DD-254_01072026.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

a. All contract personnel performing under this contract/task order shall have DOD Secret clearance at the time of award and shall maintain a favorably adjudicated Tier 3 (T3/T3R) investigation current within 5 years IAW SECNAVINST 5510.30. All Contractors shall be United States citizens.

b. The contractor shall provide the Navy’s Security Manager and the COR, the name, title, address and phone number for the Contractor’s Security Representative (CSR)/Facility Security Officer (FSO). The CSR/FSO shall be the primary point of contact on any security matter. The contractor shall provide a listing of contract personnel performing under this contract/task order within 15 days of contract award. The Navy’s Security Manager is responsible for entering contract personnel’s information into the Defense Information System for Security (DISS), having “Owning” role in DISS for contract personnel. CSR/FSO shall submit a visit authorization letters (VAL) on company letterhead in one (1) year increments. VALs shall be re- submitted annually prior to expiration of previous letter and cannot exceed the contract period of performance. The VAL shall consist of contract personnel’s full name and social security numbers; and shall be delivered via encrypted email, regular mail or hand delivered. The Navy command site Security Managers will take a “Servicing” role in DISS for contract personnel for the duration of contract. Contract personnel shall in-process with the Navy Security Manager upon arrival to Navy command and shall out-process prior to the conclusion of the contract/task order or employment termination. The VAL shall be renewed annually for contract personnel performing under this contract/task order. Failure to submit VAL is likely to result in a delay in contract personnel start date.

c. For new contractor investigations, once Contractor FSO has submitted individual’s SF-86 in DISS and the individual’s preliminary background investigation has been favorably completed, the Department of Defense Consolidated Adjunction Services (DOD CAS) can authorize an interim eligibility through the Contractor CSR/FSO. The contractor shall ensure that the individual employee has a current requisite background investigation for the duration of the contract/task order. The investigation shall be submitted and results received prior to commencement of work.

(1) Derogatory information (i.e. Medical Evaluations, Letters of Intent, Statement of Reasons) or “No Determination Made” decisions resulting from a personnel security investigation shall be addressed by the CSR/FSO. Contract personnel shall self-report any derogatory issue to their supervisor or the CSR/FSO in accordance with NISPOM. The CSR/FSO shall notify the

Government Sponsor regarding issues that will impact a contract personnel’s ability to maintain access. No contract personnel shall have access to any DoD classified/unclassified or sensitive information/CUI until completion of the adjudication process and/or resolution of issues. An unfavorable determination does not relieve the contractor from meeting any contractual obligation under this contract/task order.

d. The contractor FSO shall ensure contractor personnel requiring access to IT systems or networks are certified in accordance with DoDI 8570.01-M, designated in DISS and provide documentation of certification to the COR. The contractor shall ensure contractor personnel complete annual Information Assurance (IA) training. The contractor/site lead/government

CONTINUATION-DD-254

sponsor shall ensure a System Authorization Access Request - Navy (SAAR-N) is completed on contract personnel requiring access to IT systems.

e. The government sponsor shall ensure a completed SAAR-N is forwarded to the Navy Command’s Security Manager at least five (5) days prior to the contract personnel’s start date. Failure to provide the required documentation in the prescribed timeframe is likely to result in a delay in contract personnel’s start date.

f. The contractor shall comply with Directive-Type Memorandum (DTM) 08-003, DoD 5200.2R, and SECNAVINST 5510-30 regarding CAC issuance, Personnel Security Program procedures for contract employees requiring: (1) Physical access to a federally controlled base, facility or activity and/or; (2) Access to DoD computers and networks (information technology and systems) to perform certain classified, unclassified, or non-critical sensitive duties under this contract/task order.

(1) The contractor shall immediately report a lost or stolen CAC to the Government Sponsor.

(2) FAR Clause, 52.204-9, “Personal Identity Verification of Contractor Personnel”, also included in this contract is applicable and provides further direction regarding the CAC.

