DAtch04AppDDD254wAdd 1 .pdf

Solicitation FA0021-15-R-0004 3 Nov 2014

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

TOP SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYMMDD) tbd

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs) Revision No.

Date (YYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYMMDD)

FA0021-15-R-0004 tbd

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under FA0021-09-D-0001/0002/0003 (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code) To be completed by Contractor

To be completed by Contractor – Full Defense Security Services (DSS) Address

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code) Hurlburt Field, FL, and/or other locations as required by specific task orders under this contract.

N/A See Block/Item 15 of this form

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

SETA IV Contract Support at Hurlburt Field, Florida. Specific security requirements will be made known at the task order level. The basic contract-level DD254 is provided for information only for the purpose of offerors under referenced solicitation.

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR’S

FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify).

k. OTHER Specify)

Automated Information Systems NIPRNET and SIPRNET

Automated DD 254 (Dec 99)

Attachment 4, Appendix D (Page 1 of 2)

Solicitation FA0021-15-R-0004 3 Nov 2014

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

Direct

Through (Specify):

None authorized. No release is authorized for SCO.

Contractor shall obtain Contracting Officer approval IAW DFARS 252.204-7000 for unclassified information release. All released shall be coordinated with the HQ AFSOC Public Affairs Office at Hurlburt Field, FL.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.

1. Supported USAF organizations will provide security classification guides and other classification guidance to the contractor as required for contract performance. Contractors will comply with all Hurlburt Field, supported unit and special program requirements. Supported units will provide security requirements and instructions, and will include contractors in the unit Information Security program.

2. Classified markings on all working, draft, and final copies of deliverable material shall be in accordance with Executive Order 12958, The Controlled Access Program Coordination Office (CAPCO) guidelines, DOD 5220.22-M, DoD 5200.1R and applicable instructions contained in the respective security classification guides.

3. For on-base contractors, the NISPOM security standards can be satisfied by incorporating AFI 31-401, Information Security Program Management requirements into the Visitor Group Security Agreement.

4. All classified material provided shall be returned by the contractor at contract completion. Individuals are responsible for safeguarding classified information entrusted to them.

5. Use only AF-certified AIS for performance on base and comply with all AF AIS procedures.

BLOCKS 10, 11, AND 13: SEE ATTACHED DD FORM 254 ADDENDA FOR SECURITY REQUIREMENTS. THE SECURITY LEVEL DETERMINES THE SECURITY REQUIREMENTS. APPROPRIATE GUIDANCE WILL BE GIVEN

AT THE TASK ORDER LEVEL.

Hurlburt Field Servicing Security Agency:

1 SOW/IPC, 521 Cody Avenue (Bldg 90210), Hurlburt Field, FL 32544-5400 Telephone: 850-884-5143

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office.

Use Item 13 if additional space is needed.)

Yes No

Provide the information requested by the Notification of Government Security Activity clause and Visitor Group Security Agreements Clause, AFFARS 5352.204-9000, to the Servicing Security Activity indicated in Item 13 above. Refer to the contract document for these clauses. The visitor group will operate per DoD 5200.1-R, AFI 31-401, AFI 31-601, Hurlburt Field supplements and unit security program operating instructions, plans and procedures.

APPROPRIATE GUIDANCE WITH BE IDENTIFIED AT THE TASK ORDER LEVEL.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

Long term visitor groups will be inspected as part of the supported organizations annual Information Security Program Review, conducted by the SSA, while operating on an Air Force Installation. The contractor will comply with the visitor group security agreement provided by the USAF Program/Project Manager at the performance location. The above does not apply to intelligence, SCI and SAP. APPROPRIATE GUIDANCE WITH BE IDENTIFIED AT THE TASK ORDER LEVEL.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

MARTIN MUNIZ, Major, USAF

b. TITLE

Contracting Officer

c. TELEPHONE (Include Area Code)

850-884-4770

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

427 Cody Avenue, Bldg 90333 Hurlburt Field, FL 32544-5407

X

a. CONTRACTOR

b. SUBCONTRACTOR

X

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY 1 SOW/IPC

Automated DD 254 (Dec 99)

Attachment 4, Appendix D (Page 2 of 2)

Solicitation FA0021-14-R-0007 15 May 2014

ADDENDUM #1

DD FORM 254 (BLOCK 10a)

COMSEC

(Updated Jan 07)

1. COMSEC material/information may not be released to DoD contractors without Air Force Cryptological Support Center (AFCSC) approval. Contractors will forward requests for COMSEC to the COMSEC officer through the CAASETA program office. The contractor is governed by AFKAG-1, AFKAG-2, and appropriate Air Force Security Instructions/Manuals (AFSSI/AFSSM) or Air Force Instructions (AFI). Access to COMSEC material or information is restricted to US citizens holding final U.S. Government clearances and is not releasable to personnel holding only a reciprocal clearance. Personnel requiring COMSEC access will be briefed in accordance with AFI 33-201 volumes 2 and 9 (COMSEC User Requirements). The Air Force program/project manager will designate the number of personnel requiring COMSEC access. The number will be limited to the minimum necessary and will be on a strict need-to-know basis. If contractor is working within a squadron/unit, the contractor will go through the squadron/units’ COMSEC Responsible Officer for the use of COMSEC.

