DD 254_Solicitation_TSS3.pdf

CLASSIFICATION (When filled in): Unclassified

M68909-21-R-XXX

PREVIOUS EDITION IS OBSOLETE. Page 1 of 5 AEM LiveCycle Designer

DD FORM 254, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED

(See Instructions)

Top Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

None (See instructions)

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE This DD-254 is for SOLICITATION purposes only.

The COR must contact the Security Officer designated in Block 17 with a prime contractor name, CAGE Code and contract number as soon as possible to ensure a revised DD-254 is prepared and ready for contract award.

b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor) Add Row Remove last Row Delete All Rows

a. NAME, ADDRESS, AND ZIP CODE Forward a copy of ALL Sub-DD-254s to the Security Officer designated in Block 17.

b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.) Add Row Remove last Row Delete All Rows

a. LOCATION(S) (For actual performance, see instructions.)

MCTSSA

Camp Pendleton, CA 92055-5171

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.)

I Marine Expeditionary Force 11th and C Street Camp Pendleton, CA 92055

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

M68909-21-R-XXX

PREVIOUS EDITION IS OBSOLETE. Page 2 of 5 AEM LiveCycle Designer

DD FORM 254, APR 2018

a. LOCATION(S) (For actual performance, see instructions.)

II Marine Expeditionary Force Camp Lejeune, NC 28542-0080

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.)

III Marine Expeditionary Force Camp Courtney, Okinawa, Japan

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.)

CTF 51/5

NSA Bahrain

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.)

Marine Forces Europe Stuttgart, Germany

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.)

Marine Forces Reserve 2000 Opelousas Avenue New Orleans, LA. 70114

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

The primary objective of this service is to provide tactical systems support from the MCTSSA Support Center to the fleet Marine forces worldwide with continuous support of fielded tactical C4I programs of record to ensure that Marines can successfully optimize the employment of tactical C4I systems.

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.) h. FOREIGN GOVERMENT INFORMATION

d. FORMERLY RESTRICTED DATA i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

SIPRNet

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

M68909-21-R-XXX

PREVIOUS EDITION IS OBSOLETE. Page 3 of 5 AEM LiveCycle Designer

DD FORM 254, APR 2018

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

Distribution Statements (see item 14)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

Commander, MCTSSA, BOX 555171, CAMP PENDLETON, CA 92055-5171

Public Release Authority:

All requests must be approved by MCTSSA PAO:

amy.forsythe@usmc.mil

13. SECURITY GUIDANCE Add Signature Remove last Signature Delete All Signatures

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

The Security Classification Guide (SCG) utilized for this effort is:

POP End Date (estimated:

8a. Primary place of performance shall be MCTSSA. Other locations include the three Marines Expeditionary Forces (MEFs) aboard Camps Pendleton, Lejeune, and Courtney; Marine Forces Reserve (MARFORRES) in New Orleans, LA; Marine Forces Europe/Africa (MARFOREUR/AF) in Stuttgart, Germany; and Task Force 51/5 at NSA Bahrain. Additionally, the contractor may be required to travel to various Marine Corps bases/installations located in the Continental United States (CONUS) and Outside CONUS (OCONUS) to support fleet units and/or for network traffic data collection and analysis. Contractor personnel requiring access to these facilities are required to be COMSEC/NATO briefed and hold a final U.S. Government Secret Clearance.

10a. Access to any COMSEC information requires special briefings. Access to classified COMSEC information requires a U.S.

Government Secret clearance. Publishing or releasing of any COMSEC information by any means without the written approval from Communications security, NSA, Fort George G. Meade, MD 20755 via Commanding Officer, MCTSSA, is prohibited. MCTSSA Security (Electronic Key Management System (EKMS) Manager) will provide COMSEC acknowledgement form and conduct brief. Contractor will sign Contractor Acknowledgment Form.

10e. Intelligence information will be handled and controlled as indicated in DoDM 5105.21 (Vol 1-4), NAVSUP to DoD 5105.21-M-1, the NISPOM Chapter 5 and applicable SSO Navy BANIFs. Access to Intelligence information requires a final U.S. Government clearance at the appropriate level.

