DD254 -Continuation Page_MX11769_17MAR22.pdf

DD Form 254 – Item 13 Continuation Solicitation Number:

Contract Number:

ALL ITEMS CHECKED YES, APPLY TO THIS EFFORT. ITEMS CHECKED NO ARE NOT APPLICABLE TO THIS EFFORT

AND REQUIREMENTS WILL NOT BE LEVIED AGAINST THE CONTRACTOR.

4. Follow-on contract - The classified portion of work has been completed on the contract cited in this item. The processing of classified will no longer be done under this contract. All classified material/information associated with this contract is authorized to be transferred to the contract number cited in Item 2a.

Remarks:

8. Actual Places of Performance: REFERENCE ITEM 8 OF DD FORM 254 FOR ACTUAL PLACES OF PERFORMANCE. SPECIFIC REMARKS REGARDING THOSE LOCATIONS ARE FOUND BELOW AND/OR PLACES OF

PERFORMANCE ARE DUPLICATED BELOW.

Remarks:

10a. COMSEC - Access to COMSEC material is required in the performance of this contract. Access to COMSEC requires a final clearance. The contractor may be authorized to receive government furnished cryptographic equipment, if a COMSEC account is required and if Item 11h of this DD Form 254 is checked. Contractor personnel are subject to The Department of Army Cryptographic Access Program (DACAP), IAW AR 380-40. The contractor shall comply with NSA/CSA Manual 3-16, AR 380-40, and the Committee of National Security Systems Instructions (CNSSI) 4001, “Control of Communications Security Material,” or other guidance provided by the central office of record. If access to COMSEC information is required at Government facilities, contractor shall adhere to the government/program COMSEC plan or guidance. Approval by the KO/COR is required prior to transporting or carrying classified COMSEC material on a cleared commercial carrier or passenger aircraft.

The government program/project manager shall designate the number of personnel requiring cryptographic (CRYPTO) access. Approval by the KO is required prior to the flow down of COMSEC requirements to any subcontractor.

Remarks:

YES NO

YES NO

YES NO

20201001

Contract Number:

10b. Restricted Data - Contractor requires access to Restricted Data per the PWS. Refer to 10 CFR 1045 “Nuclear Classification and Declassification” and Atomic Energy Act of 1954, as amended, for further information.

Approval by the KO is required prior to the flow down of Restricted Data requirements to any subcontractor.

Remarks:

10c. Critical Nuclear Weapon Design Information - Contractor requires access to Critical Nuclear Weapon Design Information (CNWDI). Special briefings and procedures are required. Approval by the KO is required prior to the flow down of CNWDI requirements to any subcontractor.

Remarks:

10d. Formerly Restricted Data - Contractor requires access to Formerly Restricted Data (FRD) per the PWS, SOW, or SOO.

Remarks:

10e(1). Sensitive Compartmented Information (SCI) - Access to Intelligence information that is Sensitive Compartmented Information (SCI) may be required in the performance of this contract. Refer to the SCI Addendum for additional guidance. Contractors are required to complete SCI training requirements through COR approved appropriate training systems/databases (e.g., Total Employee Development (TED), Security Training, Education and Professionalization (STEPP)). Only those personnel that require access to SCI information to complete their job duties will be provided SCI access. Approval by the KO is required prior to the flow down of SCI requirements to any subcontractor.

Remarks:

10e(2). Non-Sensitive Compartmented Information (Non-SCI) - Access to Intelligence information that is Non- Sensitive Compartmented Information (Non-SCI) may be required in the performance of this contract. Approval by the KO is required prior to the flow down of Non-SCI requirements to any subcontractor.

Remarks:

YES NO

YES NO

YES NO

YES NO

Contract Number:

10f. Special Access Programs - Contractor requires access to Special Access Program (SAP) Information per the PWS, SOW, or SOO. Contractor will comply with DoDM 5205.07 (Volumes 1-4), AR 380-381, and requirements and directions provided by the Program Security Officer (PSO), name and contact information found below, or successor. Approval by the KO is required prior to the flow down of SAP requirements to any subcontractor.