2. IN PERFORMING THIS CONTRACT::

a. Contractor may be required to provide storage for classified hardware to the level of Top Secret. The contractor will follow all instructions from AF AFIs, AFSSIs, AFSSMs, and AFKAGs.

b. A COMSEC account will be established, if necessary, and COMSEC will be protected per DoD 5220.22-S.

c. See AFI 33-203 volumes 1 and 3, The Air Force Emission Security Program, for additional guidance and requirements.

3. The contractor is authorized to use the services of DCS if they have acquired an account through AFCSC. The contracting activity must request DCS services from the Commander, Defense Courier Service, ATTN Operations Division, Ft George G. Meade, MD, 20755. Only certain classified information qualifies for shipment by DCS. It is the responsibility of the contracting activity to comply with DCS policy and procedures. If the contractor is working/receiving COMSEC material through a squadron/unit, the squadron/unit will process their needs through

DCS.

Addendum #1 to DD254, Attachment 4, Appendix D

ADDENDUM #2

DD FORM 254 (Blocks 10.e.(1) and 10.e.(2) (When item 10.e(1) and/or 10.e.(2) are(is) checked “YES”)

INTELLIGENCE INFORMATION

ITEM 12: (When item 10.e(1) and/or 10.e.(2) are checked “YES”)

If either Item 10.e.(1) or Item 10.e.(2) are marked “YES,” (i.e., “SCI” or “Non-SCI Intelligence” is involved in the contract), Item 12 must be marked “THROUGH” and the following additional addressees entered:

HQ AFSOC/A2S

100 Bartley Street 212 South Hurlburt Field, FL 32544-5273

AF/A2S

240 Luke Avenue Bolling AFB, DC 20032-5114

In addition, include the following statement in Item 12:

“PUBLIC RELEASE OF SCI AND / OR NON-SCI INTELLIGENCE INFORMATION IS PROHIBITED.”

ITEM 13: (When item 10.e(1) and/or 10.e.(2) are checked “YES”)

Contractor is prohibited from using references to SCI accesses, even by unclassified acronyms, in advertising or recruitment media or on the company website without specific, case-by-case approval by SSO AFSOC. (Refer to DCID 6/1, paragraph 7.1)

When required, the contractor will derivatively classify documents created in the course of this contract using the procedures and criteria defined in Executive Order 12958, Classified National Security Information, (EO 12958) as amended and Information Security Oversight Office Implementing Directive No. 1. Requests for original classification of intelligence information at any classification level or within any compartment will be referred to the AFSOC Special Security Officer (SSO AFSOC) at HQ AFSOC/A2S. Requests for classification not involving SCI or intelligence will be referred to the AFSOC Security Forces office via the Contracting Officer’s Representative

(COR).

When the contractor creates a classified document from extant classified documents, the contractor will incorporate into the finished product a list of all sources used and will apply required security classification markings and handling / control / dissemination / declassification caveats to all working, draft and final copies of classified documents in accordance with the following documents:

• Executive Order 12958, as amended;

• Information Security Oversight Office Implementing Directive No. 1 (Effective September 22, 2003)

• The Intelligence Community Classification and Control Markings Implementation Manual, (U/FOUO), with its classified Appendix (CONFIDENTIAL//Rel To USA, AUS, CAN, GBR) as required

• The Authorized Classification and Control Markings Register, (U/FOUO), with its classified Annex

(SECRET//Rel To USA, AUS, CAN, GBR) as required

• Air Force Instruction 31-401 Information Security Program Management

• Information Security Program, DoD 5200.1-R

• The National Industrial Security Program Operating Manual (NISPOM) (February 2006), DoD 5220.22-

M, its supplement and the Department of Defense Overprint to the NISPOM Supplement, as appropriate.

NOTE: As of 30 May 2006, it is Air Force policy to use the standardized security markings guidelines provided in references 12 and 13 listed below. THIS POLICY APPLIES TO ALL CLASSIFIED

MATERIAL (DOCUMENTS, PRESENTATIONS, ETC.) GENERATED IN, BY AND FOR THE

AIR FORCE. Contractors are required to comply with this policy change.

The responsible office for this information is AFSOC/A2S. The information is current as of 7 January 2009.

Earlier versions of this document should not be used to prepare new contracts.

Addendum #2 to DD254, Attachment 4, Appendix D

Data storage media in any form become the property of the U.S. Government whenever classified information is placed thereon. Erasure, “wiping” of the data or reformatting of the media does not change this requirement and does not declassify the media.

Contractor will not sanitize or decompartment any SCI or intelligence. If the contractor believes fulfillment of this contract requires sanitization of SCI or decompartmentation of intelligence, the information will be forwarded to

SSO AFSOC.