10e(1). Access to Sensitive Compartmented Information (SCI) is strictly controlled. The contractor will not provide SCI access to anyone without the written approval of the MCSC SSO. In performance of this contract, the contractor will require access to SCI at the locations listed in Attachment A. Also:

a. SCI does not become the property of the contractor and may be withdrawn at any time. Upon expiration of the contract, all intelligence released and any material using data from the intelligence will be returned to the project officer or COR for final disposition.

M68909-21-R-XXX

PREVIOUS EDITION IS OBSOLETE. Page 4 of 5 AEM LiveCycle Designer

DD FORM 254, APR 2018

b. Contractors will not release this information to any activity or person not directly engaged in providing services under the contract or to another contractor (including subcontractors), government agency, private individual, or organization without prior approval of the Director, Navy Special Security Office (SSO Navy) via Commander, MARCORSYSCOM (SSO).

c. Intelligence material will not be released to foreign nationals or immigrant aliens, who may be employed by the contractor, regardless of the level of their security clearance or access authorization, except with the specific permission of the Director, SSO Navy via Commander, MARCORSYSCOM (SSO).

d. Intelligence material will not be reproduced without prior approval of the Director, SSO Navy via Commander, MCSC (SSO). All intelligence material will bear a prohibition against reproduction while in the custody of the contractor.

e. Contractors will maintain records, which will permit them to furnish, on demand, the names of individuals who have access to intelligence material in their custody.

f. Reproduction and destruction of this material, regardless of the classification, is prohibited without written approval from Commander, MARCORSYSCOM (SSO) or higher authority.

10j. The contractor shall comply with the requirements of the SECNAVINST 5510.36B and DoDI 5200.48 for guidance when access to CUI is required in performance of this contract.

10k. SIPRNET access is required.

11a. Have access to classified information only at another contractor’s facility or at a government activity. The contractor requires access to classified source data up to and including the classification levels identified in item 1.a. of this DD-254 in support of this work effort.

Applicable if there is no classified access, safeguarding (storage), receiving, generating, or fabricating of classified information required at the contractor’s facility. If the contractor will be co-located in MARCORSYSCOM spaces during anytime within the full performance of this contract, they will comply with and be held accountable for the requirements of SECNAVINST 5510.30C, SECNAVINST 5510.36B and any additional security requirements provided by the MARCORSYSCOM’s GCA, the Industrial Security Office, and the CMCC Custodian. The contractor shall comply with the requirements of the Information Systems Security Programs as described in OPNAVINST

5239.2 and local command information systems security instructions. All classified systems, regardless of the level of data processed, will be accredited in accordance with the above instructions. The contractor will ensure all articles (including graphics) intended for public release or posting on Internet/World Wide Web sites will be processed through the Public Affairs Office as listed in Item 12.

11e. Contract is for services. Classification markings on the material to be furnished will provide the classification guidance necessary for the performance of this contract. Additional guidance will be provided as required by the MCTSSA Security Manager.

11f. Contractor will have access to U.S. classified outside the U.S. within the confines of U.S. supporting establishments.

11j. See [14.] Additional Security Requirements for OPSEC Requirements while preforming aboard NAVY/USMC sites.

11l. Receive, Store, or Generate Controlled Unclassified Information (CUI). In addition to classified information, certain types of unclassified information also require distribution controls and protective measures for a variety of reasons. Refer to DoDI 5200.48 for guidance with identification and protection of CUI.

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form) Hide Attachment Bar

Signature authority for this effort is:

NAME & TITLE OF REVIEWING OFFICIAL

Alisa Munden

Security Manager

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

11j. OPSEC Requirements. While performing aboard NAVY/USMC sites, the contractor shall comply with the provisions of DoD Directive 5205.02E, "DoD Operations Security (OPSEC) Program," SECNAV 3070.2, Marine Corps Order 3070.2A and the MARCORSYSCOMO P5510.2B Security Manual, at all other sites the contractor shall comply with the local command and/or program OPSEC plan.

15. INSPECTIONS

M68909-21-R-XXX

PREVIOUS EDITION IS OBSOLETE. Page 5 of 5 AEM LiveCycle Designer

DD FORM 254, APR 2018

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

M68909

c. ADDRESS (Include ZIP Code)

MCTSSA

BOX 555171

CAMP PENDLETON, CA 92055-5171

d. POC NAME

e. POC TELEPHONE (Include Area Code)

f. EMAIL ADDRESS (See Instructions)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

Alisa Munden

b. TITLE

Security Manager

c. ADDRESS (Include ZIP Code)

MCTSSA

BOX 555171

CAMP PENDLETON, CA 92055-5171

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

M68909

e. CAGE CODE OF THE PRIME CONTRACTOR

(See Instructions.)

