D.1 RFP PWS Attachment 3 DD254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

CONTINUATION SHEET FOR CONTRACT

10a. Contractor is authorized access to cryptographic equipment and information. Contractor will refer to Electronic Key Management Systems (EKMS1) for the handling and requirements of COMSEC material. Access to COMSEC requires a final U.S. Government clearance and special briefings at the appreciate level. Subcontracting COMSEC information by a contractor requires prior approval from the MCCOG Contracting Officer.

10e. (2) Contractor requires access to the SIPRNET, as certified by the COR. Intelligence Data residing on the SIPRNET shall only be accessed when required in support of the Performance Work Statement (PWS). Individuals lacking a valid requirement shall not intentionally access or download Intelligence Data. Written approval of the User Agency Contracting Officer is required prior to access to SIPRNET intelligence information. When contractors that have a SIPRNET account are terminated from the contract they must physically check out with Security office to be debriefed and account disabled.

10g. North Atlantic Treaty Organization (NATO) information will be handled and controlled as indicated in the NISPOM. Access requires a final U.S. Government clearance and special briefings at the appropriate level. Access to NATO classified information based on a interim security clearance shall be subject to the following conditions per Central Registry Newsletter No 17 dtd 12/05/2001: -approval by the authority who is granting the access to U.S. classified information based on the interim security clearance – written authorization, maintain as a record –interim clearance held is at the Secret level –process for a final security clearance has been initiated; and –individual has received and acknowledged briefing on NATO security requirements. Prior approval from MCCOG Contracting Officer is required for subcontracting.

10j The contractor shall comply with the requirements of the SECNAV M-5510.36 and DOD 52001-R Appendix C for the procedures for handling, marking, storing, transmitting, releasing and destruction of "For Official Use Only" (FOUO) information.

This contract is for operational and sustainment service. Actual knowledge of, generation, or production of classified information is not required for performance of the contract. Cleared personnel are required to perform this service because access to classified information cannot be precluded by escorting personnel. Any classification guidance needed will be provided by the using contractor.

This contract requires access to Non-SCI information that may be accessed on the SIPRNET. DSS has security inspection responsibility. Reproduction and destruction of this material is prohibited without written approval from Commanding Officer, Marine Corps Cyberspace Operations Group (MCCOG), Quantico VA via higher authority.

The Contracting Officer and the Project Officer for this contract is Ms. Mariel Noguez (571) 697-4124

Security Classification guides required during this contract is/are and will be provided under separate cover by the project officer. In addition to the reporting requirements directed by the NISPOM, the contractor will provide a concurrent report of loss or compromise of classified information to the Commanding Officer, Marine Corps Cyberspace Operations Group (MCCOG), ( Attn: Security Manager) 27410 Hot Patch Road Quantico VA 22134.

Per DoD Memorandum Dtd April 1, 2005 Subject: Facilitating Classified Visits within the Department of Defense and the National Industrial Security Program Operating Manual (NISPOM), as amended by Industrial Security Letter (ISL) 02-X, mandates industry use of JPAS. JPAS Industry Sub Committee Doc 004 Rev 000: all contractors under DoD security cognizance will use JPAS for all personnel security actions. If you have not requested a JPAS account, you must do so within 90 days after contract has been awarded. All requests shall contain the information required by the NISPOM and shall not exceed a 12 month period.

All Government Badges issued under this contract will be returned immediately to the Marine Corps Cyberspace Operations Group (MCCOG) CENTRAL SECURITY STATION upon termination of contract, or individual terminations. When an individual contractor is terminated, for any reason, it is the responsibility of the Facility Security Officer to immediately notify the Command Security Manager, MCCOG 27410 Hot Patch Road, Quantico VA 22134. Failure to comply could result in the suspension of all contractor proximity key and NT accounts.

If additional contracting requirements exist where retention of classified information by the contractor facility is required, a written request to retain material for a period but not to exceed 2 years is required.