Access to, discussion of, use of, handling, maintenance and/or storage of SCI is limited to government-owned or government-controlled Sensitive Compartmented Information Facilities (SCIF) unless approved in writing by SSO

AFSOC.

The SSO AFSOC is the final authority regarding issues of security, classification, dissemination or any other matter involving SCI or intelligence. Unresolved SCI or intelligence information security issues shall be directed to HQ AFSOC/A2S (SSO AFSOC), phone (850) 884-6689 (DSN 579). Similar issues involving other classified information will be referred to the COR.

A co-utilization agreement as required by DoD 5105.21-M-1, Chapter 5, Paragraph C, will be completed and signed if any Special Access Program material or information is stored within any SCIF. The agreement will comply with the requirements in DoD 5105.21-M-1, Chapter 5.C. and AFM 14-304, Chapter 5. If the SSO with security cognizance over the SCIF concerned is not SSO AFSOC, a copy of the agreement will be provided to SSO AFSOC by the SSO concerned.

References. (If newer editions are published after award of the contract, the contractor will utilize the most recent edition of these documents):

1. Executive Order 12958, as amended. Classified National Security Information, (March 25, 2003)

2. Director of Central Intelligence Directive 6/1 Security Policy for Sensitive Compartmented Information and Security Policy Manual (1 March 1995 / 23 December 2002)

3. Director of Central Intelligence Directive 6/3 Protecting Sensitive Compartmented Information Within Information Systems (May 1, 2003)

4. Intelligence Community Directive Number 704, Personnel Security Standards and Procedures for Access to Sensitive Compartmented Information and Other Controlled Access Program Information (Replaced DCID 6/4 on 1 October 2008)

5. Intelligence Community Policy Guidance Number 704.1, Personnel Security Investigative Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information (Replaced DCID 6/4, Annex A on 2 October 2008)

6. Intelligence Community Policy Guidance Number 704.2, Personnel Security Adjudicative Guidelines for Determining Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information (Replaced DCID 6/4, Annex C on 2 October 2008)

7. Intelligence Community Policy Guidance Number 704.3, Denial or Revocation of Access to Sensitive Compartmented Information, Other Controlled Access Program Information, and Appeals Processes (Replaced DCID 6/4, Annex D on 2 October 2008)

8. Director of Central Intelligence Directive 6/5 Policy for Protection of Certain non-SCI Sources and Methods Information (SAMI)(February 12, 2001)

The responsible office for this information is AFSOC/A2S. The information is current as of 7 January 2009.

9. Director of Central Intelligence Directive 6/6 Security Controls on the Dissemination of Intelligence Information (11 July 2001 / 3 May 2002)(Classified SECRET/NOFORN)

10. Director of Central Intelligence Directive 6/9 Physical Security Standards for Sensitive Compartmented Information Facilities (December 17, 2002) as amended by Intelligence Community Policy Memoranda 2005-700- 1, 2006-700-7 and 2007-700-2.

11. Information Security Oversight Office Implementing Directive No. 1 (Effective September 22, 2003)

12. The Intelligence Community Classification and Control Markings Implementation Manual, (U/FOUO), with its classified Appendix (CONFIDENTIAL//Rel To USA, AUS, CAN, GBR) as required

13. The Authorized Classification and Control Markings Register, (U/FOUO), with its classified Annex (SECRET//Rel To USA, AUS, CAN, GBR) as required

14. Department of Defense Manual 5105.21-M-1 Sensitive Compartmented Information Administrative Security Manual (August 1998) (DoD 5105.21-M-1) (For Official Use Only)

15. Department of Defense Manual 5220.22-M National Industrial Security Program Operating Manual, February

16. Joint DoDIIS Cryptologic SCI Information Systems Security Standards (JDCSISSS)(For Official Use Only)

17. Air Force Instruction 14-302 Control, Protection, And Dissemination Of Sensitive Compartmented Information (18 January 1994)

18. Air Force Instruction 14-303 Release of Intelligence to U.S. Contractors (1 April 1999)

19. Air Force Manual 14-304 The Security, Use and Dissemination of Sensitive Compartmented Information (1 May 99) (For Official Use Only)

20. Signals Intelligence Security Regulation, 26 May 99 (SECRET//COMINT)

21. National Geospatial-Intelligence Agency Imagery Policy Series, February 2004 (SECRET//NOFORN).

22. AFSOC Instruction 33-202, Portable Electronic Device (PED) Security

The responsible office for this information is AFSOC/A2S. The information is current as of 7 January 2009.

ITEM 14: (When item 10.e(1) and/or 10.e.(2) are checked “YES”)

Automated Information Systems used to process Sensitive Compartmented Information (SCI) will comply with the Joint DoDIIS/Cryptologic SCI Information Systems Security Standards (JDCSISSS) and the references listed in Appendix A of that document. In no case will the contractor process SCI on non-government-owned AIS or on government-owned AIS without written permission from a government agency authorized to issue approval to operate such equipment. The AFSOC SSO is the final authority regarding questions of AIS security for systems processing SCI and/or intelligence information.

Contractor will / will not require access to the NIPRNET.

Contractor will / will not require access to the SIPRNET.