N/A

f. TELEPHONE (Include Area Code)

+1 (760) 725-2365

g. EMAIL ADDRESS (See Instructions) alisa.munden@usmc.mil

h. SIGNATURE

i. DATE SIGNED (See Instructions)

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

CLASSIFIED ACCESS LOCATIONS

DD-254 Contract Number: M68909-20-R-7600

ATTACHMENT D

CLASSIFIED ACCESS LOCATIONS

Classified access (to the level indicated in Block 1a of this DD-254) may occur at the locations identified below. These facilities are under the exclusive responsibility of the designated Government Security Managers/Officers or the Contractor Facility Security Officers.

LOCATION CAGE

CODE

SMO

CODE

GENSER SIPRNet (where available)

Receive, Generate, &

Store Classified

SCIF - NV-02-015

I Marine Expeditionary Force

11th and C Street

Camp Pendleton, CA 92055

X X

MCTSSA

Camp Pendleton, CA 92055-5171 X X

II Marine Expeditionary Force

Camp Lejeune, NC 28542-0080 X

III Marine Expeditionary Force

Camp Courtney, Okinawa, Japan

CTF 51/5

NSA Bahrain

Marine Forces Europe

Stuttgart, Germany

Marine Forces Reserve

2000 Opelousas Avenue

New Orleans, LA. 70114

Additional Locations as Determined by the GCA, COR, or Project Officer in order to prevent work stoppage. These locations will be provided in subsequent DD-254 along with the Task Orders for the Multi-Award Task Order Contract.

ATTACHMENT A

CONTROLLED UNCLASSIFIED INFORMATION (CUI) INFORMATION

1. The Controlled Unclassified Information (CUI) marking is applied to the information in a document upon creation. The CUI marking is not a substitute for a security classification marking, but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

2. The use of CUI markings means that the information must be reviewed by MCTSSA prior to release to the public to determine whether a significant and legitimate government purpose is served by withholding the information or portions of the information.

3. An unclassified document containing CUI information will be marked “CONTROLLED UNCLASSIFIED INFORMATION” on the bottom face and interior pages.

4. Any CUI information released to you by MCTSSA is required to be marked with the following statement prior to transfer:

THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY

DISCLOSURE UNDER THE FOIA. EXCEPTION(S) _APPLY.

5. CUI markings may only be removed by the originator or other authority. DO NOT REMOVE ANY CUI MARKING WITHOUT WRITTEN AUTHORIZATION FROM MCTSSA OR THE AUTHOR. You will be notified when the CUI status is terminated.

6. CUI information may be disseminated to employees and subcontractors who have a need for the information, in respect to this contract.

7. During working hours, CUI information shall be placed out-of-sight if the work area is accessible to persons who do not have a need for the information. During off hours, the information shall be stored to prevent unauthorized access. Filing CUI material in unlocked files or desks with other unclassified records is adequate when internal building security is provided during off hours. When internal security is not available, locked buildings or rooms provide adequate off hours protection.

Additionally, the material may be stored in locked receptacles, such as file cabinets, desks, or bookcases.

8. CUI information may be sent via first-class mail or parcel post.

Bulky shipments may be sent via fourth-class mail.

9. CUI information created at Government site will be disposed of when no longer needed ONLY by using a government provided cross cut shredder or shred disposable bin provided in each Government facility.

10. The releasing agency should be informed of any unauthorized disclosure of CUI information. The unauthorized disclosure of CUI is not a security violation, but the release of information protected by the Privacy Act may result in criminal sanctions.

ATTACHMENT B

OPERATIONS SECURITY REQUIREMENTS

All work will be performed in accordance with DoD and Navy Operations Security (OPSEC) requirements, per the following applicable documents:

National Security Decision Directive 298, National Operations Security Program, 28 July 1992.

DoDD 5205.02E, DoD Operations Security (OPSEC) Program, 20 June 2012.

OPNAVINST 3432.1A, Operations Security, 4 August 2011.

