DD Form 254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, "DoD Contract Security Classification Specification"

Item 13 – SECURITY GUIDANCE: Collateral classified information generated in support of this contract shall be classified in accordance with the source material used or the Security Classification Guide for Lasoer Protection Material, dated 01 MAY 2013,and protected in accordance with NISP/NISPOM and 32 CFR Part 117, National Industrial Security Program (previously issued as DoD 5220.22-M), the Program Protection Plan and this DD Form 254. Unclassified information shall be protected IAW the Security Classification Guide, the OPSEC Plan, and Attachment A.

a. All classified material shall be transmitted IAW the NISP/NISPOM/NISPOM Rule (Registered US Mail, cleared commercial carrier (Monday thru Thursday), Same Day Delivery, or secure fax.

b. Access to technical data by foreign interests is prohibited unless authorized by a valid export authorization which must be obtained by the contractor.

c. The following attachments are made part of this DD Form 254:

(1) Attachment A – Guidelines for the Controlled Unclassified Information (Item 10.j. and 11.l.)

(2) Attachment B – This attachment is not applicable and intentionally left blank

(3) Attachment C – Guidelines for OPERATIONS SECURITY (OPSEC) (11.j)

(4) Attachment D – This attachment is not applicable and intentionally left blank

CUI and OPSEC requirements shall be flowed down to all U.S. subcontractors (including unclassified U.S. subcontractors) as an integral part of their respective contracts.

d. UPON COMPLETION OF CONTRACT OR AT GOVERNMENT DIRECTION: All classified (SECRET), or CUI material (documents, media, hardware, software, vehicles, etc.) supplied to the contractor, or generated or derived from the CUI material supplied to the contractor, during the course of this contract shall be destroyed in accordance with NISP/NISPOM and 32 CFR Part 117 NISPOM Rule (previously issued as DoD 5220.22-M) and DoDI 5200.48. If the contractor cannot destroy the information, the contractor shall return these items to Government Security Manager for destruction no later than one year after completion of contract, or at an earlier date if directed by the Government. Contractors wishing to maintain the material for a longer period must receive permission from the Contracting Officer.

e. Foreign Disclosure:

1. In no instance will Classified Military Information (CMI) be disclosed to transmit to other than authorized representatives of the foreign government or international organizations for which disclosure has been approved.

2. Disclosure of CMI is determined by Department of Army officials designated as disclosure authorities. CMI disclosures must be limited to that information authorized to be disclosed to accomplish the purpose of the visit.

3. Foreign Disclosure Officer for TACOM can be contacted at (586) 282-6262.

f. Notification of loss or compromise of collateral classified information shall be provided to the Government Security Manager within 72 hours of the incident, in addition to the reporting requirements outlined in the NISP/NISPOM/NISPOM Rule.

Item 10.j – CONTROLLED UNCLASSIFIED INFORMATION (CUI): CUI generated and/or provided under this contract shall be safeguarded and marked as specified in additional Guidelines for Controlled Unclassified Information (CUI) (Attachment A).

Item 11.b – RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY: Contractor will receive and store classified documents for reference only. However, if any classified information is generated in performance of this contract, it shall be derivatively classified and marked consistent with the source material.

a. Employees of the contractor may not act as couriers for classified material. All classified material will be transmitted in accordance with (IAW) the NISP/NISPOM/NISPOM Rule (Registered US Mail, cleared commercial carrier (Monday thru Thursday), same day delivery, SIPRNET, or secure fax. This applies only to and from TACOM and the contractor’s office.

b. All classified material (SECRET) supplied to the contractor during the course of this contract will be turned into Government Security Manager for destruction not later than one year after receipt. Contractors willing to maintain the material for a longer period must receive permission from the Government Security Manager.

c. Contractors are required to establish means to control classified information. This will include maintaining receipts, i.e. Document Accountability (DA) 3964, of all classified material shipped or received that is associated with this contract number.

d. General Services Administration (GSA) approved security containers are required to store classified material. Contractors will ensure all personnel who perform maintenance on any security container storing classified information are cleared to the SECRET level.

e. Any contractor who wishes to hold meetings in which classified information will be discussed are required to do so either on federal installations or a cleared facility. They should contact the Government Security Manager for approval of meeting locations.