Contractor will / will not require access to the JDISS/JWICS networks.

The contractor will notify the SSO AFSOC immediately upon receiving “reportable information” or knowledge of reportable information involving any SCI-indoctrinated employees assigned to work on this contract. “Reportable information” is defined as any change in personal status which could affect continuing eligibility for access to SCI.

Refer to Paragraph L, Chapter 2 of Department of Defense Manual 5105.21-M-1 Sensitive Compartmented Information Administrative Security Manual (August 1998)(For Official Use Only) and Paragraph 2.7 in Air Force Manual 14-304 The Security, Use and Dissemination of Sensitive Compartmented Information (1 May 99) (For Official Use Only) . Some examples (not all-inclusive) of reportable information are:

• Death, capture or the unexplained absence (over 24 hours) of any SCI-indoctrinated person (military, U.S.

Government civilian employee, contractor)

• Intent to marry or cohabit (i.e., establish a “spouse-like” relationship), or marriage to / cohabitation with a US citizen.

• Intent to marry or cohabit (i.e., establish a “spouse-like” relationship) or marriage to / cohabitation with a foreign national

• Divorce of a spouse (US citizen or foreign national)

• Psychiatric referral or psychiatric self-referral.

• Involvement with any civilian or military law enforcement agency (defined as arrest or detention) due to criminal activity (E.g., fraud, black-market activity, theft, assault, driving under the influence/while intoxicated, prostitution, sex offenses, child abuse, domestic violence, use/possession/distribution of illegal drugs or possession of drug paraphernalia, homicide, manslaughter, leaving the scene of an accident, etc.) or any traffic infraction where the fine was $150 or more.

• Illegal procurement/disposition matters (includes misuse of government or corporate credit and/or travel cards).

• Dependent involvement in a criminal offense.

• An SCI-indoctrinated individual declares himself a Conscientious Objector.

• A close personal or business relationship with a foreign national.

• Attempted suicide or a suicidal gesture.

• Recurring incidents of a discreditable nature.

• Financial irresponsibility or significant debt (failure to make court-ordered payments, placement of accounts with a collection agency, liens against property or income, repossession of property, foreclosures, etc.) .

• Sudden affluence. (Defined as receiving $10,000 or more.)

• Employment (paid or volunteer) by a foreign national, by an agent of any foreign interest or with any organization or person (foreign or domestic) involved in intelligence, foreign affairs or defense issues.

• Coworker or supervisory/management doubts about the stability, trustworthiness, reliability, discretion, character, soundness of judgment or the ability to safeguard classified information to include outside activities/employment.

• Security violations (SCI and non-SCI) involving an SCI-indoctrinated person.

The responsible office for this information is AFSOC/A2S. The information is current as of 7 January 2009.

• Refusal to sign a security statement (e.g., non-disclosure agreement, security termination statement, etc.).

• Unofficial foreign travel (itinerary required when self-reported).

• Crime or Accident Victim. Report only those incidents that result in medical or mental problems which, in turn, could adversely affect continuing SCI access.

• Any incident not listed occurring outside the United States which is inconsistent with the laws or customs of a country or state and which may result in unfavorable publicity.

This contract requires certain contractor employees to have access to SCI for performance under this contract. This contract requires not more than [enter a number] SCI-indoctrinated person(s) in order to complete work on the deliverables specified in this contract. Contractor will provide SSO AFSOC a list of all persons assigned to work under this contract. The list will include the employees’ full names, Social Security Account Numbers, dates and places of birth, the dates of the latest personnel security investigations and the dates of SCI eligibility determination, if applicable. If a Single-Scope Background Investigation has not been completed, or is out of date, upon approval of billets by SSO AFSOC, the Contractor Special Security Officer (CSSO) or Facility Security Officer (FSO) will submit the necessary forms to the Defense Industrial Security Clearance Office or to the Office of Personnel Management (OPM) for those persons nominated for SCI access in accordance with the National Industrial Security Program Operating Manual (NISPOM). Billet justifications for uncleared persons or for those whose investigations are outdated will include the contract Performance based Work Statement (PWS).

Contractor will comply with the SSO AFSOC policy of requiring the shredding of all waste paper products generated in a SCIF or intelligence facility. AFSOC Instruction 10-701 also requires the shredding of all other paper items. The only exceptions are food wrappings, newspapers, magazines and packing materials. The shredder used must meet the performance requirements of NSA/CSS Specification 02-01, High Security Crosscut Paper Shredders. (See Annex A of this specification, NSA/CSS Evaluated Products list for High Security Crosscut Paper Shredders, for specific equipment meeting these standards.) For information purposes, the performance requirements of NSA/CSS Specification 02-01 are summarized below.

• Maximum Particle Area: Ninety percent (90%) of the shredded particles shall not exceed five square millimeters (5 mm2) and none of the remaining particles shall exceed ten square millimeters (10 mm2).

