Att_7_DD_Form_254.PDF

1. CLEARANCE AND SAFEGUARDING

DEPARTMENT OF DEFENSE a. FACILITY CLEARANCE REQUI RED

CONTRACT SECURITY CLASSIFICATION SPECIFICATION TOP SECRET

(The requirements of the DoD Industrial Security Manual apply

b. LEVEL OF SAFEGUARD REQUIRED to all security aspects of this effort.)

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER X a. ORIGINAL (Complete date in all cases)

DATE (YYYYMMDD)

20170 11 1 b . SU BCONTRACT NUMBER

b. REVISED I REVISION NO. DATE (YYYYMMDD)

(Supercedes all previous specs)

X c. SOLICITATION OR OTHER NUM BER DUE DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases)

DATE (YYYYMMDD)

DP I 7PSOO l 39 20 1703 15

4. IS THIS A FOLLOW-ON CONTRACT?

LJYES L:.J NO If Yes, complete the foll owing:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254?

LJYES L:.J NO If Yes, complete the following:

In response to the contracto(s request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZI P CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

Defense Security Service -

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

Defense Advanced Research Projects Agency (DARPA) NIA NIA 675 North Randolph Street Arl ington, VA 22203-2114

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Strategic Technology Office (STO) - Systems Engineering and Technical Assistance (SETA) Support

10. CONTRACTOR WILL REQUIRE ACCESS TO: YES NO 11 . IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION X a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR'S X

FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA X b . RECEIVE CLASSIFIED DOCUMENTS ONLY X

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION X c. RECEIVE AND GENERATE CLASSIFIED MATERIAL X

d. FORMERLY RESTRICTED DATA X d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE X

e. INTELLIGENCE INFORMATION e. PERFORM SERVICES ONLY X

(1) Sensitive Compartmented Information (SCI) X f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S ., PUERTO RICO, U .S. POSSESSIONS X AND TRUST TERRITORl•S

(2) Non·SCI X g. BE AUTHORIZED TO USE THE SERV1CES OF DEFENSE TECHNICAL INFORMATION CENTER (DTIC) OR OTHER X SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION X h. REQUIRE A COMSEC ACCOUNT X

g. NATO INFORMATION X i. HAVE TEMPEST REQUIREMENTS X

h. FOREIGN GOVERNMENT INFORMATION X j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS X

i. LIMITED DISSEMINATION INFORMATION X k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE X j . FOR OFFICIAL USE ONLY INFORMATION X i. OTHER (Specify)

k. OTHER (Specify)

Alternative Compensatory Control Measures X X

DD Form 254, DEC 1999 Designed using Adobe, DARPA/SSO

D17PS00139

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaiing to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release O Direct (g] Through (Specify)

No information, except as provided in appl icable U .S. Statutes, which is classified or unclassified pertaining to this contract shall be released for public dissemination without prior written approval of the DARPA.

to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)" for review.

•1n the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the informaiton involved shall be handeled and protected at the highest level of classification assigned or recommended . (Fill in as appropriate for the classified effort. Attach, or forwa rd under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

IOa: Classified COMSEC information/material wi ll be protected IA W DoD 5220.22-M. Access to classified COMSEC information requires a final U.S. Government clearance at the appropriate leve l. In accordance with 0005220.22-M (9-407), further disc losure ofCOMSEC information by a contractor, to include subcontract ing, requires prior written approval of the DARPA, Contracting Officer for Security Matters. (ref. DoD 5220.22-M (Ch 9, Sec 4))

I Ob: The contractor is permitted access to Restricted Data (RD) in the performance of this contract. RD is nuclear-related information which is controlled by the Department of Energy and is classified and controlled under the Atomic Energy Act of 1954. The OARP A, Chief, Personnel Security or designated representative will brief the FSO, who must brief other contractor personnel requiring access under this contract. In accordance with Do DI 52 10.02, written concurrence of the DARPA, Contracting Officer for Security Matters is required prior to subcontracting (ref. DoOM5220.22-M (Ch 9, Sec I))

I Oc: CNWDI Information is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level.

