DD 254.pdf

CLASSIFICATION (When filled in):_ Unclassified

DD Form 254, MAY 2019 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Unclassified

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort.)

OMB No. 0704-0567 OMB approval expires 20220531

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing Instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of Information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-lnformation-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of Information If it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY CLEARANCE (FCL) REQUIRED (See instructions)

Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/MATERIAL

REQUIRED AT CONTRACTOR FACILITY

None

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (x and complete as applicable)

a. PRIME CONTRACT NUMBER (See instructions.)

X

DATE (YYYYMMDD)

a. ORIGINAL (Complete date in all cases) 20200506

b. SUBCONTRACT NUMBER b. REVISED (Supersedes all previous specs)

REVISION NO.

DATE (YYYYMMDD)

X

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

HDTRA1-20-R-0033

c. FINAL (Complete item 5 in all cases) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? X NO YES. If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? X NO YES. If Yes, complete the following:

In response to the contractor’s request dated , retention of the identified classified material is authorized for the period o f

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO)

(Name, Address, Zip Code, Telephone required; Email Address optional)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO)

(Name, Address, Zip Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE

(If applicable, see instructions)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, Zip Code, Telephone required; Email Address optional)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

Provide services required for prsentation of treaty or mission related training courses, seminars and missions.

mailto:lnformation-collections@mail.mil

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAMS (SAP) INFORMATION

b. RESTRICTED DATA X g. NORTH ATLANTICE TREATY ORGANIZATION (NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (If CNWDI applies, RESTRICTED DATA must also be marked) X h. FOREIGN GOVERNMENT INFORMATION

i. ALTERNATIVE COMPENSATORY CONTROL MEASURES (ACCM)

d. FORMERLY RESTRICTED DATA

e. NATIONAL INTELLIGENCE INFORMATION X j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions)

(1) Sensitive Compartmented Information (SCI)

k. OTHER (Specify) (See instructions.)

(2) Non-SCI

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY (Applicable only if there is no access or storage required at contractor facility. See instructions)

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION CENTER

(DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE TEMPEST REQUIREMENTS

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY X j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

c. RECEIVE, STORE, AND GENERATE CLASSIFIED INFORMATION OR

MATERIAL

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

X d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE X

l. RECEIVE, STORE, OR GENERATE CONTROLLER UNCLASSIFIED INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements.

Non-DoD Components: See instructions.) e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE

U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

m. OTHER (Specify) (See instructions)

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone number contact information and if available, an e-mail address. (See instructions)

Direct X Through (Specify) PUBLIC RELEASE AUTHORITY: Defense Threat Reduction Agency 8725 John J. Kingman Road, MS 6201 Ft. Belvoir, VA 22060-6201

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

NOTE: See BLOCK 13 (CONTINUED) for Statement 13b

Item 13a: The contractor shall comply with the Security Agreement (DD Form 441) including the NISPOM and any revisions to that manual, notice of which has been furnished to the contractor.

Item 13c: Should the contractor visit or perform work in support of this contract at any DTRA facility, the contractor shall submit proof of clearance thru JPAS to SMO Code GQDD614 or fax a Visit Authorization Request (VAR) to The DTRA Security and Counterintelligence Office (ATTN:

Visitor Services). VARs shall contain the information specified in paragraph 6-104 of the NISPOM. VARs may be faxed to (703) 767-3287. The term of the VAR shall be for the period of contract performance. All classified visit request by contractors should be forwarded to the Program Manager for approval and need-to-know.

List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form) i i

NAME AND TITLE OF REVIEWING OFFICIAL SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS.

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No X Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13.

When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Use Item 13 or click button if additional space is needed. (See instructions for additional guidance or use of the fillable PDF.)

All "For Official Use Only" information shall be marked, safeguarded, transmitted, and disclosed in accordance with DoD 5400.7, "DOD Freedom of Information Act Program", Chapter 4

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the CSO.

X No Yes If Yes, explain and ident can also use item 13. W fy specific areas and government act hen removing any expanded text are ivity res a, use ponsible for inspections.

delete key or backspace k

The field w ey, then clic ll expand as text is added or you k out of the text field for it to shrink after the text has been deleted. Use Item 13 or click button if additional space is needed. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME c. ADDRESS (Include ZIP Code)

8725 John J Kingman Road Fort Belvoir, VA 22060

d. POC NAME

Defense Threat Reduction Agency Deirdre D. Parker

b. ACTIVITY ADDRESS CODE (AAC) OF THE

CONTRACTING OFFICIAL (See instructions.)

HDTRA1

e. POC TELEPHONE (Include Area Code)

5716165491

f. EMAIL ADDRESS (See instructions) deirdre.d.parker.civ@mail.mil

17. CERTIFICATION AND SIGNATURE.

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort.