• Maximum Particle Dimensions: Seventy five percent (75%) of the shredded particles shall have no edge dimension exceeding five millimeters (5 mm) in length. The remaining particles (a maximum of twenty five percent (25%)) may exhibit edge dimensions between five and twelve and one half millimeters (5 -

12.5 mm) in length. No particle shall have an edge dimension greater than twelve and one half millimeters (12.5 mm) in length.

• Durability: Shredder shall operate continuously for one (1) hour, shredding paper at a feed rate prescribed by the manufacturer, and consistently produce particles that meet specification requirements.

Contractor will not destroy any classified document provided by the government for the purpose of performing under the contract without permission from the government.

The HQ AFSOC/A2 is the approval authority for “need-to-know” for SCI and intelligence information. This authority is delegated to SSO AFSOC. For all other information, the COR is the approval for “need-to-know.”

Contractor will return all SCI and non-SCI intelligence material furnished under this contract to the SSO AFSOC upon completion of this contract unless written approval is granted for its retention. All classified information (in any form whatsoever) furnished in support of this contract is and remains the sole property of the United States Government.

Contractor will utilize only appropriately secured local/wide area networks (i.e., SIPRNet or JWICS/JDISS, as appropriate), or another appropriately secured electronic means of transmission approved by SSO AFSOC as the primary method of transmitting SCI and/or intelligence information under this contract. An alternate method of

The responsible office for this information is AFSOC/A2S. The information is current as of 7 January 2009.

transmitting SCI/intelligence will be the Defense Courier Service. SSO AFSOC will act as the receiving and dispatching point for use of the Defense Courier Service under this contract and contractor will not require a separate Defense Courier Service account. Establishment of a Defense Courier Service account is not authorized.

Contractor will not remove any SCI or intelligence information from a government or government-controlled Sensitive Compartmented Facility (SCIF) supported by this contract without written approval of the Senior Intelligence Officer (AFSOC/A2) and, if removed from a government installation, written courier authority from the SSO AFSOC. Requests to hand-carry SCI or intelligence information via commercial aircraft generally will not be approved. Removal of other classified information requires written permission from the COR.

Contractor will not reproduce classified information (to include SCI and/or intelligence information) without advance approval of SSO AFSOC or the releasing agency. If permission is granted, each copy will be controlled in the same manner as the original.

Contractor employees will wear a SCIF identification badge (issued by SSO AFSOC or other appropriate government authority) at all times while within a SCIF under Government control. The badge must be prominently displayed on top of the outer garment and above the wearer’s waist. This requirement is in addition to that mandating wear of the contractor-issued contractor identification badge.

Contractor will comply with HQ AFSOC policies concerning the use and/or possession of Portable Electronic Devices (PED) within any AFSOC facility. AFSOC prohibits all non-government PEDs and limits use of government PEDs within AFSOC buildings. Refer to AFSOC Instruction 33-202 (Portable Electronic Device (PED) Security) for definitions of PEDs.

• SSO AFSOC prohibits the possession or use of all cameras, video recorders, audio recorders, cellular phones, hand-held radios, two-way pagers and all devices containing an Radio Frequency transmitter in any AFSOC SCIF.

• Contractor will comply with the SSO AFSOC policies which prohibit the possession or use of memory/storage devices variously described as Flash Memory, Memory Stics, Smart Media, Thumb Drives and/or Jump Drives, inter alia, in AFSOC SCIFs. Such items present unacceptable security hazards.

• Briefings/presentations will be sent to / brought into AFSOC-operated SCIFs via secure e-mail at the appropriate classification level or on CD-ROM (Read only) or on DVD (Read only). Use of “thumb drives,” “flash drives,” “jump drives” or similar type USB storage devices to transfer briefings/presentations is prohibited.

The contractor is prohibited from:

• Connecting any media storage device to any government computer without permission from the Information Assurance Officer for the location in question.

• Connecting any non-government computer to any government computer or computer network without permission from the Information Assurance Officer for the location in question.

AFSOC/A2S (SSO AFSOC) (or its designee) conducts random searches of persons (military, government civilians, contractors and other persons) entering and leaving SCIFs. These searches are to ensure prohibited items do not enter SCIFS and to ensure that only authorized items are removed from SCIFs. Prohibited items will be seized and destroyed if discovered in any AFSOC SCIF and the incident reported to the Defense Security Service and the contractor’s Facility Security Office/Contractor Special Security Office. Contractor employees assigned to work under this contract must consent to search. (Authority: Section 21 Internal Security Act of 1950; 50 U.S.C. 797)

The responsible office for this information is AFSOC/A2S. The information is current as of 7 January 2009.

Contractor employees performing under this contract will participate in all periodic SCI security awareness education and training provided by AFSOC/A2S (SSO AFSOC).

Contract expiration date: [ enter date contract expires ]

COR/Contract Monitors (CM) (Primary and Alternate) (Names, office symbols, and phone numbers): [ enter data requested ]

Places where contract will be performed (list physical addresses & locations) if not listed in Block 8.a.: [ enter data requested if applicable ]

ITEM 15: (When item 10.e(1) and/or 10.e.(2) are(is) checked “YES”)

HQ AFSOC/A2S (SSO AFSOC), Hurlburt Field, Florida has exclusive security responsibility for all intelligence information and/or SCI material provided, released or developed under this contract. The Defense Intelligence Agency and HQ AFSOC/A2S (SSO AFSOC) have inspection authority for all intelligence-related and/or SCI-related matters under this contract.

