Draft 254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

UNCLASSIFIED//FOUO

Contract#: FA8604-17-D-1000 Supporting SSO: NASIC

Company: Intrepid Solutions Office Symbol: NASIC/SOO

Expiration Date: 10/31/2021 Address: 4180 Watson Way WPAFB, OH 45433

SCI COR: Robert L. Bennett III Phone: (937)257-2846

Office Symbol: SCXP

Phone: (937) 522-6285

Email: robert.bennett.42@us.af.mil

ADDENDUM TO DD FORM 254 (Block 10e (1)) – Effective date: 7 March 2018

SENSITIVE COMPARTMENTED INFORMATION (SCI) CLAUSES

1. Reference Block 14: This contract requires access to Sensitive Compartmented Information (SCI).

The National Security Act of 1947, as amended; Executive Order (EO) 12333, as amended; EO 13526; EO 13549; EO 12829; EO 12968, as amended; 32 CFR Part 2001; 32 CFR Part 2003; 32 CFR Part 2004; and other applicable provisions of law; DoD Manual 5105.21 Volumes 1/2/3; AFMAN 14-304; ICD 701; ICD 702; ICD 703; ICD 704/ ICPGs 704.1, ICPG 704.2, ICPG 704.3, ICPG 704.4, ICPG 704.5, ICPG 704.6; ICD 710; ICD 705, ICS 705-1; ICD 503; provides the necessary guidance for physical, personnel, information, and information systems security measures and is part of the SCI security specifications for the contract.

2. SCI will not be released to contractor employees without the specific release approval by the originator of the material as outlined in the governing directives and based on prior approval and certification of “need-to-know” by the Contracting Officer’s Representative (COR):

Robert L. Bennett III NASIC/SCXP (937) 522-6285 robert.bennett.42@us.af.mil

3. Names of contractor personnel requiring access to SCI and justification for SCI positions will be submitted for coordination and action to the supporting SOO (above) after the Contracting Officer Representative (COR) approval/concurrence. Upon receipt of written approval from the COR, the Contractor Special Security Officer(CSSO) may submit the necessary forms to Defense Security Service (DSS) for a Single Scope Background Investigation (SSBI)/Tier 5 investigation for those personnel nominated for SCI access in accordance with the National Industrial Security Program Operating Manual (NISPOM).

4. This contract will require 4 SCI positions in order to fulfill contractual obligations incurred. SCI access is subject to US Government review and approval as outlined in the aforementioned SCI security regulations. Upon completion or cancellation of the contract, the CSSO will debrief all personnel not required for contract closeout and those positions will be disestablished.

5. The CSSO must restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract. Further dissemination to other contractors, sub-contractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the releasing agency.

6. SCI materials furnished in support of this contract remain the property of the DoD department or command that released it. Upon completion or cancellation of the contract, all SCI materials furnished will be returned to the direct custody of the originator of the materials.

7. Classified foreign intelligence materials must not be released to foreign nationals or immigrant aliens whether or not they are also consultants, US contractors, or employees of the contractor, regardless of the level of their security clearance, except with advanced written permission from the originator.

8. Inquires pertaining to classification guidance on SCI will be directed to the COR listed in above. SCI security management issues shall be directed to SOO, NASIC, phone 937-522-4962/937-257-2031.

9. Contractor personnel must maintain accountability for all intelligence (to include foreign intelligence) materials released to their custody.

10. Inquires pertaining to classification guidance on SCI will be directed to the COR listed above. SCI security management issues shall be directed to the supporting SOO, identified at the top of this document.