All questions shall be referred to the official named below. Upon digitally signing Item 17h, no Changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See instructions)

d. ACC OF THE CONTRACTING OFFICE (See Instructions)

h. SIGNATURE

GRAY.PA Digitally signed by

MELA.DE GRAY.PAMELA.D

ENISE.122975304

NISE.122 1

Date: 2020.05.07

9753041 10:17:01 -04'00'

Gray, Pamela D HDTRA1

b. TITLE e. CAGE CODE OF THE PRIME CONTRACTOR (See instructions)

Program Manager

c. ADDRESS (Include ZIP Code) f. EMAIL ADDRESS (See instructions) pamela.d.gray8.civ@mail.mil

i. DATE

07 May 2020 8725 John J Kingman Road Fort Belvoir, VA 22060 g. TELEPHONE (Include Area Code)

571-616-6296

18. REQUIRED DISTRIBUTION BY CERTIFYING OFFICIAL

X a. CONTRACTOR f. OTHERS AS NECESSARY (If more room is needed, continue in item 13 or on additional page if necessary.)

b. SUBCONTRACTOR

X c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

X e. ADMINISTRATIVE CONTRACTING OFFICER mailto:deirdre.d.parker.civ@mail.mil mailto:pamela.d.gray8.civ@mail.mil

BLOCK 13 (CONTINUED)

HDTRA1-20-R-0033

Item 10g: Contractor access to North Atlantic Treaty Organization (NATO) and Foreign Government Information requires a final U.S.

Government clearance at the appropriate level.

Reference: DTRA Memorandum, North Atlantic Treaty Organization (NATO) Security Briefing for Secure Internet Protocol Router Network (SIPRNET) Users.

All DTRA contractors that require a SIPRNET account must be NATO briefed.

Item 10h: Contractor access to Foreign Government Information requires a final U.S. Government clearance at the appropriate level.

Individuals should be briefed on NATO at the appropriate locations.

Item 10j: All Controlled Unclassified Information (CUI) shall be marked, safeguarded, transmitted, and disclosed in accordance with DoD Manual 5200.01, Volume 4, Controlled Unclassified Information and Volume 3, Protection of Classified Information.

Item 11d: The contractor is required to fabricate, modify, and store classified hardware. The Government will provide one work area and computer with DTRA network access. Under no circumstances shall individuals working on this contract remove from DTRA any classified electronic media without approval and permission.

All contractors in privileged user positions must follow the guidance in accorance with the authority in DoDI 8500.01 and DoDM

5200.02. Privileged users are defined as, but not limited to, persons in the following roles or positions: Information Assurance Managers/Officers, supervisors of IT positions, system administrators, maintainers of IA-enabled products such as routers, switches, firewalls, personnel performing system monitioring and testing, and personel who issue Classified PKI certificates.

Item 11j: a. The contractor shall comply with Operations Security (OPSEC) requirements contained in the contract, addendum thereto, or identified herein.

b. The contractor will ensure compliance with the Agency’s OPSEC Policy Statement and Critical Information List, supporting security and OPSEC policies, directives, instructions or mandates.

c. The contractor shall be familiar with OPSEC and will be required to take government furnished initial and annual refresher OPSEC training and will be reminded of their continued responsibility to protect sensitive information.

d. The contractor shall take the necessary precautions to ensure employees with access to the sensitive and critical information are instructed not to disclose or disseminate any information relating to the conduct and performance of the contract to any individual not authorized to perform on this contract. OPSEC and other security guidance issued to the Prime Contractor shall also apply to subcontractors working on this effort. Assigned personnel shall be knowledgeable of the designated critical information and measures in place to protect it.

e. For programs protected by a Program Protection Plan (PPP), Critical Program Information (CPI) must be identified and protected in accordance with DoD Instruction 5200.39, Critical Program Information (CPI) Identification and Protection within Research, Development, Test and Evaluation (RDT&E). The contractor shall ensure that any program with CPI has the corresponding supplements and associated plan, such as an OPSEC plan, approved and in effect in support of the PPP.

f. The contractor shall comply with OPSEC content review policies within the Agency. A content review is an evaluation of information intended for release outside the control of the organization, including release to the public. OPSEC focuses on identifying and protecting the organization's unclassified information that may individually or in the aggregate lead to the compromise of classified information and sensitive activities. The contractor will ensure that these reviews are conducted according to Agency guidance in accordance with mandates from DoD Directive 5205.02E, DoD Operations Security (OPSEC) Program, DoD 5205.02, DoD Operations Security (OPSEC) Program Manual, DoD Instruction 5230.09, Security and Policy Review cof DoD Information for Public Release DoDI 5230.29, Clearance of DoD Information for Public Release; and DoDI 8170.01, Online Information Management and Electronic Messaging.

G. Further OPSEC guidance may be obtained by contacting the OPSEC PMO at 571-616-5371 or the Special Security Office (SSO) for this program.

Item 11l: All Controlled Unclassified Information (CUI) shall be received, stored, and generated in accordance with DoD Manual 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI).