The SSA has security oversight of all information and/or material released or developed under this contract with the exception of Intelligence (SCI and non-SCI) and SAP material. Long Term Visitor Groups will be inspected as part of the supported organization’s annual Information Security Program Review, conducted by the SSA, while operating on an Air Force installation. The contractor will comply with the Visitor Group Security Agreement which must be signed before start of work is authorized at Hurlburt Field.

ITEM 17: (When item 10.e(1) and/or 10.e.(2) are(is) checked “YES”(

Add HQ AFSOC/A2S to Required Distribution.

The responsible office for this information is AFSOC/A2S. The information is current as of 7 January 2009.

ADDENDUM #3

DD FORM 254 FOR ITEM 12

(When item 10.e(2) is checked “YES”)

INTELLIGENCE INFORMATION

ITEM 12: (When item 10.e(2) is checked “YES”)

If Item 10.e.(2) IS marked “YES,” (i.e., Non-SCI intelligence is involved in the contract), Item 12 must be marked “THROUGH” and the following additional addressees entered:

HQ AFSOC/A2S

100 Bartley Street 212 South Hurlburt Field, FL 32544-5273

AF/A2S

240 Luke Avenue Bolling AFB, DC 20032-5114

In addition, include the following statement in Item 12:

“PUBLIC RELEASE OF INTELLIGENCE INFORMATION IS PROHIBITED.”

ITEM 13: (When item 10.e(2) is checked “YES”)

When required, the contractor will derivatively classify documents created in the course of this contract using the procedures and criteria defined in Executive Order 12958, Classified National Security Information, (EO 12958) as amended and Information Security Oversight Office Implementing Directive No. 1. Requests for original classification of intelligence information at any classification level or within any compartment will be referred to the AFSOC Special Security Officer (SSO AFSOC) at QH AFSOC/A2S. Requests for classification not involving intelligence will be referred to the AFSOC Information Protection Office via the Contracting Officer’s Representative (COR).

When the contractor creates a classified document from extant classified documents, the contractor will incorporate into the finished product a list of all sources used and will apply required security classification markings and handling/control/dissemination/ declassification caveats to all working, draft and final copies of classified documents in accordance with the following documents:

• Executive Order 12958, as amended;

• Information Security Oversight Office Implementing Directive No. 1 (Effective September 22, 2003)

• The Intelligence Community Classification and Control Markings Implementation Manual, (U/FOUO), with its classified Appendix (CONFIDENTIAL//Rel To USA, AUS, CAN, GBR) as required

• The Authorized Classification and Control Markings Register, (U/FOUO), with its classified Annex

(SECRET//Rel To USA, AUS, CAN, GBR) as required

• Air Force Instruction 31-401 Information Security Program Management

• The National Industrial Security Program Operating Manual (NISPOM) (February 2006)

NOTE: As of 30 May 2006, it is Air Force policy to use the standardized security markings guidelines provided in references 12 and 13 listed below. THIS POLICY APPLIES TO ALL CLASSIFIED

MATERIAL (DOCUMENTS, PRESENTATIONS, ETC.) GENERATED IN, BY AND FOR THE AIR

FORCE. Contractors are required to comply with this policy change.

Data storage media in any form become the property of the U.S. Government whenever classified information is placed thereon. Erasure, degaussing, “wiping” of the data or reformatting of the media does not change this requirement and does not declassify the media.

Contractor will not sanitize or decompartment any intelligence. If the contractor believes fulfillment of this contract requires sanitization of intelligence, the information will be forwarded to SSO AFSOC.

The responsible office for this information is AFSOC/A2S. The information is current as of 9 January 2009.

Addendum #3 to DD254, Attachment 4, Appendix D

Access to, discussion of, use of, handling, maintenance and/or storage of intelligence is limited to government owned or government-controlled facilities.

The SSO AFSOC s the final authority regarding issues of security, classification, dissemination or any other matter involving intelligence. Intelligence information security issues shall be directed to HQ AFSOC/A2S (SSO AFSOC), phone (850) 884-6689 (DSN 579). Similar issues involving other classified information will be referred to the COR.

References. (If newer editions are published after award of the contract, the contractor will utilize the most recent edition of these documents):

1. Executive Order 12958, as amended. Classified National Security Information, (March 25, 2003)

2. – 6. . [Not used.]

7. Intelligence Community Policy Guidance Number 704.3, Denial or Revocation of Access to Sensitive

Compartmented Information, Other Controlled Access Program Information, and Appeals Processes (Replaced DCID 6/4, Annex D on 2 October 2008)

8. Director of Central Intelligence Directive 6/5 Policy for Protection of Certain non-SCI Sources and Methods

Information (SAMI)(February 12, 2001)

9. Director of Central Intelligence Directive 6/6 Security Controls on the Dissemination of Intelligence

Information (11 July 2001 / 3 May 2002)(Classified SECRET/NOFORN)

10. [Not used.]