SECNAVINST 5239.2

MCTSSA Operations Security Policy

The Contractor will accomplish the following minimum requirements in support of Marine Corps Tactical Systems Support Activity (MCTSSA) OPSEC Program:

The Contractor will practice OPSEC and implement OPSEC countermeasures to protect DoD Critical Information. Critical Information includes facts (individually or in aggregate) that reveal sensitive details about MCTSSA, contractor security, or operations related to the support or performance of this Performance Work Statement (PWS), and require a level of protection from adversarial collection or exploitation not normally afforded to unclassified information.

The Contractor must protect Critical Information and other sensitive unclassified information and activities, especially those which could compromise classified information, operations, or degrade the planning and execution of military operations performed or supported by the contractor. Protection of Critical Information includes adherence to and execution of countermeasures provided by MCTSSA for Critical Information related to the PWS.

Sensitive unclassified information is that information marked CONTROLLED UNCLASSIFIED INFORMATION (or CUI), Privacy Act of 1974, COMPANY PROPRIETARY, and also information as identified by MCTSSA or the MCTSSA Contracting Officer Representative (COR).

MCTSSA has identified the following Critical Information items that may be related to this PWS:

Known or probable vulnerabilities to any U.S. system and direct support systems.

Details of capabilities or limitations of any U.S. system and direct support systems.

Details about military operations (e.g., numbers of systems deployed, deployment timelines, locations, effectiveness, unique capabilities).

Operational characteristics for new or modified weapon systems (e.g., Probability of Kill (Pk), countermeasures, survivability).

Required performance characteristics of U.S. systems using leading edge or greater technology (e.g., new, modified, existing).

Telemeter or data-linked data or information from which operational characteristics may be inferred or derived.

Test or evaluation information pertaining to schedules of events during which Critical Information might be captured.

Details of MCTSSA’s unique Test and Evaluation (T&E) capabilities (disclosure of unique capabilities).

Existence or details of intrusions into or attacks against the DoD networks or information systems, including tactics, techniques and procedures used, network vulnerabilities exploited, and data targeted for exploitation.

Network user identification (ID) and passwords.

Counter- Improvised Explosive Device (IED) capabilities and characteristics, including success or failure rates, damage assessments, and advancements to existing or new capabilities.

Vulnerabilities in Command processes, the disclosure of which could allow someone to circumvent security, financial, personnel safety, or operational procedures.

Force Protection specific capabilities or response protocols (e.g., timelines, equipment, numbers of personnel, training received).

Command leadership and VIP agendas, reservations, plans and routes.

Detailed facility maps or installation overhead photography (photos with annotations of Command areas or greater resolution than commercially available).

Details of MCTSSA emergency evacuation procedures, or emergency recall procedures.

Government personnel information that reveals force structure and readiness (e.g., recall rosters, deployments lists).

Compilations of information that directly disclose Command Critical Information.

The above Critical Information and any developed by the contractor, regardless if electronic or hardcopy must be protected by the following countermeasures at minimum:

All emails containing Critical Information must be DoD Public Key Infrastructure (PKI) signed and PKI encrypted when sent.

Critical Information may not be sent via unclassified fax.

Critical Information may not be discussed via non-secure phones.

Critical Information may not be provided to individuals that do not have a need to know to complete their assigned duties.

Critical Information may not be disposed of in recycle bins or trash containers.

Critical Information may not be left unattended in uncontrolled areas.

Critical Information should be treated with the same care as CUI or proprietary information.

Critical Information must be destroyed in the same manner as CUI.

Critical Information must be destroyed at upon termination of the contract or returned to the government at the government’s discretion.

The contractor shall document Critical Information items applicable to operations involving information on or related to the PWS.

Determinations of Critical Information will be completed using the DoD OPSEC 5-step process described in the National Security Decision Directive (NSDD) 298, National Operations Security Program.

OPSEC training must be included as part of the contractor’s ongoing security awareness program conducted in accordance with Chapter 3, Section 1, of the NISPOM. NSDD 298, DoD 5205.02E, DoD Operations Security (OPSEC) Program, and OPNAVINST 3432.1A, Operations Security should be used to assist in the creation or management of training curriculum.

If the contractor cannot resolve an OPSEC issue, they will contact the MCTSSA COR, who will consult with the MCTSSA OPSEC Manager.

All above requirements must be passed on to all subcontractors.