11. An SCI Facility (SCIF) meeting the physical security requirements outlined in ICD 705 is required for this contracting effort. All SCI used for this contract shall be stored, handled, and maintained in an accredited SCIF, be it the local contractor SCIF or a similarly SCI accredited facility used by the contractor. If the contractors place of performance is in a SCIF, if they are accessing an SCI IT system and/or generating SCI, the places of performance will be identified in the DD 254 (Version dated April 2018) item 8 and listed in this form. If SCI access is for meeting, conferences, demonstration, etc. ONLY check here

A. NASIC/SCXP:4180 Watson Way WPAFB, OH 45433;

CSSO: Alex Heredia, 703-992-0386, ext 107

12. For contract work within an approved contractor SCIF, all SCI information systems will be accredited and authorized following the Risk Management Framework (RMF), IAW ICD 503 and the ICD 503 Practitioners Manual. All SCI systems will be accredited through the Designated Authorizing Official using XACTA system. These are processed through Command ISSO/ISSM at NASIC/SCXS to the 25th AF/A6S (AF Intelligence Community –AO). Other applicable policy as directed by DIA, ODNI, or NASIC shall apply. This includes all electronic connectivity and electronic methods for storing and communicating within and outside the SCIF.

13. Other networks processing corporate unclassified, SIPRNET, or other collateral information will follow the cognizant authority policy requirements. Prior authorization by a cognizant authority must be obtained prior to operation. Non-AF SCI systems must be accredited by the designated authority and will require a CUA/JUA for operation in DIA facilities.

14. Reference Block 15: This contract requires access to SCI. If the contractor has established a SCIF, DIA and its designees are responsible for all inspections of the contractor SCIF and SCI security management program for ensuring compliance with all SCI security regulations and policies. The supporting SOO maintains security cognizance for all SCI requirements on this contract. Inspections of the SCIF(s) will be conducted by the Intelligence Community accrediting agency who approved the SCIF or delegated official. The Defense Security Service (DSS) is relieved of security oversight for SCI performance.

15 .Visits. The contractor will submit the written request for SCI visit certifications through the COR for approval of the visit. The certification must arrive at their SOO at least three working days prior to the visit.

16. This contract requires that the contractor requires courier authorization in order to transport classified materials between work locations. This authorization is based on duty locations and distance and will be processed IAWDODM 5105.21 V1. Check Here

Continuation Block:

FOR OFFICIAL USE ONLY

This document contains information exempt from mandatory disclosure under the FOIA image1.emf image2.emf

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, MAY 2019

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

20220531 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification whs.mc-alex.esd.mbx.formswebmaster@mail.mil

WHS

List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

4180 Watson Way WPAFB, OH 45433-5648 Springfield-Beckley ANG Base 101 A Avenue Springfield, OH 45502

The following Security Classification Guides are required in support of this contract:

TBD

These classification guides will be provided to the contractor by the Government Task Manager.

GENERAL GUIDANCE:

The Contractor must:

- For information system security direction, the Contractor shall comply with Director of National Intelligence issued 500- series Intelligence Community Directives, Policy Guidance, Policy Memos and Standards for SCI AIS and AFI 33-200, AFI 33-210, AFMAN 33-152, AFMAN 33-282, and AFMAN 33-285 for collateral AIS. This guidance will be used in its entirety or waivers must be obtained in writing from NASIC/SCX.

- If work under the terms of this contract requires access to NSA systems or support to a DIA mission, the contractor may be required to take a Counterintelligence (CI) polygraph test.

- Contract may require personnel to have access to NASIC during non-core duty hours, 7 days a week, as mission dictates. The COR will furnish NASIC/SOO on a case by case basis with a listing of contractor personnel who require access.

- All contractor personnel will be indoctrinated into Secret Collateral at a minimum additional clearance requirements will be required but on a case by case basis.

Ref Item 10a: Contractor will comply with AFMAN 17-1302-O, Communications Security (COMSEC) Operations, 3 Feb 17. Contractor personnel will follow the security requirements of the host government activity.

Ref item 10e. SCI work will be done in an appropriately accredited SCI facility (SCIF).

Ref Item 10e(1): Contractor requires access to SCI materials; SCI security requirements apply, see SCI addendum for details.

Ref Item 10e(2): Contractor will require access to Non-SCI intelligence information and must comply with directions provided by the Contracting Officer’s Representative (COR) in accordance with AFMAN 14-403 para 2.8.4.

Ref Blk 10f: All SAP work will be performed within approved NASIC SAP facilities (SAPF) designated by the DIA Program Security Officer. SAP material shall only be received/generated at NASIC and is not authorized for receipt/generation within contractor facilities.