All work performed within MCCOG sites, will follow the Information Security regulations SECNAVINST 5510.36, SECNAVINST 5510-30A and local command security instructions.

ADP PROCESSING: The contractor shall comply with the requirements of the Information Systems Security Programs as described in OPNAVINST 5239._ series, DoD 5220.22-M (Chapter 8), and local command information systems security instructions. All systems, regardless of the level of data processed, will be accredited in accordance with the above instructions. Use of cellular phones, hand-held radios, beepers and/or pagers, cordless telephones, and cordless microphones will be restricted from areas where US Government Protected Information is processed or discussed.

ADDENDUM TO DD FORM 254 (BLOCK 11j)

OPERATIONS SECURITY

1. This section outlines the requirements and procedures necessary for contractors to provide Operations Security (OPSEC) protection for MCCOG's Critical Information (CI).

2. OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

· Identify those actions that can be observed by adversary intelligence systems.

· Determine which of those action are indicators to hostile intelligence systems which they can obtain and interpret or piece together to derive critical information in time to be useful for adversaries planning.

· Develop, select and execute countermeasures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

3. OPSEC principles are used to help assigned personnel:

· Maintain a continuing awareness of adversary interest in cyberspace actions and adversary intelligence collection capabilities.

· Understand the need to identify and protect unclassified indicators that reveal sensitive information.

· Evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

4. Our objectives are:

· Protect operational activities by preventing the inadvertent disclosure of unclassified information relating to or revealing MCCOG operations.

· To preserve secrecy concerning specific cyberspace events and MCCOG’s response to these events.

· To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of current and future operations.

5. MCCOG employed contractors will be in-briefed by the assigned OPSEC program coordinator on the unit’s OPSEC requirements within 30 days of assignment. Individual training will at a minimum include annual OPSEC training. Additional training may apply as required by the level of contact with MCCOG critical information.

6. Unit specific OPSEC requirements, Critical Information Lists (CILs) and assistance can be obtained by contacting the unit OPSEC coordinator. MCCOGIO@USMC.MIL

7. USMC OPSEC requirements can be found in MCO 3070.2A available at: https://www.marines.mil/Portals/1/Publications/MCO%203070.2A.pdf

ATTACHMENT B

PROCEDURES FOR OFFICIAL USE ONLY

The following procedures will be used to protect FOR OFFICIAL USE ONLY (FOUO) information:

1. HANDLING: Access to FOUO material shall be limited to those employees who need the material to do their jobs. The FOR OFFICIAL USE ONLY marking is assigned to information when created by a DOD User Agency. FOR OFFICIAL USE ONLY is not a classification, but requires extra precautions to ensure it is not released to the public.

2. MARKING:

a. Mark an unclassified document containing FOUO information “FOR OFFICIAL USE ONLY” at the bottom of each page containing FOUO information and on the bottom of the front cover (if any) and on the back of the last page and on the back cover (if any).

b. In a classified document, mark:

- An individual paragraph that contains FOUO, but not classified information, by placing “(FOUO)” at the beginning of the paragraph.

- The top and bottom of each page that has both “FOR OFFICIAL USE ONLY” and classified information, with the highest security classification of information on that page.

- “FOR OFFICIAL USE ONLY” at the bottom of each page that has FOUO but not classified.

- If a classified document also contains FOUO information or if the classified material becomes FOUO when declassified, place the following statement on the bottom of the cover or the first page, under the classification marking: “NOTE: If declassified, review the document to make sure material is not FOUO and not exempt under Freedom of Information Act before public release.”

c. Mark other records, such as computer print outs, photographs, films, tapes, or slides “FOR OFFICIAL USE ONLY” so that the receiver or viewer knows the record contains FOUO information.

d. Mark each part of a message that contains FOUO information. Unclassified messages containing FOUO information must show the abbreviation “FOUO” before the text begins.

e. Make sure that documents, which transmit FOUO materials, call attention to any FOUO attachments.

f. Any FOUO material released to a contractor by a DOD User Agency must have the following statement on the front page or cover: THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FREEDOM OF INFORMATION ACT. EXEMPTION(S) 5 APPLY.