ATTACHMENT C

SPECIFIC ON-SITE SECURITY REQUIREMENTS

1. GENERAL

a. Contractor Performance

In performance of this contract, the following security services and procedures are incorporated as an attachment to the DD-254. The Contractor will conform to the requirements of DoD 5220.22-M, Department of Defense (DoD) National Industrial Security Program, Operating Manual (NISPOM). When visiting MCTSSA, the contractor will comply with the security directives used regarding the protection of classified and sensitive unclassified information, SECNAVINST 5510.36 (series) and SECNAVINST 5510.30 (series).

b. Security Supervision

MCTSSA will exercise security supervision over all contractors onboard MCTSSA and provide security support to the contractor, as noted below. The contractor will identify, to the MCTSSA COR or Technical Support Officer (TSO), an on-site point of contact (POC) to interface with the MCTSSA COR or TSO.

2. HANDLING CLASSIFIED MATERIAL OR INFORMATION

a. Control and Safeguarding

Contractor personnel at MCTSSA are responsible for controlling and safeguarding classified material in their possession.

Contractor personnel will be briefed by the Facility Security Officer (FSO) on the responsibility to safeguard classified material. In addition, all contractor personnel are invited to attend MCTSSA security briefings. In the event of a possible or actual loss or compromise of classified material, the on-site contractor at MCTSSA will immediately report the incident to the MCTSSA Security Manager and the Contractor’s FSO. A MCTSSA representative will investigate the circumstances, determine culpability when possible, and report results to the FSO and the Cognizant Field Office of the Defense Security Service (DSS). On-site contractor personnel will promptly correct any deficient security conditions identified by the MCTSSA representative.

b. Storage

Classified material may be stored in containers authorized by the MCTSSA Security Manager. The MCTSSA Commanding Officer must pre-approve in writing, the use of open areas for storage or for the processing of classified material. The MCTSSA Security Manager will provide specific supplemental security controls for open storage areas, when required.

c. Transmission of Classified Material

i. All classified material transmitted by mail for use by long term visitors will be addressed to COMMANDING OFFICER, MCTSSA, ATTN: CMCC, Box 555171, CAMP PENDLETON, CA 92055- 5171. The inner envelope will be addressed to the attention of the COR/TSO for this contract.

ii. All SECRET/CONFIDENTIAL material hand carried to MCTSSA by contractor personnel must be delivered to the MCTSSA Classified Material Control Center (CMCC).

iii. All MCTSSA classified material transmitted by contractor personnel from MCTSSA will be sent via the MCTSSA CMCC.

d. Information Systems (IS) Security

Contractors using IS networks, or computer resources to process classified, sensitive unclassified and/or unclassified information will comply with the provisions of the NISPOM and SECNAVINST 5239.2 and local policies and procedures.

Contractor personnel must contact the Information System Security Officer (ISSO) to ensure the systems used at MCTSSA have been granted a formal letter of approval to operate.

3. VISITOR CONTROL PROCEDURES

a. Contractor personnel assigned to MCTSSA will be considered long term visitors for the purpose of this contract.

b. Per DoD Memorandum dated April 1, 2005 Subject: Facilitating Classified Visits within the Department of Defense and the National Industrial Security Program Operating Manual (NISPOM), as amended by Industrial Security Letter (ISL) 02-X, mandates industry use of Joint Personnel Adjudication System (JPAS). JPAS Industry Sub Committee Doc 004 Rev 000; all contractors under DoD security cognizance will use JPAS for all personnel security actions. You must request a JPAS account within 90 days after the contract has been awarded.

Prior to the setup of a JPAS account, visit requests to activities shall have Need to Know certified by the MCTSSA TSO. All requests shall contain the information required by NISPOM and shall not exceed a 12 month period. Visit Notifications may be sent via JPAS to the MCTSSA Security Management Office (SMO) number 304256.

c. Visit requests for long term visitors must be received prior to the expected arrival of the visitor to ensure necessary processing of the request.

d. MCTSSA security personnel will issue temporary identification badges to contractor personnel following receipt of a valid JPAS Visit Notification from the contractor’s Security Office.

