DARPA-PS-26-123-Attachment-C-Classified-Submission-Instructions.docx

DARPA-PS-26-123

Distribution with Agreements Officer’s authorization only Attachment C – Classified Submission Instructions, Requirements, and Procedures

Classified submissions should NOT be submitted through DARPA’s Broad Agency Announcement (BAA) website or unclassified mail.

Proposers choosing to submit classified information from other classified sources (i.e., sources other than DARPA) must ensure (1) they have permission from an authorized individual at the cognizant Government agency (e.g., Contracting Officer, Program Manager); (2) the proposal is marked in accordance with the source Security Classification Guide (SCG) from which the material is derived; and (3) the source SCG is submitted along with the proposal.

CUI

For unclassified submissions containing CUI, proposers will ensure personnel and information systems processing CUI security requirements are in place.

Unclassified submission containing CUI may be submitted via DARPA’s BAA Website (https://baa.darpa.mil) in accordance with Section 3 of the TTO OW Solicitation.

Proposers making submissions involving the pursuit and protection of DARPA information designated as CUI must have, or be able to acquire prior to contract award, an information system authorized to process CUI information in accordance with NIST SP 800-171 and DoDI 8582.01.

Classified Submissions For classified submissions, applicants will ensure all industrial, personnel, and information systems processing security requirements are in place and at the appropriate level (e.g., Facility Clearance Level (FCL), Automated Information Security (AIS), Certification and Accreditation (C&A),a nd any Foreign Ownership Control and Influence (FOCI) issues are mitigation prior to submission. Additional information on these subjects can be found at https://www.dcsa.mil/.

Use transmission, classification, handling, and marking guidance provided by previously issued SCGs, the DoD Information Security Manual (DoDM 5200.01, Volumes 1 - 4), and the National Industrial Security Program Operating Manual, including the Supplement Revision 1 (DoD 5220.22-M and DoD 5200.22-M Sup. 1), when submitting Confidential, Secret, and/or Top Secret classified information.

Confidential and Secret Confidential and Secret classified information may be submitted via ONE of the two following methods to the mailing address listed in the TTO OW Solicitation overview section under contact information:

· Hand-carried by an appropriately cleared and authorized courier to the DARPA Classified Document Registry (CDR). At least five (5) business days prior to traveling, the courier shall contact the DARPA CDR at 703-526-4052 to coordinate arrival and delivery.

OR

· Mailed via U.S. Postal Service (USPS) Registered Mail or USPS Express Mail. All classified information will be enclosed in opaque inner and outer covers and double-wrapped. The inner envelope shall be sealed and plainly marked with the assigned classification and addresses of both sender and addressee. Senders should mail to the mailing address listed in the contact information herein.

The inner envelope shall be addressed to:

Defense Advanced Research Projects Agency ATTN: Tactical Technology Office Reference: DARPA-PS-26-123 675 North Randolph Street Arlington, VA 22203-2114

The outer envelope shall be sealed with no identification as to the classification of its contents and addressed to:

Defense Advanced Research Projects Agency Security & Intelligence Directorate, Attn: CDR 675 North Randolph Street Arlington, VA 22203-2114

Top Secret Top Secret information must be hand-carried by an appropriately cleared and authorized courier to the DARPA CDR. At least five (5) business days prior to traveling, the courier shall contact the DARPA CDR at 703-526-4052 to coordinate arrival and delivery.

Sensitive Compartmented Information (SCI) SCI must be marked, managed and transmitted in accordance with DoDM 5105.21 Volumes 1 - 3. Unclassified questions regarding the transmission of SCI may be sent to the DARPA Technical Office Program Security Officer (PSO) via the TTO OW Solicitation mailbox or by contacting the DARPA Special Security Officer (SSO) at 703-812-1970.

Successful proposers may be sponsored by DARPA for access to SCI. Sponsorship must be aligned to an existing DD From 254 where SCI has been authorized. Questions regarding SCI sponsorship should be directed to the DARPA Personnel Security Office at 703-526-4543.

Special Access Program (SAP) Information SAP information must be marked in accordance with DoDM 5205.07 Volume 4 and transmitted by specifically approved methods which will be provided by the TTO PSO or their staff.

Proposers choosing to submit SAP information from an agency other than DARPA are required to provide the DARPA Technical Office PSO written permission from the source material’s cognizant Special Access Program Control Officer (SAPCO) or designated representative. For clarification regarding this process, contact the DARPA Technical Office PSO via the TTO OW Solicitation or the DARPA SAPCO at 703-526-4102.

Additional SAP security requirements regarding facility accreditations, information security, personnel security, physical security, operations security, test security, classified transportation plans, and program protection planning may be specified in the DD Form 254.

NOTE: All proposals containing SAP information must be processed on a SAP information technology (SAP IT) system that has received an Approval-to-Operate (ATO) from the DARPA Technology Office PSO or other applicable DARPA SAP IT Authorizing Official. The SAP IT system ATO will be based upon the Risk Management Framework (RMF) process outlined in the Joint Special Access Program Implementation Guide (JSIG), current version (or successor document). (Note: A SAP IT system is any SAP IT system that requires an ATO. It can range from a single laptop/tablet up to a local and wide area networks.)

The Department mandates the use of a component’s SAP enterprise system unless a compelling reason exists to use a non-enterprise system. The DARPA Chief Information Officer (CIO) must approve any performer proposal to acquire, build, and operate a non-enterprise SAP IT system during the awarded period of performance. Use of the DARPA SAP enterprise system, SAVANNAH, does not require CIO approval.

SAP IT disposition procedures must be approved in accordance with the DoD CIO Memorandum of April 20, 2020.

Submission Instructions for both Classified and Unclassified Submissions For submission that include both classified and unclassified information, the submission may be separated into an unclassified portion and a classified portion. When a submission includes a classified portion, and when able according to security guidelines, we ask that proposers send an unclassified e-mail to DARPA-PS-26-123@darpa.mil as notification that there is a classified portion to the submission.

The proposal should include as much information as possible in the unclassified portion and use the classified portion ONLY for classified information. The unclassified portion can be submitted through the DARPA BAA Website, per the instructions above. The classified portion must be provided separately, according to the Classified Submissions Instructions identified herein.

Distribution with Agreements Officer’s authorization only