Requiring Activity’s (RA) PSO is required to provide the SAP Security Plan to contractors for adherence.

PSO Name (must be completed if 10f is checked YES):

PSO Contact Information (Phone and DISA Email):

Remarks:

10g. North Atlantic Treaty Organization - Contractor requires access to North Atlantic Treaty Organization (NATO) Information per the PWS requires a final clearance. Approval by the KO is required prior to the flow down of NATO requirements to any subcontractor. Refer to item 13e for NATO training guidance in Item

10h. Foreign Government Information - Contractor requires access to Foreign Government Information (FGI) per the PWS, SOW, or SOO. Access to FGI requires final clearance.

Remarks:

10i. Alternative Compensatory Control Measures - Contractor requires access to Alternative Compensatory Control Measures (ACCM) Information.

Remarks:

YES NO

YES NO

YES NO

YES NO

Remarks:

Contract Number:

10j. Controlled Unclassified Information (CUI) - Access to Controlled Unclassified Information (CUI) is required in the performance of this contract. Information designated as CUI, generated or provided under this contract shall be controlled, handled, stored, marked, safeguarded, transmitted, and destroyed IAW DoDI 5200.48, AR 380-5.

Electronically transmitted CUI shall be sent via:

o Emailing CUI between the Government and a Contractor: Digitally encrypted email can be accessed via DOD CAC or if the Contractor's company has the proper DOD-approved assurance certificates installed. For more details on DOD-approved assurance certificates visit https://public.cyber.mil/eca/.

o Government SharePoint: Contractor must have a DOD CAC and access is based on the Government's approval.

o DOD Safe (use email certification to enter site) https://safe.app.mil/ o IntelDocs - https://inteldocs.intelink.gov/inteldocs o CD/DVD: Save CUI-marked files to a CD/DVD and properly mail to recipient.

o Fax: Send CUI-marked documents via facsimile machine to recipient.

o An accredited information system with proper security controls.

The contractor may disseminate CUI information to their employees and subcontractors that have a need-to-know.

The contractor shall report the unauthorized disclosure of CUI to the COR.

Remarks:

10k. SCGS – SCGs associated with this effort are listed below by title, date, and office of primary responsibility per AR 380-49. Contractor will require access to all SCGs listed below:

Remarks: (ENTER ALL SCGs ASSOCIATED WITH THIS EFFORT BY TITLE, DATE, AND FUNCTIONAL OFFICE OF

PRIMARY RESPONSIBILITY)

1. ARCYBER SCG FOR CYBERSPACE OPERATIONS AND SECURITY, DATED 19 MAY 2016, U.S. ARMY CYBER COMMAND AND SECOND ARMY, or most current SCG.

YES NO

Contract Number:

10k. SIPRNet - Secured Internet Protocol Network (SIPRNet) access is required for the performance of the contract. Requests for access will be submitted to COR to facilitate the local vetting and approval process.

Contractor must follow appropriate processes for obtaining login credentials to SIPRNet. Contractor personnel must be cleared at the NATO SECRET level in order to obtain access to SIPRNet. If SIPRNet is required at contractor facility, contractor shall coordinate with appropriate DSS representatives. The contractor requires access to the Defense Information Systems Network (DISN) Secret Internet Protocol Routing Network (SIPRNet) dated 01 June 2013, or most current.

Remarks:

10k. JWICS - JWICS access is required for the execution of the contract. Requests for access will be submitted to COR to facilitate the vetting and approval process. Contractor must follow appropriate processes for obtaining login credentials to JWICS. Contractor personnel must be cleared at the NATO SECRET level in to obtain access to JWICS. If JWICS is required at contractor facilities, the contractor shall coordinate with the appropriate Special Security Officer (SSO) and/or Contractor Special Security Officer (CSSO). The Contractor requires access to the JWICS SCG, Defense Intelligence Agency, dated 29 September 2017, or most current.