Requests for SAP access will be made through the NASIC/SAPMO. SAP access requirements, personnel access controls, SAP mandated security, education, and training, reporting, records retention, etc. associated with contractor SAP performance under this contract are the responsibility of NASIC/CVX. The contractor is responsible for maintenance of personnel security clearances necessary for SAP access eligibility IAW DoDM 5205.07, Vol II. Inquiries regarding SAP classification guidance will be directed to the NASIC/SAPMO. SAP-derived material generated under this contract will be marked IAW with DoDM 5205.07, Vol IV and the Security Marking Guide for Special Access Programs, current revision. Challenges to markings will be directed to CVX for verification from OCA. SAP information furnished or generated in support of this contract remains the property of the government and will be returned to the servicing program office upon completion of this contract. All procedures, equipment, and devices used for data processing or data transfer of SAP information must be accredited (approved) by the PSO prior to any processing. Any subsequent configuration or procedural changes must be approved prior to use. The contractor will produce classified material and have access to classified data/areas within NASIC only. CVX will provide on-site security oversight for the SAP portions of the contract. Security clearance requirements for access is a final Top Secret clearance based on a SSBI/T5/T5R investigation within the last six years, per the OSD Memo entitled, "Temporary Periodicity and Clearance Submission Implementation Guidance for Special Access Programs," dtd 10 Feb 2017. SAP information is not releasable to foreign nationals. Only properly accessed (program briefed) personnel will have access to security containers and classified media containing SAP information. IF a SAP sub-contract is awarded, it is the prime contractor's responsibility to incorporate the additional security requirements in the sub-contract and get PSO signature for each sub-contract. Authority for access must be obtained from the DIA SAP Program Office when the Need-to-Know is established and required to accomplish the required efforts under the contract. DIA is the CSA for all SAPs related to this contract on WPAFB. The NASIC SAPMO is the day-to-day servicing security office. Prior approval from the PSO is required before prime contractor is permitted to flow-down SAP access and requirements.

The on-base government performance location will provide SAP security classification guidance for performance on this contract. On base performance will occur in the NASIC complex, Wright-Patterson AFB, OH. If any classified information is generated in the performance of this contract at the identified location, the contractor shall apply derivative classification and markings consistent with the source material.

DoD issuances website: http://www.esd.whs.mil/DD/

AF e-Publications website: http://www.e-publishing.af.mil/

Ref item 10g. This contract requires access to classified information or documents belonging to NATO, or containing NATO classified information. Commanders and Directors grand U.S. personnel access to NATO information based on verification of security eligibility and a need-to-know. (If there are specific levels of NATO, list the specific levels required for performance on the contract).

Prior approval of the contracting activity is required for subcontracting to impose NATO requirements or grant NATO access to a subcontractor. Access to classified NATO information requires a final U. S. government clearance at the appropriate level and a NATO access briefing/debriefing. Adhere to requirements located in AFI 16-1404 Chapter 9 for access to NATO.

Ref item 10j/11l. Controlled Unclassified Information (CUI) provided under this contract shall be safeguarded as specified in the DoDM 5200.01-V4 Item 11.

Ref item 11a. The contractor will not generate classified information. Contract performance is restricted to NASIC 4180 Watson Way WPAFB, OH 45433 including all NASIC facilities at WPAFB at buildings 4025, 4023, 280, 296, 146, 145, 4091, 4042, 856, 828, 822, 829, 858, & 859. Using activity will provide security classification guidance for performance of this contract. Security classification guidance:

TBD

AFGM to AFI 16-1406, para 3.2.4.4.

Ref item 11j/1. On base contractor employees will comply with AFI 10-701, Operations Security, available on the Air Force’s e-publishing web site at URL: http://www.e-publishing.af.mil/. They will also participate in the assigned unit’s OPSEC program, complete "Protecting Sensitive Information" (ZZ133078) a computer based training (CBT) module located on the Advanced Distributed Learning Service (ADLS) Website upon assignment and annually thereafter.