3. STORAGE: To safeguard FOR OFFICIAL USE ONLY records during normal duty hours, place them in an out-of-sight location if your work area is accessible to persons who do not have a valid need for the information. After normal duty hours, store FOUO records to prevent unauthorized access. File them with other unclassified records in unlocked files or desks when internal building security is provided. When there is no internal security, locked buildings or rooms usually provide adequate after-hours protection. For additional protection, store FOUO material in locked containers such as file cabinets, desks, or bookcases. Expenditure of funds for security containers or closed areas solely for the protection of FOUO data is prohibited.

4. TRANSMISSION: FOUO material shall be transported via first class mail, parcel post, or fourth class mail for bulk shipments. Transmit FOUO message traffic via approved secure communication system. Discussion of FOUO material over a secure telephone is authorized if necessary for performance of the contract. FOUO information shall be transmitted over telephone lines with encryption.

5. RELEASE: FOUO information shall not be released outside the contractor’s facility except to representatives of the DOD but via the Government Contracting Officer.

6. DESTRUCTION: When no longer needed, FOUO information may be disposed of by any method, which will preclude its disclosure to unauthorized individuals.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification Hide Attachment Bar

27410 Hot Patch Road, Quantico, VA 22134-5010

Marine Corps Cyberspace Operations Group 27410 Hot Patch Road Quantico, VA 22134

Additional locations: Okinawa - Bldg 480 MCB Camp Butler/Camp Foster, Okinawa, JP FPO AP 96377 I Marine Corps Expeditionary Forces (MEF) G6 “C” Street Bldg. 210722 Camp Pendleton, CA 92055 II MEF, Bldg. H-1, Julian C. Smith, Camp Lejeune, NC 28542 Commandant of the Marine Corps, HQ USMC, 3000 Marine Corps, Pentagon, Washington DC 20350-3000 Pentagon

Ref. Blk 10a. (2) Contractor is authorized access to cryptographic equipment and information. Contractor will refer to Electronic Key Management Systems (EKMS1) for the handling and requirements of COMSEC material. Access to COMSEC requires a final U.S. Government clearance and special briefings at the appreciate level. Subcontracting COMSEC information by a contractor requires prior approval from the MCCOG Contracting Officer.

Ref. Blk 10e. Contractor requires access to the SIPRNET, as certified by the COR. Intelligence Data residing on the SIPRNET shall only be accessed when required in support of the Performance Work Statement (PWS). Individuals lacking a valid requirement shall not intentionally access or download Intelligence Data. Written approval of the User Agency Contracting Officer is required prior to access to SIPRNET intelligence information. When contractors that have a SIPRNET account are terminated from the contract they must physically check out with Security office to be debriefed and account disabled.

Ref. Blk 10g. North Atlantic Treaty Organization (NATO) information will be handled and controlled as indicated in the NISPOM. Access requires a final U.S. Government clearance and special briefings at the appropriate level. Access to NATO classified information based on a interim security clearance shall be subject to the following conditions per Central Registry Newsletter No 17 dtd 12/05/2001: -approval by the authority who is granting the access to U.S. classified information based on the interim security clearance – written authorization, maintain as a record –interim clearance held is at the Secret level –process for a final security clearance has been initiated; and –individual has received and acknowledged briefing on NATO security requirements. Prior approval from Contracting Officer is required for subcontracting.

Ref. Blk 10j. The contractor shall comply with the requirements of the SECNAV M-5510.36 and DOD 52001-R Appendix C for the procedures for handling, marking, storing, transmitting, releasing and destruction of "For Official Use Only" (FOUO) information.

This contract is for operational and sustainment service. Actual knowledge of, generation, or production of classified information is not required for performance of the contract. Cleared personnel are required to perform this service because access to classified information cannot be precluded by escorting personnel. Any classification guidance needed will be provided by the using contractor.