f. In the event of a possible compromise of classified information under the control of the vendor, the vendor will immediately notify the Defense Counterintelligence and Security Agency (DCSA); and TACOM (586-282-6262, MAIL: TACOM Security Manager, U.S. Army TACOM, G-2, 651 E. 11 Mile Rd, Bldg 233/MS-105, Detroit Arsenal, MI 48397-5000).

g. All classified material received will be handled and stored IAW with the NISP/NISPOM/NISPOM Rule. Any computer used by the contractor to process classified information must have written accreditation. The contractor shall obtain accreditation from the DCSA Cognizant Security Office. The contractor must provide a copy of their accreditation certificate from DCSA to the TACOM Security Manager prior to processing any classified information. All computers will be marked with the appropriate visual markings showing what level of classified information may be processed on the computer. All storage media will be marked to reflect the highest classification level of the system accreditation irrespective of what is saved on the storage device.

h. When processing classified information on a computer, the contractor will ensure he or she does so in a secure environment. Continuous supervision will be required to ensure inadvertent access to classified does not occur. All personnel with access to the computer must have a SECRET clearance and a need to know.

i. Cell phones, Fit-Bits Wireless Communitation Devices, etc., will not be operated in areas approved for classified computer processing.

Item 11.j – OPERATIONS SECURITY (OPSEC) REQUIREMENTS: The contractor shall follow the TACOM OPSEC Plan, dated 6 MAR 2020, as well as annexes and updates. The contractor is not required to develop their own OPSEC Plan. All U.S. contractors shall provide annual Program specific OPSEC training for all Program personnel. New Program personnel shall receive OPSEC training within 30 days of Program assignment. Annually, contractors shall complete OPSEC training and submit a report, validating 100% completion to the Government Security Office by 30 September. These requirements, OPSEC Plan and training, shall be flowed down to all U.S. subcontractors with access to CUI and/or classified material. See (Attachment C).

Item 11.l – CONTROLLED UNCLASSIFIED INFORMATION (CUI): CUI generated and/or provided under this contract shall be safeguarded and marked as specified in additional Guidelines for Controlled Unclassified Information (CUI) (Attachment A).

Item 11.m.(2) – THREAT AWARENESS AND REPORTING REQUIREMENTS: IAW NISP/NISPOM/NISPOM Rule, the contractor shall report threat-related incidents, behavioral indicators, and other matters of counterintelligence (CI) interest specified in AR 381-12, Chapter 3, through the facility security officer to the government security manager, the nearest military CI office, the Federal Bureau of Investigation, and the Defense Counterintelligence and Security Agency. Annually, train personnel who handle classified information IAW AR 381-12, Chapter 2.

The contracting officers or contracting officer representatives will ensure Army contractors with security clearances comply with threat awareness and reporting requirements specified by AR 381-12 (Threat Awareness and Reporting Program). All contractor employees with security clearances working on any Army contract MUST receive annual TARP training by a Counter Intelligence (CI) agent, or other authorized designated training method, per Army Regulation 381-12, para. 2-4b. Persons employed by Army contractors will report threat-related incidents: indicators of espionage, potential terrorist-associated insider threats and / or extremist activity that may pose a threat to DoD and other matters of CI interest specified in chapter 3 of AR 381-12, to the facility security officer, the nearest military CI office, the Federal Bureau of Investigation, or the Defense Counterintelligence and Security Agency. The NISP/NISPOM/NISPOM Rule requires contractors to promptly report to the Federal Bureau of Investigation (FBI), information coming to the contractor's attention concerning "actual, probable or possible espionage, sabotage, terrorism, or subversive activities" at any of the contractor's locations. Contractors will also notify TACOM security office. Initial reports may be done over the phone but must be followed up with a written report with 15 days of the incident coming to light.