Remarks:

10k. NSANet - NSANet access is required for the execution of the contract. Requests for access will be submitted to COR to facilitate the vetting and approval process. For access to NSANet requires final clearance. Contractor must follow appropriate processes for obtaining login credentials to NSANet.

Remarks:

YES NO

YES NO

Contract Number:

10k. Other classified IS – (Add tailored verbiage provision for using other classified IS) Remarks:

11a. Have access to classified information only at another contractor’s facility or at a government activity - The contractor shall have access to classified information only at another contractor’s facility or at a government activity. If this item is checked, than safeguarding of classified is NONE and items 11b, 11c, 11d, 11h, or 11k do not apply to this effort.

Remarks:

11b. Receive and store classified documents only - Contractor is authorized to receive classified documents only for purposes named in the remarks below. There will be no generation or derivative classification of material at the contractor facility. Special storage requirements are listed in remarks below.

Remarks:

YES NO

YES NO

Contract Number:

11c. Receive, store, and generate classified information or material - Contractor is authorized to receive, store, and generate classified material at the contractor’s facility. Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware, reference item 10k. All classified information received or generated will be properly stored and handled according to the markings on the material. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of this contract, the U.S. Government will be contacted for proper disposition instructions.

Remarks:

11d. Fabricate, modify, or store classified hardware - Contractor will fabricate, modify, or store classified hardware at their facility. A description of the area required to store such material and details regarding what the contractor will require, can be found in the remarks below.

Remarks:

11e. Perform services only - Contractor will perform services only as described in the remarks below:

Remarks:

YES NO

YES NO

Contract Number:

11f. Have access to U.S. classified information outside the U.S., Puerto Rico, U.S. Possessions, and Trust Territories - The contractor will have access to classified information at OCONUS locations. Refer to item 8a for a listing of OCONUS locations. RA is responsible for identifying security oversight for the OCONUS locations and ensuring compliance with Foreign Clearance Guide (https://www.fcg.pentagon.mil/fcg.cfm).

Remarks:

11g. Be authorized to use the services of Defense Technical Information Center (DTIC) or other secondary distribution center - The contractor will prepare DD Form 1540, Registration for Scientific and Technical Information Services and DD Form 2345, Militarily Critical Technical Data Agreement, for authorized access to Defense Technical Information Center DTIC. Completed forms will be provided to the KO/COR for processing and submission to DTIC.

Remarks:

11h. Require a COMSEC account - Contractor requires a COMSEC account. Access to COMSEC requires a final clearance. If this item is checked, then item 10a will be checked.

Remarks:

YES NO

YES NO

Contract Number:

11i. Have a TEMPEST requirement - The contractor shall submit a TEMPEST countermeasure review (TCR) worksheet to the Army certified TEMPEST technical authority (CTTA) and coordinate with their Cognizant Security Agency (CSA) for CTTA TEMPEST countermeasure implementation IAW AR 380-27, paragraph 2-6g.

Remarks:

11j. Have Operations Security (OPSEC) Requirements – (ALWAYS REQUIRED) (REQUIRED WHEN THE PLACE OF PERFORMANCE IS AT GOVERNMENT INSTALLATIONS/FACILITIES) While performing work at Government facilities, the contractors shall adhere to the OPSEC requirements IAW the OPSEC Plan/SOP listed by name and date, in the REMARKS BELOW, or its most current version. The OPSEC plan will be provided to the contractor after contract has been awarded.

and/or (REQUIRED WHEN THE PLACE OF PERFORMANCE IS AT THE CONTRACTOR’S FACILITY) If performing on contractor site, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1. The contractor shall develop an OPSEC Plan IAW AR 530-1 as listed in the PWS, SOW, and, SOO CDRL NUMBER BELOW. RA is responsible for providing to the contractor a current and valid program/command OPSEC Plan.

The contractor will use the program/command OPSEC Plan to ensure the contractor developed OPSEC Plan includes the same Critical Information List (CIL) and OPSEC measures.