Access to and handling of C WO! shall be in accordance with Do DD 5210.02. Contractor must contact DARPA, Chief, Personnel Security, to be briefed into CNWDI. In accordance with 0005220.22-M (9-204), written concurrence of the DARPA, Contracting Officer for Security Matters is required prior to subcontracting. (ref. DoDM5220.22-M (Ch 9, Sec 2))

IOd: The contractor is permitted access to Formerly Restricted Data (FRD) in the performance of this contract. The DARPA, Chief, Personnel Security or designated representative will brief the FSO, who must brief other contractor personnel requiring access under this contract. In accordance with Do DI 5210.02, written concurrence of the DARPA, Contracting Officer for Security Matters is required prior to subcontracting (ref. DoDM5220.22-M (Ch 9, Sec I))

** Continued next page**

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. [8J Yes LJ No (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirement to the cognizant security office. Use Item 13 if additional space is needed.)

Program information shall be protected in accordance with various DARPA and other agency security class ification guidance, to be provided by cognizant DARPA PSO(s).

When information is controlled by the United States Munitions List (USML), the contractor must abide by the International Traffic Arms Regulation (IT AR) requirements

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. ~ Yes LJ No (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

SAP: DARPA is responsible for inspection of all SAP materials under this contract.

SCI: DIA is responsible for inspection of all SCI materials under this contract.

16. CERTIFICATION AND SIGNATURE. Security requ irements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

Timothy R. Wood

d. ADDRESS (Include Zip Code)

Defense Advanced Research Projects Agency (DARPA) 675 NortJ:l Randolph Street

b. TITLE

Chief, Industrial and Information Security

c. TELEPHONE (Include Area Code)

703-526-1057

17. REQUIRED DISTRIBUTION

1--

~ a. CONTRACTOR

b. SUBCONTRACTOR ArlingtorJ VA 22203 hc---:::-:=f.tr..'rf.,C,,,!/9c.;..,_....e::-----:..__-__________________ --+X~ c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

~- Sli~~.it,.., d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADM INISTRATION I .J. ,r, ~ [_x e. ADMINISTRATI VE CONTRACTING OFFICER

I.ff , ) /, 1/ X f. OTHERS AS NECESSARY

D~ F~ n ~~Back), DEC 1999 Designed using Adobe, DARPA/SSO

CONTINUATION SHEET FOR DD 254, CONTRACT SECURITY CLASSIFICATION SPECIFICATION

BLOCK 13 Cont'd:

I

CONTRACT NUMBER

DPl7PSOOl39

IOe(l): SCI Access required. The Director, DIA and Director, DARPA, have exclusive security responsibility for SCI re leased to the contractor or developed under this contract. Before releasing or providing SCI to contractor personnel, the GCA shall ensure that they are appropriately cleared in accordance with ICD 704, and they agree to follow controls and procedures for the protection, handling, and accountability of SCI. All activities involving SCI (including discussions) shall be conducted in sensitive compartmented information facilities (SC!Fs). Physical security standards for SC!Fs are contained in ICD 705 must be adhered to. In accordance with DoD5220.22-M (9-304), written concurrence of the DARPA, Contracting Officer for Security Matters is required prior to subcontracting. (ref. DoDM5220.22-M (Ch 9, Sec 3))

I Oe(2): Access to Intelligence information is required for performance. The Director, DARPA, has exclusive security responsibility for Non-SCI released to the contractor or developed under this contract. In accordance with DoD5220.22-M (9-304), written concurrence of the DARPA, Contracting Officer for Security Matters is required prior to subcontracting. (ref. DoDM5220.22-M (Ch 9, Sec 3))

I Of: SAP activities will be accredited, governed, maintained, marked and protected in accordance with DoDM 5205 .07-Volumes (I), (3) and (4);

and applicable references. and program security classification guides. Access to SAP information requires employees undergo additional personnel security screening and meet the SAP access standards de lineated in the applicable DoD directives and policies. SAP inspections and security oversight while in component facilities are under the cognizance of the DARPA SAPCO, as appropriate. The performer is required to submit an accreditation package (Fixed Facility Checklists (FFC) and other applicable documents) and/or System Security Plans (SSP) to the responsib le DARPA PSO via "DFASTS." Otherwise, contact your PSO for submission instructions.