11. Information Security Oversight Office Implementing Directive No. 1 (Effective September 22, 2003)

12. The Intelligence Community Classification and Control Markings Implementation Manual, (U/FOUO), with its classified Appendix (CONFIDENTIAL//Rel To USA, AUS, CAN, GBR) as required

13. The Authorized Classification and Control Markings Register, (U/FOUO), with its classified Annex

(SECRET//Rel To USA, AUS, CAN, GBR) as required

14. [Not used.]

15. Department of Defense Manual 5220.22-M National Industrial Security Program Operating Manual, February 2006

16. – 17.. [Not used.]

18. Air Force Instruction 14-303 Release of Intelligence to U.S. Contractors (1 April 1999)

19. – 20. [Not used.]

21. National Geospatial-Intelligence Agency Imagery Policy Series, February 2004 (SECRET//NOFORN).

22. AFSOC Instruction 33-202, Portable Electronic Device (PED) Security

The responsible office for this information is AFSOC/A2S. The information is current as of 9 January 2009.

ITEM 14: (When item 10.e(2) is checked “YES”)

Automated Information Systems used to process non-SCI intelligence information will comply with the Air Force 33-series Instructions and Hurlburt Field policies and procedures. In no case will the contractor process intelligence information on non-government-owned AIS or on government-owned AIS without written permission from a government agency authorized to issue approval to operate such equipment. The SSO AFSOC is the final authority regarding questions of AIS security for systems processing intelligence information.

Contractor will / will not require access to the NIPRNET. [Line out the inappropriate words.]

Contractor will / will not require access to the SIPRNET. [Line out the inappropriate words.]

The contractor will notify the SSO AFSOC immediately upon receiving “reportable information” or knowledge of reportable information involving any employees assigned to work on this contract. “Reportable information” is defined as any change in personal status which could affect continuing eligibility for access to classified information. Refer to DoD 5200.2-R, Personnel Security Program, Chapters 2 and 8.) Some examples (not all-inclusive) of reportable information are:

• Death, capture or the unexplained absence (over 24 hours) of any employee assigned to this contract with access to classified information.

• Intent to marry or cohabit (i.e., establish a “spouse-like” relationship) or marriage to / cohabitation with a foreign national

• Psychiatric referral or psychiatric self-referral.

• Involvement with any civilian or military law enforcement agency (defined as arrest or detention) due to criminal activity (E.g., fraud, black-market activity, theft, assault, driving under the influence/while intoxicated, prostitution, sex offenses, child abuse, domestic violence, use/possession/distribution of illegal drugs or possession of drug paraphernalia, homicide, manslaughter, leaving the scene of an accident, etc.) or any traffic infraction where the fine was $150 or more.

• Illegal procurement/disposition matters (includes misuse of government or corporate credit and/or travel cards).

• A cleared employee declares himself a Conscientious Objector.

• A close personal or business relationship with a foreign national.

• Attempted suicide or a suicidal gesture.

• Recurring incidents of a discreditable nature.

• Financial irresponsibility or significant debt (failure to make court-ordered payments, placement of accounts with a collection agency, liens against property or income, repossession of property, foreclosures, etc.).

• Sudden affluence. (Defined as receiving $10,000 or more.)

• Employment (paid or volunteer) by a foreign national, by an agent of any foreign interest or with any foreign organization or person (foreign or domestic) involved in intelligence, foreign affairs or defense issues.

• Coworker or supervisory/management doubts about the stability, trustworthiness, reliability, discretion, character, soundness of judgment or the ability to safeguard classified information to include outside activities/employment.

• Security violations involving a cleared employee on this contract.

• Refusal to sign a security statement (e.g., non-disclosure agreement, security termination statement, etc.).

• Unofficial foreign travel (itinerary required when self-reported).

• Crime or Accident Victim. Report only those incidents that result in medical or mental problems which, in turn, could adversely affect continuing access to classified information.

Contractor will comply with the SSO AFSOC policy of requiring the shredding of all waste paper products generated in a facility containing intelligence information. AFSOC Instruction 10-701 requires shredding of all other paper items. The only exceptions are food wrappings, newspapers, magazines and packing materials. The shredder used must meet the performance requirements of NSA/CSS Specification 02-01, High Security Crosscut Paper Shredders. (See Annex A of this specification, NSA/CSS Evaluated Products list for High Security Crosscut

The responsible office for this information is AFSOC/A2S. The information is current as of 9 January 2009.

Paper Shredders, for specific equipment meeting these standards.) For information purposes, the performance requirements of NSA/CSS Specification 02-01 are summarized below.

• Maximum Particle Area: Ninety percent (90%) of the shredded particles shall not exceed five square millimeters (5 mm2) and none of the remaining particles shall exceed ten square millimeters (10 mm2).