Item 13b: Contractor employee(s) performing work under this contract shall be U.S. citizens, with an active appropriate security clearance eligbility based on the need for access to specific sensitive or classified information. The minimum security clearance eligibility requirement for access to DTRA information, systems or facilities is Secret, granted by the DoD Central Adjudicative Facility, Fort Meade, Maryland 20755. All personnel at DTRA that require acess to DTRA facilities, networks or information and/or who are sponsored or issued a Common Access Card, DTRA badge or Local Area Network account(s) adhere to all DTRA Security and Counterintelligence Policy & Procedures, specifically the Mandatory In and Out Processing; Personnel Security Reporting Requirements. Failure to complete security requirements, to include mandatory security training (Cyber Awareness, PII and Refresher Security Counterintelligence) will result in deactivation/revoking of network, CAC and facility access. Contractor(s) employees working at or supporting DTRA must require DTRA space or network minimum of three days per week for issuance of CAC or DTRA permanent badge to be issued to them. Contractor(s) terminating employment, or no longer supporting a DTRA contract must out-process immediately with security. Failure to do so may adversely affect departing personnel's continued eligibility to sensitive and classified information.

Contractor employee must have a valid Visitor Authorization Request (VAR) in place with DTRA to perform work. Submit a VAR for each contractor employee performing work on this contract prior to scheduling Security In Processing. The term of the VAR should be for the period of the contract performance. Need to Know should be validated by the PM and COR by DTRA FM 3. Utilize JPAS the approved DoD Adjudicative Database, for passing a VAR. DTRA's Security Management Office (SMO) Code is GQDD614.

Item 13d: In contracts involving SCI/SAP information, the contractor is not authorized to issue subcontracts in furtherance of the security requirements delineated in this specification without the written authorization of the DTRA SSO.

Item 13e: In accordance with DTRA Policy and DTRA Instruction 5240.06, Counterintelligence Awareness, Briefing, and Reporting Programs, all contractors working under DTRA contracts are required to comply with the following:

4.1. All DTRA contractors will receive a CI Awareness Briefing upon in-processing at DTRA. All DTRA contractors will receive an annual update of the CI Awareness Briefing.

4.2 Prior to any official travel outside the Continental United States (OCONUS) or while attending domestic or overseas meetings, conferences or symposiums where meetings with foreign nationals are expected, all DTRA contractors and personnel contracted by DTRA traveling via agency sponsored or supported activities or another DoD component, will contact the BDC or the local SC Field Office to receive a AOR Specific Travel Briefing, no more than 90 days prior to any OCONUS travel in accordance with DoDI

2000.16 (reference(b).

In accordance with DODI 2000.16-V-1 Antiterrorism (AT) Program Implementation and the DTRA Antiterrorism Plan, requires all DTRA military personnel, DoD civilians and On-site contractors at all DTRA locations to be provided AT Level I Training. The Security and Counterintelligence Directorate will be responsible for ensuring completion of annual AT Level I Training.

All DTRA (field offices) contractors are required to take the madatory training listed on Learning Management System (LMS) within 90 days of Entrance on Duty (EOD) date.

All personnel at DTRA (civilian, military, contractor or other government agency personnel), in accordance with DTRA instructions and policies, the use of personally owned electronic devices are prohibited in the DTRA facility . Unauthorized introduction of such devices into the DTRA facilities constitutes a security incident; which will be followed with a security incident inquiry/report for corrective action. Unless issued/approved by DTRA, all electronic devices which require access into the DTRA facility must be coordinated and approved through the Security and Counterintelligence, Technical Security Branch.

The use of the public world-wide web/internet services is not authorized to discuss, disseminate, produce or transmit "For Official Use Only" information and classified information

All personnel at DTRA (military, civilian, contractor or other government agency personnel) that require a permanent DTRA badge or access to the DTRA LAN must receive an in-processing security brief before issuance of a DTRA badge or access to the DTRA LAN.

Contractors or other government agency employees working at or supporting DTRA must be in DTRA spaces a minimum of three days per week for a DTRA permanent badge to be issued to them. Some contractors or other government agency employees working at or supporting DTRA may be required to have a DTRA LAN account. Contractors or other government agency employees working at or supporting DTRA that will be issued a DTRA permanent badge or a DTRA LAN account must in-process and receive a security briefing. All personnel that possess a DTRA permanent badge or have access to the DTRA LAN must receive an out-processing security debrief in the event they are terminating employment, retiring, no longer supporting DTRA, being reassigned to another government agency, or will be absent from duty or employment for more than 60 consecutive days. Failure to do so may adversely affect departing personnel’s security clearance and future employment. This sentence relates to full time DTRA contractors, and

Phone:

personnel who are contracted by DTRA that are located in other regions, academia, etc. All contractors that will be working in DTRA space and/or having access to the Local Area Network are required to in and out process through Personnel Security.

Item 13f: Security Classificaton Guides:

New START Treaty (NST); Conventional Focesion Europe Treaty (CFE); The Treaty on Open Skies and the Chemical Weapons Convention (CWS)

The signatures below indicate this contract has been coordinated with the DTRA Program Manager. For further assistance on the contract please contact the DTRA Program Manager listed below.

Program Manager:

Deirdre Parker DATE: 5/6/2020 571-6165491 Printed Name

(Signature)

PARKER.DEIRDRE.D

ENISE.1042532246

Digitally signed by

PARKER.DEIRDRE.DENISE.10425322

Date: 2020.05.06 15:23:13 -04'00'