Insider Threat Program:

a. The contractor will establish and maintain an insider threat program that will gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O. 13587 (reference (ac) and the National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs (reference (ad), as required by the appropriate CSA. The Insider Threat Program Senior Official must always be cleared to the level of the FCL.

b. The contractor will designate a U.S. citizen employee, who is a senior official and cleared in connection with the FCL, to establish and execute an insider threat program. This Insider Threat Program Senior Official may also serve as the FSO. If the designated senior official is not also the FSO, the contractor's Insider Threat Program Senior Official will assure that the FSO is an integral member of the contractor's implementation program for an insider threat program.

c. A corporate family may choose to establish a corporate-wide insider threat program with one senior official designated to establish and execute the program. Each cleared legal entity using the corporate-wide Insider Threat Program Senior Official must separately designate that person as the Insider Threat Program Senior Official for that legal entity.

d. All cleared employees must be provided insider threat awareness training before being granted access to classified information, and annually thereafter. Training will address current and potential threats in the work and personal environment and will include at a minimum:

(1) The importance of detecting potential insider threats by cleared employees and reporting suspected activity to the insider threat program designee.

(2) Methodologies of adversaries to recruit trusted insiders and collect classified information, in particular within ISs.

(3) Indicators of insider threat behavior, and procedures to report such behavior.

(4) Counterintelligence and security reporting requirements, as applicable.

The contractor will establish and maintain a record of all cleared employees who have completed the initial and annual insider threat training. Depending on CSA-specific guidance, a CSA may, instead, conduct such training and retain the records."

Block 14 – ADDITIONAL SECURITY REQUIREMENTS: Prior approval of the contracting officer is required before the prime contractor can impose any additional security requirements. Any additional security requirements imposed by this 254 or contact will be agreed upon prior to contact implementation.

Block 15 – INSPECTIONS: The Defense Counterintelligence and Security Agency(DCSA) has cognizance over this contract. The Government Security Manager reserves the right to inspect compliance with the DD254, the OPSEC Plan, the PPP and Guidelines for CUI.:

In accordance with AR 380-49, AR 380-67, AR 25-2, current DCSA, and TACOM security policy, when a SECRET SSBI is required the sponsoring Army activity will initiate the investigation, as the government is responsible for submitting the individual for the SSBI via PSIP and indicating the investigation request for IT I. The contractor FSO will be responsible for requesting secret eligibility based on the completed SSBI via the DOD CAF-Industrial via DISS/JPAS once the investigation is completed. The FSO can also use a copy of the SF 86 once completed to request interim secret via their normal procedures.

DISTRIBTUION STATEMENTS: All unclassified technical documents containing CUI or critical technology generated in connection with this contract will be marked IAW DoDI 5230.24 or DoDI 5200.48. Examples of technical data include: research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software.

EXPORT CONTROLLED TECHNICAL DATA: The contractor shall comply with all applicable laws and regulations regarding export-controlled items. IAW DoDI 5230.24, all printed and electronic, including digital, technical documents that are determined to contain export-controlled technical data shall be marked:

"WARNING - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq) or the Export Administration Act of 1979, as amended (Title 50, U.S.C., App 2401 et seq). Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DOD Directive 5230.25."

All of the above security requirements will flow down to any subcontractors supporting this contract on a need to know basis. The contractor shall ensure that DoD and U.S. Army security requirements, to include the appropriate SCG(s), are flowed down to their subcontractors who are involved in this effort.

The contractor will be required to transmit and receive CUI and/or (U//FOUO) information electronically over the Internet (email) ensuring it is encrypted by FIPS 140-2 standard. Alternative dissemination methods include: secure fax; US mail; and hand carrying CUI and/or U//FOUO material. CUI and/or U//FOUO information may be disseminated by vendor's internal computer network if it is protected with a firewall and individual access is controlled by using IDs and passwords, and employees with access are U.S. citizens or permanent resident aliens to the United States.

ECA Certificates are obtained directly from the vendors. You may purchase an ECA Certificate from one of the approved vendors below:

(1) Operational Research Consultants, Inc. (ORC) http://www.eca.orc.com/ Email: ecahelp@orc.com Phone: 800.816.5548

(2) Symantec, Inc. http://www.symantec.com/theme.jsp?themeid=eca-certificates Email: http://www.symantec.com/page.jsp?id=eca-certificates Phone: 866.202.5570

(3) IdenTrust, Inc. http://www.identrust.com/certificates/eca/index.html Email: helpdesk@identrust.com Phone: 888.882.1104

ATTACHMENT A

ADDITIONAL GUIDELINES FOR CONTROLLED UNCLASSIFIED INFORMATION (CUI)

General: There are types of information that are not classified but that require application of access and distribution controls and protective measures for a variety of reasons. This information is known as “controlled unclassified information (CUI).” The types of information considered CUI are U.S. Government technical information and information listed at the CUI registry (https://www.archives.gov/cui/registry/category-list). When handling CUI material, all personnel are to comply with these requirements and follow their company policy and/or applicable Non-Disclosure Agreement (NDA) concerning the protection of proprietary information in situations not clearly stated herein.