Effective May I, 2015 Program Access Request (PAR) packages wi ll be coordinated using the recently approved PAR and PSQ templates. The approved templates can be found at http://www.dss.mil/isp/templates. html.

All Special Access Program (SAP) accredited areas must meet the minimum physical and technical security standards outlined in the DoD 5205.07 SAP Manual Volume 3 and its references in Enclosure I, before receiving, generating, processing, using, or storing SAP classified information, as appropriate to the accreditation. New SAP accredited areas wi ll be inspected by DARPA physical security prior to accreditation. In accordance with DoDM 5205.07-Vl (11- 1), DARPA PSO review is required prior to re lease to subcontractors.

(ref. DoDM 5205.07-Vo lumes ( I), (3) and (4))

I Og: Personnel not assigned to a NA TO staff position, but requiring access to A TO classified information, NA TO COSMJC, NA TO Secret or access to the ATO accredited SIPRNET terminals, must possess the equivalent FINAL or Interim U.S. Security Clearance based upon the appropriate personnel security investigation required. Personnel with access to A TO A TO MAL information must have the appropriate level FINAL U.S. Security Clearance. The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees are NATO briefed prior to access being granted. The contractor will maintain strict compliance in regards to NATO information IA W NJSPOM Ch I 0, Section 7. Contractor must contact DARPA, Chief, Personnel Security to be briefed into NA TO. [n accordance with DoD5220.22-M ( I 0-7 11 ), written concurrence of the DARPA, Contracting Officer for Security Matters is required prior to subcontracting. (ref. DoDM5220.22-M (Ch I 0, Sec 7))

I Oh: Foreign Government Information (FGI) is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. In accordance with DoD5220.22-M (I 0-3 12), written concurrence of the DARPA, Contracting Officer for Security Matters is required prior to subcontracting.

(ref. DoDM5220.22-M (Ch I 0, Sec 3))

IOj : For Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoD Manual 5200.01 Volume 4, DoD Information Security Program.

I Ok: Alternative Compensatory Control Measures (ACCM) referenced on DARPA-associated contract DD Forms 254 are established, controlled, managed, and administered by non-DA RP A Department of Defense (DoD) entities. Access may be provided by DARPA, but all guidance relating to these ACCM procedures and reporting are the responsibility of the establ ishing DoD entity

11 a: Contractor performance is restricted to DARPA, 675 North Randolph Street, Arlington, VA 22203-2 11 4. DARPA will provide security classification guidance for performance of this contract.

11 g: The contractor must prepare and forward DD Forms 1540 and 2345 to the COR for authorization before the services may be requested.

Technical information on file at DTIC will be made avai lable to the contractor if the contractor requires such information. The contracting officer will certify the field of interest relating to the contract.

** Continued next page**

Designed using Adobe, DARPA/SSO

CONTINUATION SHEET FOR DD 254, CONTRACT SECURITY CLASSIFICATION SPECIFICATION

** Block 13 Continued**

I

CONTRACT NUMBER

DP17PS00139

1 lj : The contractor must abide by guidance outlined in the DARPA Security Guide, as well as the DARPA Baseline Agency OPSEC Plan, which will be provided by the PSO or PSR.

All Contractors performing on this contract shall abide by all current and applicable successor governmental guidance. Please contact your FSO, PSO or PSR if any questions arise pertaining to the avai labi lity of these guidance documents.

All Contractors performing on this contract shall abide by the Open Skies Treaty or other U.S. on-site treaty compliance obligations. In doing so, the Contractor may be required to create and execute treaty compliance plans. These plans must be approved by the cognizant Program Security

Officer.

Reports of loss, compromise or suspected compromise shall be provided to the appropriate DARPA Program Securi ty Officer (PSO) within 24 hours of the incident, in addition to the reporting requirements to DSS out lined in the N lSPOM.

All of the above security requirements, where appl icable, will flow down to any subcontractors and consultants supporting this contract.

Subcontract DD254s must be approved by DARPA Director, Information & Industrial Security prior to issue.

STO PM - Dr. Thomas Bums; PSO - Mark Doody, 703.526.2687; PSR - Jackie Croat, 703.526.2683

Designed using Adobe, DARPNSSO