Remarks: (ENTER OPSEC PLAN[S] ASSOCIATED WITH THIS EFFORT BY TITLE AND DATE)

11k. Be authorized to use Defense Courier Service (DCS) - Contractor is authorized to use Defense Courier Service (DCS). The KO/COR will obtain written approval from the United States Transportation Command’s (USTRANSCOM) Defense Courier Division (TCJ3-C), Scott AFB, IL 62225-5357. Only certain classified information qualifies for shipment by DCS. If applicable, COMSEC material will be transported via DCS as described in remarks below.

Remarks:

YES NO

YES NO

Contract Number:

11l. Receive, store, or generate CUI - Contractor is authorized to receive, store, or generate CUI in the performance of this contract. Information designated as CUI, generated under this contract shall be controlled, handled, stored, marked, safeguarded, transmitted and destroyed IAW DoDM 5200.48, AR 380-5, and the following guidance:

Electronically transmitted CUI shall be sent via:

o Emailing CUI between the Government and a Contractor: Digitally encrypted email can be accessed via DOD CAC or if the Contractor's company has the proper DOD-approved assurance certificates installed. For more details on DOD-approved assurance certificates visit https://public.cyber.mil/eca/.

o Government SharePoint: Contractor must have a DOD CAC and access is based on the Government's approval.

o DOD Safe (use email certification to enter site) - https://safe.app.mil/.

o IntelDocs - https://inteldocs.intelink.gov/inteldocs o CD/DVD: Save CUI-marked files to a CD/DVD and properly mail to recipient.

o Fax: Send CUI-marked documents via facsimile machine to recipient.

The contractor may disseminate CUI information to their employees and subcontractors that have a need-to-know.

The contractor shall report the unauthorized disclosure of CUI to the COR.

Remarks:

11m. Other/IT sensitive duties required - Refer to Item 13 for IT requirements.

Remarks:

YES NO

Contract Number:

12. Public Release - All requests for public release shall be submitted by the government COR utilizing the CECOM Public Release Approval System (PRAS) at: https://pras.army.mil/PRAS/default.asp and/or through OPSEC Officer and Public Affairs Office (PAO) identified below:

OPSEC Officer and Contact Information (include phone, email, and mailing address):

YES NO

YES NO

YES NO

YES NO

YES NO

YES NO

YES NO

PAO (include phone, email, and mailing address):

13a. Base Contract Only – Specific security requirements, e.g., SCG, place of performance, access, etc., are contingent upon each task order and shall be stipulated in the task order’s DD254.

13b. IT Levels - IT Level Designations. Contractor personnel shall be designated as IT-I IT-II or IT-III, as defined in the Traditional Security Checklist: Version 1, Release 3, Benchmark Date 15 Jun 2020, STIG ID: PE-02.02.01 at https://cyber.mil/. Contractor personnel shall obtain the appropriate security screening as prescribed in STIG PE-02.02.01 and DoD 8570.01-M (Ch4), before being granted access to DoD information technology (IT) systems that contain classified/sensitive data. Upon request by the Contractor, the Government will initiate the investigation for IT level access to DoD IT systems that contain classified/sensitive data and grant an interim IT-I or IT-II access determination investigation. Cleared contractors shall ensure all personnel are designated as IT-I, IT-II, or IT-III in the DISS/JPAS Personnel Summary. Contractor Visitor Access Requests (VARs) shall also be annotated with the appropriate IT level and appropriately cleared IAW DoDI 8500.01 and Homeland Security Presidential Directive 12 for the following investigation requirements: IT/ADP Level I- Tier 5; IT/ADP Level II- Tier 3; and IT/ADP Level III (Normal IT user)- Tier I."