• Maximum Particle Dimensions: Seventy five percent (75%) of the shredded particles shall have no edge dimension exceeding five millimeters (5 mm) in length. The remaining particles (a maximum of twenty five percent (25%)) may exhibit edge dimensions between five and twelve and one half millimeters (5 -

12.5 mm) in length. No particle shall have an edge dimension greater than twelve and one half millimeters (12.5 mm) in length.

• Durability: Shredder shall operate continuously for one (1) hour, shredding paper at a feed rate prescribed by the manufacturer, and consistently produce particles that meet specification requirements.

Contractor will not destroy any classified document provided by the government for the purpose of performing under the contract without permission from the government.

The AFSOC/A2 is the approval authority for “need-to-know” for intelligence information. This authority is delegated to SSO AFSOC. For all other information, the COR is the approval for “need-to-know.”

Contractor will return all intelligence material furnished under this contract to the SSO AFSOC or other office designated by the SSO AFSOC upon completion of this contract unless written approval is granted for its retention.

All classified information (in any form whatsoever) furnished in support of this contract is and remains the sole property of the United States Government.

Contractor will utilize an electronic means of transmission (SIPRNet) approved by AFSOC/A2S (SSO AFSOC) as the primary method of transmitting intelligence information under this contract. Hand-carrying of classified intelligence information requires compliance with applicable security directives and may require a written appointment as an authorized courier. Establishment of a Defense Courier Service account is not authorized.

Contractor will not remove any intelligence information from a government or government-controlled Sensitive Compartmented Facility (SCIF) or other intelligence facility supported by this contract without written approval of the Senior Intelligence Officer (AFSOC/A2) and, if removed from a government installation, written courier authority from SSO AFSOC. Requests to hand-carry intelligence information via commercial aircraft generally will not be approved. Removal of other classified information requires written permission from the COR.

Contractor will not reproduce classified intelligence information without advance approval of SSO AFSOC or of the releasing agency. If permission is granted, each copy will be controlled in the same manner as the original.

Contractor will comply with HQ AFSOC policies concerning the use and/or possession of Portable Electronic Devices (PED) within any AFSOC facility. AFSOC prohibits all PEDs within AFSOC buildings. Refer to AFSOC Instruction 33-202 (Portable Electronic Device (PED) Security) for definitions of PEDs.

• SSO AFSOC prohibits the possession or use of all cameras, video recorders, audio recorders, cellular phones, hand-held radios, two-way pagers and all devices containing an Radio Frequency transmitter in any AFSOC intelligence facility.

• Contractor will comply with the SSO AFSOC policies which prohibit the possession or use of memory/storage devices variously described as Flash Memory, Memory Stics, Smart Media, Thumb Drives and/or Jump Drives, inter alia. Such items present unacceptable security hazards.

• Briefings/presentations will be sent to / brought into AFSOC-operated SCIFs or intelligence facilities via secure e-mail at the appropriate classification level or on CD-ROM (Read only) or on

The responsible office for this information is AFSOC/A2S. The information is current as of 9 January 2009.

DVD (Read only). Use of “thumb drives,” “flash drives,” “jump drives” or similar type USB storage devices to transfer briefings/presentations is prohibited.

The contractor is prohibited from:

• Connecting any media storage device to any government computer without permission from the Information Assurance Officer for the location in question.

• Connecting any non-government computer to any government computer or computer network without permission from the Information Assurance Officer for the location in question.

AFSOC/A2S (SSO AFSOC) conducts random searches of persons (military, government civilians, contractors and other persons) entering and leaving SCIFs and other intelligence facilities. These searches are to ensure prohibited items do not enter areas where classified intelligence is present and to ensure that only authorized items are removed. Prohibited items will be seized and destroyed if discovered in any AFSOC intelligence facility and the incident reported to the Defense Security Service. Contractor employees assigned to work under this contract must consent to search. (Authority: Section 21 Internal Security Act of 1950; 50 U.S.C. 797)

Contract expiration date: [Enter contract expiration date.]

COR/Contract monitors (Primary and Alternate) (Names, office symbols, and phone numbers): [Enter data requested.]

Places where contract will be performed (list physical addresses & locations) if not listed in Block 8.a.: [Enter data requested.]

ITEM 15: (When item 10.e(2) is checked “YES”)

HQ AFSOC/A2S (SSO AFSOC), Hurlburt Field, Florida has exclusive security responsibility for all intelligence information provided, released or developed under this contract. The Defense Intelligence Agency and HQ AFSOC/A2S (SSO AFSOC) have inspection authority for all intelligence-related and/or SCI-related matters under this contract.

The SSA has security oversight of all information and/or material released or developed under this contract with the exception of intelligence and SAP material. Long Term Visitor Groups will be inspected as part of the supported organization’s annual Information Security Program Review, conducted by the SSA, while operating on an Air Force installation. The contractor will comply with the Visitor Group Security Agreement which must be signed before start of work is authorized at Hurlburt Field.

ITEM 17: When item 10.e(2) is checked “YES”

Add HQ AFSOC/A2S to Required Distribution.

The responsible office for this information is AFSOC/A2S.