(3) The contractor is responsible for the absence of contract personnel due to expired CACs/credentials.

(4) Contract personnel shall return CACs to the government Technical Point of Contact/Government Sponsor upon contractor change in status, expiration of the CAC, or completion or expiration of the contract.

(5) IAW DHRA Memo of 27 April 2016 DoD organization/government e-mail addresses are to be assigned to DoD contractors and be reflected in DoD’s government GALs, CAC issuance and maintenance processes will be modified to allow only approved e-mail addresses. If contract personnel have not obtained a DoD organization/government e-mail addresses at the time of reverification (every 180 days), the CAC will not be re-verified; and the system will automatically revoke and disable the CAC.

g. If government sponsor does not validate requirement for CAC issuance of contract personnel, Defense Biometric Identification Systems (DBIDS) credentials must be obtained by the contractor personnel. The contractor is responsible for obtaining DBIBS credentials and submitting applications for specific installation IAW contract/task order for contractor personnel to access installation. DBIBS manages access control and privileges for non-CAC eligible contractors.

(1) Contractor personnel currently possessing a Navy Commercial Access Control System (NCACS) card (RAPIDSGate pass) must follow sections 1 (a) through 1(d) below in order to obtain DBIDS credential.

(a) Present current NCACS card and a completed copy of the SECNAV Form

5512/.1 to base Visitor Control Center (VCC) representative.

(b) VCC representative will validate information provided is current and correct.

(c) Once information is validated, a temporary DBIDS credential is provided.

(d) Temporary DBIDS credential will have an expiration date of 180 days from issuance. Obtain permanent DBIDS prior to expiration of temporary credentials.

(2) Contract personnel who do not possess a NCACS cards must follow sections 2(a) through 2(e) the below in order to obtain DBIDS credentials.

(a) Present a letter or official document from government sponsoring organization that provides the purpose for access.

(b) Present valid identification, such as passport or Real ID Act-compliant state driver’s license.

(c) Present a completed copy of the SECNAV Form 5512/1 to obtain background check.

(d) Upon completion of the background check, the VCC representative will complete the DBIDS enrollment process, which includes photo, fingerprints, base restrictions, and several other assessments.

(e) Contract personnel will be provided with new DBIDS credentials and may proceed to work.

OPERATIONS SECURITY (OPSEC) REQUIREMENTS

General Contractor OPSEC Requirements: During the course of this contract/task order, in addition to those restrictions, instructions and guidelines delineated in the contract Performance Work Statement (PWS) and/or other references provided, the contractor shall adhere to the following minimum requirements in support of Commander, Navy Air Force Reserve (CNAFR) OPSEC programs:

a. Introduction of personnel electronic devices into government networks, government spaces, laptops, tablet PCs, cellular phones, cameras, recording devices, and data recording/storage devices is STRICTLY controlled and forbidden in most cases. Company issued equipment required for the performance of work at CNAFR site shall be approved by the government security officer. Photography and recording is not allowed except for official use and by permit only. (Unless otherwise stipulated in the contract, contact the CNRFC/CNAFR Security Officer for approval.)

b. Contractor personnel shall not discuss government operations in public or over unprotected or unencrypted communications. Official Business, controlled unclassified information shall only be transmitted as directed in the Performance Work Statement.

c. The Contractor shall not post to company websites, publications, newsletters or other media any images, data or information that reveal sensitive government operations, personnel, equipment, and/or classified or controlled unclassified information, refer to paragraph (d) below. When in doubt, company press releases related to this contract shall be coordinated through the Contracting Officer Representative (COR) and the CNRFC/CNAFR Public Affairs Officer (PAO).

d. Contractor personnel shall not disclose to unauthorized third parties, post to unofficial sites (including Social Networking sites) any images, data or information that reveals sensitive government operations, personnel, equipment, including, but not limited to:

(1) Tactics, techniques and procedures, production or work schedules, any visible or concealed modifications, upgrades, additions to vessels, aircraft, or weapons or equipment; increases, change, or decreases in work/deployment frequency or government personnel, vehicle, vessel or aircraft movements; specialized equipment orders, deliveries, shipments, etc. (Unauthorized disclosure and transfer of National Security Information is punishable under 18 United States Code § 793.)