13c. Spillages - Classified and covered defense information, as defined in DFARS 252.204-7012, information, will be protected IAW the NISPOM and DFARS 252.204-7012. All security and cyber incidents involving classified and covered defense information, e.g., spillage, shall be immediately reported to the RA Security Specialist and to their DSS Industrial Security Representative. A spillage occurs whenever or covered defense information is transferred onto an information system not authorized for the appropriate security level or exploited by external/malicious sources. Information will be forwarded to KO/COR and the Program Manager for a program damage assessment to be conducted IAW AR 380-49. Contractors responsible for a willful or negligent spillage of information shall pay enterprise service providers for the associated cleanup costs across the enterprise to restore the affected network or networks to a normal operating configuration.

13d. PWS, SOW, or SOO - The PWS, SOW, or SOO shall be provided to the contractor’s FSO and/or CSSO along with the DD Form 254 and associated Continuation Pages. This is to ensure that the FSO and/or CSSO are aware of all contractual requirements relating to security within the effort.

13e. NATO Awareness Briefing - All cleared contractor personnel shall obtain a NATO Security Awareness Briefing from their FSO and/or from their program security specialist. NATO Awareness Briefing can be found at the following CAC enabled link http://www.cdse.edu/documents/toolkits-fsos/NATO Brief.pdf

13f. OCONUS Travel - Contractors traveling to OCONUS locations for either official or unofficial travel may require a defensive counterintelligence briefing prior to their departure. Requirement for defensive travel brief will be based on threat and will remain at the discretion of the G2 and/or organization’s security manager.

20201001 Page 11 of 13

Contract Number:

13h. Security Trainings/Briefings - Several training requirements exist for contractor personnel per DoD and Army regulation/directives. On-site contractors may receive training briefs from the government appointed Security Manager; however, contracting companies will be required to provide training to off-site contractor employees. Training is tailored to the organization’s requirements as well as local policy. Some examples of Security training provided to integrated/embedded contractors may include, but is not limited to, the following:

Threat Awareness Reporting Program (required for all contractors with security clearances) - Per AR 381-12 Threat Awareness and Reporting Program (TARP), cleared contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b.

Initial Security Orientation: Online training available on the Army Learning Management System (ALMS) site, reference ALARACT 207-2103 - Initial training

Annual Security Orientation: Online training available on the Army Learning Management System (ALMS) site, reference ALARACT 207-2103 - Annual training requirement

Derivative Classification Training, reference DoD 5200.01-V3- Annual training requirement Foreign travel training, AR 525-13 - Required when traveling abroad Department of the Army (DA), Army Material Command (AMC), and/or commander directed security stand-downs, e.g., ad-hoc refresher trainings.

13i. Security Classification Guides - Per AR 380-49, the RA is required to identify by title, functional office of primary responsibility, and approval date, the SCGs applicable to the contract on the DD Form 254 within item

13. The requirement for SCG(s) must also be annotated on DD Form 254, block 10k. Due to the mission and its reimbursable nature, it is impossible to proactively identify all SCGs associated with contract efforts. However, upon identification, the RA shall immediately provide SCGs related to the classified information associated with the execution of this contract.

13j. Individual Courier Card - Must have a need to know and approval from the COR prior to Courier Cards being issued.

13k. Additional Remarks not already addressed in items 1a – 13i of this Security Appendix.

Remarks:

YES NO

YES NO

YES NO

YES NO

20201001

13g. Generation of classified material - The generation of classified material includes derivatively classified information. YES NO

Contract Number:

Certification and Signature (ALWAYS REQUIRED - IF SCI CONTRACT, THE SCI CONTRACT MONITOR MUST ALSO SIGN) Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official(s) named below. Signature block for COR and/or PM required.

COR SIGNATURE (ALWAYS REQUIRED)

X___________________________________________

NAME:___________________________________________

DATE:___________________________________________

TITLE:___________________________________________

EMAIL:___________________________________________

COMM:___________________________________________

CM SIGNATURE (REQUIRED ON SCI CONTRACTS)

X___________________________________________

NAME:___________________________________________

DATE:___________________________________________

TITLE:___________________________________________

EMAIL:___________________________________________

COMM:___________________________________________

Untitled

Revised 27 Dec 2017

Address / Phone Number of PR Authority

Contracting Officer or Designated Official