Technical Information Description: Any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process, or can be used to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media (e.g., computer software, drawings, or photographs), text in specifications, related performance or design documents, or computer printouts. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation.

CUI Information Description: Unclassified Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide or “LRGWP” policies but is not classified under EO 13526, (Classified National Security Information).

CUI Markings All documents containing CUI will carry the CUI markings in accordance with DoDI 5200.48. Discontinue all use of legacy or other markings not permitted or included in either the CUI Registry or DoDI 5200.48. Marking of Technical Information will include the statement provided in the Security Classification Guide. If the contents of the technical document require more than one Distribution Statement, apply the most restrictive statement. This does not preclude additional mandated markings as may be required by the contract.

Protection of CUI Information Access: CUI may be released only to an individual who has a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. Further dissemination of such information will be at the discretion of the Government Security Manager. All personnel supporting this contract shall sign a CUI Non- disclosure Agreement prior to gaining access to the information. Personnel no longer requiring access to CUI must dispose (see “Disposal” below) or surrender any in their possession and terminate future access to it.

Storing/Handling: During working hours, take reasonable steps to minimize risk of access to CUI by unauthorized personnel. After working hours, when not in physical possession of the owner, all CUI (whether hardcopy or optical media (e.g., DVDs, CDs) that contain CUI) must be afforded a reasonable degree of physical protection to prevent theft of program information (e.g., store CUI information in locked desks or file cabinets, locked rooms, cable lock laptops, storing in a trunk, storing out of site or similar means). Do not display CUI in public places (e.g., airports, airplanes, restaurants). Electronic storing and processing of CUI shall be in accordance with DFARS 252.204-7012 Safeguarding Controlled Defense Information and Cyber Incident Reporting. Do not process CUI on public computers (e.g., those available for use by the general public in kiosks, hotel business centers), public wireless networks or computers that do not have access control. Personally owned computers and personally owned devices are not authorized to process CUI. Portable electronic devices (e.g., smartphones, laptop computers, tablets), non- portable computers, and removable media (e.g., external hard drives, flash drives, USB drives; not including optical media) must be physically and electronically protected as described in this instruction, DFARS 252.204-7012 and DoDI 8582.01.

Dissemination: CUI printed documents and material may be transmitted through mail channels, commercial carrier or hand-carried without formal courier orders. CUI information may be disseminated to DoD personnel and DoD contractors to conduct official business for the program. If dissemination is required outside of DoD personnel or DoD contractors, contact the Government Security Manager for approval. Technical information will follow the release instructions identified in the Distribution Statement. Use secure communications whenever possible; howeve, land-line telephones are more secure than cellular telephones and should be used whenever available for discussions involving CUI. Transmit voice and facsimile transmissions only when you have a reasonable assurance that only authorized recipients will have access to the transmission. Digital transmission shall comply with the below:

All transmission and/or dissemination of CUI (i.e., email and file transfers) must use NIST/NIAP-approved cryptographic products/algorithms, e.g., DoD-approved Public Key Infrastructure Certification or DoD Safe Exchange at https://safe.apps.mil/. These are available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm. This encryption requirement includes communications that contain passcodes to teleconferences or web conferences where there is a reasonable expectation that CUI may be discussed. When encryption is not available, a government collaborative suite (aka Integrated Digital Environment [IDE]) must be used to transmit CUI.

• Contractor-hosted collaborative suites may be used for digital transmission and/or dissemination of CUI by personnel not located on a government backbone (e.g., NIPRNET), provided the following conditions apply: 1) Use only NIST/NIAP-approved cryptographic products/algorithms. The latest validation lists may be obtained at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm; and, 2) Use an internally hosted service that does not use a third-party collaborative suite service provider.