This contract requires access to Non-SCI information that may be accessed on the SIPRNET. DSS has security inspection responsibility. Reproduction and destruction of this material is prohibited without written approval from Commanding Officer, Marine Corps Cyberspace Operations Group (MCCOG), Quantico VA via higher authority.

The Contracting Officer's Representative is Ms. Mariel Noguez (571) 697-4124.

Security Classification guides required during this contract is/are and will be provided under separate cover by the project officer. In addition to the reporting requirements directed by the NISPOM, the contractor will provide a concurrent report of loss or compromise of classified information to the Commanding Officer, Marine Corps Cyberspace Operations Group (MCCOG), ( Attn: Security Manager) 27410 Hot Patch Road Quantico VA 22134.

Per DoD Memorandum Dtd April 1, 2005 Subject: Facilitating Classified Visits within the Department of Defense and the National Industrial Security Program Operating Manual (NISPOM), as amended by Industrial Security Letter (ISL) 02-X, mandates industry use of JPAS. JPAS Industry Sub Committee Doc 004 Rev 000: all contractors under DoD security cognizance will use JPAS for all personnel security actions. If you have not requested a JPAS account, you must do so within 90 days after contract has been awarded. All requests shall contain the information required by the NISPOM and shall not exceed a 12 month period.

All Government Badges issued under this contract will be returned immediately to the Marine Corps Cyberspace Operations Group (MCCOG) CENTRAL SECURITY STATION upon termination of contract, or individual terminations. When an individual contractor is terminated, for any reason, it is the responsibility of the Facility Security Officer to immediately notify the Command Security Manager, MCCOG 27410 Hot Patch Road, Quantico VA 22134. Failure to comply could result in the suspension of all contractor proximity key and NT accounts.

If additional contracting requirements exist where retention of classified information by the contractor facility is required, a written request to retain material for a period but not to exceed 2 years is required.

All work performed within MCCOG sites, will follow the Information Security regulations SECNAVINST 5510.36, SECNAVINST 5510-30A and local command security instructions.

ADP PROCESSING: The contractor shall comply with the requirements of the Information Systems Security Programs as described in OPNAVINST 5239._series, DoD 5220.22-M (Chapter 8), and local command information systems security instructions. All systems, regardless of the level of data processed, will be accredited in accordance with the above instructions. Use of cellular phones, hand-held radios, beepers and/or pagers, cordless telephones, and cordless microphones will be restricted from areas where US Government Protected Information is processed or discussed.

Ref. Blk 11j. 1. This section outlines the requirements and procedures necessary for contractors to provide Operations Security (OPSEC) protection for MCCOG's Critical Information (CI).

2. OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

• Identify those actions that can be observed by adversary intelligence systems.

• Determine which of those action are indicators to hostile intelligence systems which they can obtain and interpret or piece together to derive critical information in time to be useful for adversaries planning.

• Develop, select and execute countermeasures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

3. OPSEC principles are used to help assigned personnel:

• Maintain a continuing awareness of adversary interest in cyberspace actions and adversary intelligence collection capabilities.

• Understand the need to identify and protect unclassified indicators that reveal sensitive information.

• Evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

4. Our objectives are:

• Protect operational activities by preventing the inadvertent disclosure of unclassified information relating to or revealing MCCOG operations.

• To preserve secrecy concerning specific cyberspace events and MCCOG’s response to these events.

• To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of current and future operations.

5. MCCOG employed contractors will be in-briefed by the assigned OPSEC program coordinator on the unit’s OPSEC requirements within 30 days of assignment. Individual training will at a minimum include annual OPSEC training. Additional training may apply as required by the level of contact with MCCOG critical information.

6. Unit specific OPSEC requirements, Critical Information Lists (CILs) and assistance can be obtained by contacting the unit OPSEC coordinator. MCCOGIO@USMC.MIL

7. USMC OPSEC requirements can be found in MCO 3070.2A available at: https://www.marines.mil/Portals/1/Publications/MCO%203070.2A.pdf

Security Manager

Quantico, VA 22134