 2020, has replaced and cancelled DoDM 5200.0l, Volume 4 removing the designation of "For Official Use Only" FOUO. Contractors will no longer use the FOUO designation and change to using CUI. For this contract the Contractor will safeguard Controlled Unclassified Information (CUI) in accordance with DoDI 5200.48, Controlled Unclassified Information, 06 Mar 20, and AFGM 2020-16-01, Air Force Guidance Memorandum for Controlled Unclassified Information, 23 Jul 20.

There is no requirement for the Contractor to re-mark legacy FOUO documents as CUI. However, any new document created with information derived from legacy material must be marked as CUI if the information qualifies as CUI. DoD legacy information does not automatically become CUI. It must be reviewed by the owner of the information to determine if it meets the CUI requirements. If it is determined the specific legacy information meets the CUI requirements, it will be marked in accordance with this issuance and corresponding manual.

The "Controlled Unclassified Information (CUI)" marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that laws, regulations, or government-wide policies allow for, or require safeguarding. All CUI must be controlled until authorized for public release in accordance with departmental public release policies.

Other non-security markings, such as, "Limited Official Use" and "Official Use Only" are used by non- DoD User Agencies for the same type of information and should be safeguarded and handled in accordance with instructions received from such user agencies.

Use of the above markings does not mean that the information cannot be released to the public, only that it must be reviewed by the government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

1. Markings:

a. An unclassified document containing CUI information will be marked "CUI" at the top and bottom of the front cover (if any), on the first page, on each page containing CUI information, on the back page, on the outside of the back cover (if any). No portion markings will be shown.

b. Within a classified document, an individual page that contains both CUI and classified information will be marked at the top and bottom with the highest security classification of the information appearing on the page. If an individual portion contains CUI information but no classified information, the portion will be marked "CUI".

c. Removal of the "CUI", marking can only be accomplished by the originator or other competent authority in accordance with departmental public release policies. When the "CUI" status is terminated, all known holders will be notified to the extent practical.

2. Dissemination:

Contractors may disseminate "CUI" information to their employees and subcontractors who have a need for the information in conjunction with a classified contract.

3. Storage:

During working hours, "CUI" and legacy "FOUO" information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files, desks, is adequate when internal building security is provided during non-working hours.

When such internal security controls are not exercised, locked building, or rooms will provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desk or bookcases.

4. Transmission:

CUI information and material may be transmitted via first class mail, parcel post, or, bulk shipments. When practical, CUI information may be transmitted electronically (e.g., data, website, or e-mail), via approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure or transport layer security (e.g., https).

Avoid wireless telephone transmission of CUI when other options are available. CUI transmission via facsimile machine is permitted; however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive CUI;

facsimile machine located in a controlled government environment).

5. Disposition:

All CUI records must follow the approved mandatory disposition authorities whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and DoDI 5200.48.

6. Unauthorized Disclosure (UD):

During working hours, steps will be taken to minimize the risk of access by unauthorized personnel, such as not reading, discussing, or leaving CUI information unattended where unauthorized personnel are present. After working hours, CUI information will be stored in unlocked containers, desks, or cabinets if the government or government-contract building provides security for continuous monitoring of access. If building security is not provided, the information will be stored in locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas. The concept of a controlled environment means there is sufficient internal security measures in place to prevent or detect unauthorized access to CUI. For DoD, an open storage environment meets these requirements.

7. Controlled Unclassified Military Information (CUMI), Controlled Unclassified Information

(CUI):

The Contractor shall provide adequate security to safeguard Controlled Unclassified Military Information (CUMI), Controlled Unclassified Information (CUI) and Unclassified Controlled Technical information from compromise. The Contractor will notify the Government of any security violation, security incident, or of any indication of a potential unauthorized disclosure or compromise of classified or CUI.

a. The Contractor will be responsible for control and distribution of CUMI and CUI (For Official Use Only, Personnel Privacy and Company Proprietary, and Export controlled information.) The Contractor shall comply with DoDM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI), Enclosures 3 & 4, for identification, protection and training requirements of CUI. The contractor shall be responsible for training their personnel and accomplishment of the out-processing procedures identified in DoDM 5200.01, Volume 4, Enclosure 4. The contractor shall comply with DoDM 5400.07/Air Force Manual 33-302, DoD Freedom of Information Act (FOIA) Program, requirements.

Protection of unclassified DoD information not approved for public release on non-DoD Information Systems will be protected IAW DoDI 8582.0 I, 9 December 2019, Security of Unclassified DoD information on non-DoD Information Systems, Enclosure 3.

b. The Contractor shall safeguard CUI stored on non-DoD information Systems to prevent the loss, misuse, and unauthorized access to or modification of this information. The Contractor shall ensure that Contractor-owned and operated unclassified information technology (IT) network assets (including assets used for Contractor teleworkers) used to process sensitive Government CUI are managed and maintained IAW commercial best practices, vendor-specific, or other nationally or internationally-recognized IT configuration and management standards.

c. Personal Identifiable Information (PII): PII, which is a type of CUI, must be protected from public disclosure in accordance with Federal policy, as described in ASD (NII) Memorandum (Reference(bx)) and Director, Administration and Management Memorandum (Reference (by)).

Some PII also qualifies for protection under the provisions of section 552a of Reference (bm) (also known and hereinafter referred to as "The Privacy Act of 1974, as amended"). Certain PII required data-at-rest encryption and other protections.

NOTE: PII is unique information about an individual that can be used to distinguish or trace his or her identity. It includes, but is not limited to name, social security number, date and place of birth, mother's maiden name, home address and phone number, personal email address, biometric records, financial records, medical history, criminal or employment history, and other information to which a security manager may have access. PII does not include an individual's name when it is associated with work elements, such as duty phone number, duty address and U.S. Government mail address.

o. Reference Blk 18e:

Denene M. Ballenger Administrative Contracting Officer DCMA AIMO Greenville - DCMAA-AGA 244 Terminal Road, Bldg. 1040 Greenville, SC 29605-5298 864-299-7175

Denene.M.Ballenger.civ@mail.mil