Ref item 11m. • In addition to the security guidance listed above, the following guidance is also applicable to the contract:

DoD directive 5205.07, Special Access Program (SAP) Policy, (latest version); DoD Manual (DODM) 5205.07, Volume 1, DoD Special Access Program (SAP) Security Manual; General procedures, (latest version); DoDM 5205.07, Volume 2, Special Access Program (SAP) Security Manual: Personnel Security, (latest version); DoDM 5205.07, Volume 3, DoD Special Access Program (SAP) Security Manual: Physical Security, (, incorporating Change 1, (latest version), and AFMAN 16-703, Volume 3, Special Access Program (SAP) Security Manual: Physical Security, (latest version); DoDM 5205.07, Volume 4, DoD Special Access Program (SAP) Security Manual: Marking, (latest version); DoD Instruction 5205. 11, Management, Administration, and Oversight of DoD Special Access Programs (SAPs), (latest version); DoDM 5200.01, Volume 1, DoD Information Security Program: Overview, Classification and Declassification, (latest version); DoDM 5200.01, Volume 2, DoD Information Security Program: Marking of Classified Information, (latest version), incorporating Change 2, (latest version); DoDM 5200.01, Volume 3, DoD Information Security Program: Protection of Classified Information, (latest version), Incorporating Change 2, (latest version); DoDM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI), (latest version); AF Policy Directive 16-7, Special Access Programs, (latest version); AFI 16-701, Management, administration and oversight of Special Access Programs, (latest version); DoD instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), (latest version), incorporating Change 1, (latest version); Risk Management Framework (RMF) using the Joint Special Access Program Implementation Guide (JSIG), (latest version); SAF/AAZ Memorandum, “DoD Manual 5205.07, Volume 4, (latest version); SAF/AAZ USAF Security Marking Guide for Special Access Programs, (latest version).

Ref Item 12. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the NISPOM (DoD 5220.22-M), unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases of non-SAP information shall be submitted for review and approval prior to release to the appropriate government approval authority: HQ NASIC/PA, 937-522-6600, 4180 Watson Way, Wright-Patterson AFB, OH 45433-5648. Public release of SAP related data is NOT authorized without prior coordination through DIA and subsequent approval of the Original Classification Authority (OCA) and DIA Special Access Program Central Office. Submit all proposed public disclosures related to SAP data to the Government Program Manager (GPM) and DIA Program Security Officer (PSO).

Government Special Access Program Security Officer (GSSO): TBD Program Security Officer (PSO): TBD Program Manager (GPM) and DIA Program Security Officer(PSO): TBD

The Contractor will notify the Government Contracting Activity and the Government Security Manager within 48 hours of any incident involving the actual or suspected compromise/loss of classified information to enable the Government to conduct immediate assessment of potential impact pending formal inquiry/investigation. Actual or suspected compromise of Covered Defense Information will be reported IAW DFARS Clause 252.204-7012.

Ref Blk 12:

Ref Item 12: Contractor is to submit requests through the Contracting Officer for OPSEC Program Manager review and public release authorization. The Contracting Officer will provide contractor with written approval/disapproval. Information requiring AF or DoD–level review will be reviewed by the unit’s OPSEC Program Manager or Coordinator who will in-turn forward to the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690. Transmission of public release request via e-mail is not authorized.

Ref Item 14: Contract Officer Representative (COR) TBD Ref Item 14/15/17: SSA/ISPM: NASIC/SOO, Industrial Security: 4180 Watson Way, Wright-Patterson, AFB, OH 45433-5648 Ref Item 18f:

The contractor will comply with ICS 500-18 and NASICI 33-201 for the handling of removable media within the NASIC complex.

Enter your name here.: NASIC has exclusive security responsibility for all SCI classified material released to or developed under this contract. Defense Counterintelligence and Security Agency (DCSA) is relieved of security inspection responsibility. Industrial Security Reviews/Inspections, while operating on an Air Force Installation, will be conducted by the ISPM.

DCSA has been relieved of inspection oversight responsibilities for SAP programs associated with this contract. DIA is identified as the Cognizant Security Authority (CSA) fulfilling the execution role for all contractor inspections under the purview of DIA Special Access Programs.