The COR/TSO may request that picture badges be issued for the length of the basic contract or option period. Identification badges are the property of the U.S. Government and will be worn and used for official business only. Unauthorized use of a MCTSSA badge will be reported to DSS. Identification badges will be worn above the waist in plain sight at all times on board MCTSSA.

e. Prior to departing MCTSSA (after official business has concluded) contractor personnel will check-out with MCTSSA security personnel. The check-out process will ensure security related items issued to contractor personnel are retrieved.

f. Foreign Nationals may only visit MCTSSA by complying with authorized methods set forth within:

i. SECNAVINST 5510.34

ii. Foreign Clearance Guide @ https://www.fcg.pentagon.mil

g. Prior to the termination of a Contractor employee with a MCTSSA badge or active Visit Notification on file, the FSO must:

i. Notify, in writing to the MCTSSA Security Manager and COR/TSO, the Contractor employee is being terminated. In emergency situations, a facsimile may be sent or a telephone notification may be used. The telephone notification, however, must be followed up in writing within five working days.

ii. Confiscate any MCTSSA identification/access badges and return them to the MCTSSA Security Officer, no later than five working days after the effective date of the termination.

4. PHOTOGRAPHY/RECORDING CONTROL

No photography, video, or audio recordings are authorized aboard or around the MCTSSA compound without the written permission of the Commanding Officer or his representative. If there is an official requirement for any photography, video, or audio recordings, the MCTSSA COR/TSO will submit the MCTSSA PHOTOGRAPHY

/ RECORDING REQUEST form to the MCTSSA Security Manager via the CMCC, building 31337.

5. INSPECTIONS

MCTSSA security personnel will conduct periodic inspections of the security practices of the on-site contractor. All contractor personnel will cooperate with MCTSSA security representatives during these inspections. The contractor will be responsive to the MCTSSA security representative’s findings.

6. REPORTS

As documented by the NISPOM, Chapter 1, Section 3, contractors are required to report events that have an impact on the status of the facility clearance (FCL), the status of an employee’s personnel clearance (PCL), the proper safeguarding of classified information, or an indication that classified information has been lost or compromised. The contractor will ensure that information pertaining to assigned contractor personnel or operations is reported to the MCTSSA Security Manager and

COR/TSO.

This reporting will include the following:

a. The denial, suspension, or revocation of security clearance of any assigned personnel

b. Any adverse information, which would cast doubt on an assigned employee’s suitability for continued access to classified materials

c. Any instance of loss or compromise, or suspected loss or compromise, of classified information

d. Actual, probable or possible espionage, sabotage, or subversive information

e. Any other circumstances relating to security that would affect contractor operations on board MCTSSA.

7. PHYSICAL SECURITY

a. The Contractor will comply with all emergency rules and procedures established for MCTSSA.

b. All personnel onboard MCTSSA and Marine Corps Base Camp Pendleton are subject to random inspections of their vehicles, personal items and of themselves. Consent to these inspections is considered to have been given when personnel enter Camp Pendleton.

8. ITEMS PROHIBITED ON BOARD MCTSSA

a. Dangerous weapons, instruments, or devices including, but not limited to, the following:

i. Rifles, automatic rifles, machine guns, sub-machine guns, pistols, machine pistols, flare pistols, starter pistols, shotguns, compressed gas, air or spring fired pellet or BB guns, sling shots, blow guns, or any other device which uses gun powder, compressed gas or air, or spring tension to forcefully eject a projective or other device which may injure someone.

ii. Daggers, switch blades, bow and arrows, spear guns, Hawaiian slings, power heads, fishing knives, scuba knives, or any unofficial knife with a blade longer than 2.5 inches.

iii. Martial arts devices (throwing stars, nunchakus), stun guns, tasers, brass knuckles, billy clubs, night sticks, pipes, bars, mallets, or other similar devices capable of being used as a weapon.

iv. Poison, acids or caustic chemicals; or any other item that may be used to inflict serious injury or death to another person or temporarily blind or disable or cause individual injury not specifically authorized by proper authority.

b. Explosive articles or compounds including, but is not limited to, ammunition for any of the small arms weapons mentioned as a dangerous weapons, including blank ammunition, gun powder, Molotov cocktails, pipe bombs, grenades, pyrotechnics, fireworks, or any other compound or article which might violently react and cause injury not specifically authorized by proper authority.