• Do not post CUI to web pages that are publicly available or have access limited only by domain/IP restrictions. As permitted by other contract provisions, CUI may be posted to web pages that control access through the use of a DoD approved Public Key Infrastructure Certification and that provide protection via use of secure sockets, or other equivalent technologies. These are available at http://iase.disa.mil/pki/eca.

• As new technologies become available in the electronics arena, care should be given to providing a reasonable degree of protection from known vulnerabilities.

• The Internet is “Public Access”. CUI must be reviewed and officially approved by the TACOM Public Affairs Officer for public release before placing on the Internet. This is not applicable when the Internet is used for e-mail transmissions and encryption is used as noted above.

Disposal: The contractor shall ensure any covered defense information provided by the Government under this contract is destroyed or sanitized from contractor-owned media and reported in accordance with NIST Special Publication (SP) 800-88, Rev 1, Guidelines for Media Sanitization , December 2014, and in accordance with Section 2002.14 of Title 32, CFR. Destroy CUI documents may be destroyed by means approved for classified information or by any other means making it unreadable, indecipherable, and unrecoverable.

Report of Loss of CUI: Report any loss of CUI to the Government Security Manager. Initial reports shall be made as expeditiously as possible in all cases within 72 hours of discovery. If additional information is required after submission and review of the initial report, guidance will be provided at that time. Initial report content shall include the following information as available.

• Applicable dates, including dates of compromise and dates of discovery

• Threat methodology, including all known resources used (e.g. IP addresses, domain names, software tools)

• Account of what actions the threat(s) may have taken on victim system/network

• What information may have been compromised or lost, and its potential impact on government programs

ATTACHMENT B

This section left blank intentionally – N/A

ATTACHMENT C

OPERATIONS SECURITY (OPSEC)

1. If the contractor generates unclassified OPSEC sensitive information, this information will be protected at the same level as CUI information. The contractor will not transmit any OPSEC sensitive information electronically over the Internet unless it is encrypted IAW FIPS 140-2 standard. Alternative dissemination methods include secure fax, US mail, and hand carrying OPSEC sensitive material. OPSEC sensitive information may be disseminated within the contractor’s internal computer network if it is protected with a firewall and individual access is controlled by using IDs and passwords. (Under no circumstances can classified information be transmitted over an unclassified network.)

2. Because of antiterrorism, force protection, OPSEC, and counterintelligence concerns, the contractor will not release any diagrams, maps, floor plans, schematics, or digital pictures of the installation to outside organizations or companies without the approval of the Contracting Officer Representative (COR) and TACOM Security Office. All information proposed for public release in any form (video, pictures, article, brochure, web site, etc.) will undergo a TACOM OPSEC Review using the most current and approved STA Form 7114.

3. Examples of information that would be considered OPSEC sensitive: Equipment capabilities, limitations, and vulnerabilities; Detailed mission statements; Operation schedules; Readiness and vulnerability assessments; Test locations and dates; Inventory charts and reports; Detailed budget data; Photographs of components; Detailed organizational charts (with phones and e-mail listings); Technical and scientific data; Unclassified technical data with military applications; Critical maintenance information; Information extracted from a DoD Intranet web site; Lessons learned that could reveal sensitive military operations, exercises, or vulnerabilities; Logistics support (munitions, weapons, movement); Specific real time support to current or on-going military operations; Delivery schedules; and Manufacturing methods.

4. OPSEC review requests should be sent via encrypted e-mail or U.S. mail (if preferred) to the respective Program Security Manager. Contact information can be requested from the COR. If emails cannot be encrypted, please send OPSEC review requests to:

a. TACOM Security Manager U.S. Army TACOM G-2 6501 E. 11 Mile Rd Bldg 233/MS-105 Detroit Arsenal, MI 48397-5000

ATTACHMENT D: INTELLIGENCE INFORMATION: NON-SCI

This section left blank intentionally – N/A

Bldg 233, MS-105 Detroit Arsenal, MI 48397-5000 Enter address (include zip code).: 6501 E. 11 Mile Road Bldg 233, MS-105 Detroit Arsenal, MI 48397-5000