(2) Any Non-Disclosure requirements will remain in effect during the duration of this contract/task order and indefinitely thereafter.

(3) Unauthorized disclosures and attempts to solicit this type information by unauthorized third parties or others not affiliated with this contract shall be reported to the CNRFC/CNAFR Security Office, the contract point of contact, the Contractor Facility Security Officer (FSO) and the Defense Security Service (DSS).

e. Government issued badges, identification shall be removed and/or concealed from plain sight when off station and shall not be left in vehicles or unprotected. Badges and Passes shall not be duplicated or copied. Lost or stolen identification badges, vehicle passes etc., will be immediately reported to the CNRFC/CNAFR Security Office.

f. Practice OPSEC and implement countermeasures to protect Critical Information (CI) and other sensitive unclassified information and activities vigilance or degrade the planning and execution of military operations performed or supported by the contractor in support of the mission. Protection of CI will include the adherence to and execution of countermeasures which the contractor initiates or as provided by CNRFC/CNAFR Security Office, for CI on or related to this Performance Work Statement.

g. The contractor must mark and protect related internal production schedules, deliverables, inventories and shortages and identified vulnerabilities related to production of government material as FOR OFFICIAL USE ONLY (FOUO) Information.

h. All government information shall be destroyed at contract termination or returned to the government at the government’s discretion.

INFORMATION ASSURANCE (IA) BASIC USER:

IA TRAINING

DOD Cyber Awareness Challenge Information Assurance (IA) and Identifying and Safeguarding Personally Identifiable Information (PII) training is required for all contractor personnel prior to having a Navy Marine Corps Intranet (NMCI) account created, and repeated as per DON and/or Commander, Reserve Forces (RESFOR) guidance annually thereafter. The Contractor shall meet the applicable information assurance certification requirements, including:

a. DOD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DOD 8570.01-M.

b. Appropriate operating system certification for information assurance technical positions is required by DOD 8570.01-M. All contractor Cyber Security Workforce (CSWF) certifications (if required shall be provided to CNRFC N64 upon receipt/arrival/check-in for registration in the Total Workforce Management Services (TWMS).

c. Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

d. Contractor personnel who do not have proper and current certifications shall be denied access to DOD information systems for the purpose of performing information assurance functions. The contractor shall provide a plan/schedule of certification attainment within six months of contract/task order award for those contractor personnel assigned who arrive without appropriate IAT certification. The contractor shall provide the plan/schedule of certification attainment and/or a schedule of continuing education (CE) for the maintenance of required certification units within 15 days of contract award (DOD requires CEs for maintenance of Security +). The contractor shall comply with all other requirements of DOD 8570.01-M for each respective Information Assurance Systems Architect and Engineer (IASAE) or IAT level. Guidance is located at: http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf.

e. DOD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DOD 8570.01-M. It has been determined that contractors supporting this contract/task order will not hold any privileged access. If the contractor’s duties and responsibilities are elevated during the contract period, a review of those duties will be performed by the CSWF PM. This review will identify the appropriate work role code and proficiency level required for the position. The contractor will be required to comply with all CSWF policies.

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, "DoD Contract Security Classification Specification" Hide Attachment Bar

Aviation Supply Detachment 1251 Military Parkway Fort Worth, TX 76127-1251

1915 Forrestal Drive

Ref 11e: Contractor is not allowed to Fabricate, Modify, or Store Classified Hardware. Perform services only.

Attachment: DD254 continuation pages

Philadelphia, PA 19111-5083 Enter address (include zip code).: 1915 Forrestal Drive Norfolk, VA 23551