9. ESCORTING POLICY

All personnel within the MCTSSA fenced perimeter, with the exception of emergency personnel such as fire, ambulance, or hazardous materials responding to an actual emergency, must wear a MCTSSA issued badge. Personnel without the required security clearance require a MCTSSA escort at all times

10. COMMON ACCESS CARD (CAC) REQUIREMENT

The COR will identify and approve contractor employees for this contract that require Common Access Cards (CACs) to perform their job. In accordance with Headquarters, United States Marine Corps issued guidance relative to Homeland Security Presidential Directive – 12 (HSPD-12), all personnel must meet eligibility criteria to be issued a CAC. To meet the eligibility criteria, contractor employees requiring a CAC, must obtain and maintain a favorably adjudicated Personnel Security Investigation (PSI).

Prior to authorizing a CAC, the employee’s JPAS record must indicate a completed and favorably adjudicated PSI or (at a minimum) that a PSI has been submitted and accepted (opened).

The minimum acceptable investigation is a National Agency Check with Written Inquiries (NACI). If a contractor employee’s open investigation closes and is not favorably adjudicated, the CAC must be immediately retrieved and revoked.

FSOs are responsible for notifying the Marine Corps Systems Command (MCSC) Security Director if any contractor on this contract receives an unfavorable adjudication after being issued a CAC. The FSO must also notify the MCSC Security Director of any adverse/derogatory information associated with the 13 Adjudicative Guidelines/Factors concerning any contractor issued a CAC, regardless of whether a JPAS Incident Report is submitted.

Each CAC is issued with a “ctr.usmc.mil” e-mail account the individual contractor must keep active, by logging in on a regular basis (at least twice a month), sending an e-mail, and clearing any unnecessary e-mails. Contractors are prohibited from auto-forwarding “.mil” e-mail to a personal “.com” account.

If the “ctr.usmc.mil” e-mail account is not kept active, the G-6 will deactivate the account and CAC will lose functionality.

CACs will only be issued to contractors that have been authorized by the COR. If a contractor loses their eligibility for a CAC due to an adverse adjudicative decision, they also lose eligibility to work on MCSC contracts. CACs are not issued for convenience.

The CAC and MCTSSA access badge must be turned into the COR or MCTSSA Security representative prior to leaving the compound on the last business day of the contract, upon the expiration of the CAC, or in the event of a contractor employee resigning or being fired.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification Hide Attachment Bar

The COR must contact the Security Officer designated in Block 17 with a prime contractor name, CAGE Code and contract number as soon as possible to ensure a revised DD-254 is prepared and ready for contract award.

Camp Pendleton, CA 92055-5171 Location: I Marine Expeditionary Force 11th and C Street Camp Pendleton, CA 92055 Location: II Marine Expeditionary Force Camp Lejeune, NC 28542-0080 Location: III Marine Expeditionary Force Camp Courtney, Okinawa, Japan Location: CTF 51/5 NSA Bahrain Location: Marine Forces Europe Stuttgart, Germany Location: Marine Forces Reserve 2000 Opelousas Avenue New Orleans, LA. 70114

POP End Date (estimated:

8a. Primary place of performance shall be MCTSSA. Other locations include the three Marines Expeditionary Forces (MEFs) aboard Camps Pendleton, Lejeune, and Courtney; Marine Forces Reserve (MARFORRES) in New Orleans, LA; Marine Forces Europe/Africa (MARFOREUR/AF) in Stuttgart, Germany; and Task Force 51/5 at NSA Bahrain. Additionally, the contractor may be required to travel to various Marine Corps bases/installations located in the Continental United States (CONUS) and Outside CONUS (OCONUS) to support fleet units and/or for network traffic data collection and analysis. Contractor personnel requiring access to these facilities are required to be COMSEC/NATO briefed and hold a final U.S. Government Secret Clearance.

10a. Access to any COMSEC information requires special briefings. Access to classified COMSEC information requires a U.S. Government Secret clearance. Publishing or releasing of any COMSEC information by any means without the written approval from Communications security, NSA, Fort George G. Meade, MD 20755 via Commanding Officer, MCTSSA, is prohibited. MCTSSA Security (Electronic Key Management System (EKMS) Manager) will provide COMSEC acknowledgement form and conduct brief. Contractor will sign Contractor Acknowledgment Form.

10e. Intelligence information will be handled and controlled as indicated in DoDM 5105.21 (Vol 1-4), NAVSUP to…