3_-_DD_FORM_254_-_Combined_CCAS5.pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYMMDD)

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs)

Revision No.

Date (YYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYMMDD)

c. FINAL (Complete Item 5 in all cases) Date (YYMMDD)

FA0021-16-R-0001

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

TBD

FULL DEFENSE SECURITY SERVICE ADDRESS

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

***** ALWAYS LEFT BLANK *****

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

24 SOW

121 Terry Ave, Bldg 90310 Hurlburt Field, FL 32544 ***Multiple Locations, See Block 13***

N/A

See Block/Item 15 of this form

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

The 24th Special Operations Wing (SOW) requires 1000 hours of Combined (Live/Dry) Contracted Close Air Support (CCAS) flight sorties to support the Special Operations Terminal Attack Controller Course (SOTACC) Joint Terminal Attack Controller (JTAC) initial/mission qualification training and academic instruction of Weapons School like mission debriefing techniques.

24 SOW Combined CAS Contract

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR’S

FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify).

k. OTHER Specify)

Automated Information Systems NIPRNET

NONE

DD Form 254 (Dec 99)

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review. *In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

Direct

Through (Specify):

Information requiring AF or DoD—level review will be forwarded by the entry-level public affairs office through the MAJCOM/DRU Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.

1. Supported USAF organizations will provide security classification guides and other classification guidance to the contractor as required for contract performance. Contractors will comply with all Hurlburt Field, supported unit and special program requirements. Supported units will provide security requirements and instructions, and will include contractors in the unit Information Security program.

2. Classified markings on all working, draft, and final copies of deliverable material shall be in accordance with Executive Order 13526, The Controlled Access Program Coordination Office (CAPCO) guidelines, DoD 5220.22-M, DoDM 5200.01 and applicable instructions contained in the respective security classification guides.

3. For on-base contractors, the NISPOM security standards can be satisfied by incorporating AFI 16-1404, Air Force Information Security Program, and AFI 16-1406. Air Force Industrial Security Program Management, requirements into the Visitor Group Security Agreement.

4. All classified material provided shall be returned by the contractor at contract completion. Individuals are responsible for safeguarding classified information entrusted to them.

5. Use only AF certified AIS for performance on base and will comply with all AF AIS procedures.

Ref Item 10k: Secret Internet Protocol Network (SIPRNet) access authorization. The contractor shall not access, download, or further disseminate any information or data that falls outside the scope of execution of the defined contract requirements. In the event any additional access is required, the Program Manage, Contracting Officer Representative, or Security Manager, must modify/revise the requirements for the DD Form 254 and/or Statement of Work. Contractor shall prepare and submit all required documentation as required by Command policy prior to receiving access.

Ref Item 11a: The highest level of security clearance required for contract performance is Secret. Using activities will provide security classification guidance for performance of this contract. The government will oversee the handling and storage of classified information in support of this contract.

The government will provide storage capability for all classified material required for this contract. All classified information shall be returned to the government upon termination of the contract.

RICHARD D. DOUGLAS, MSGT, USAF ROBERT JEFFERS WILLIAM S. DENSON, JR., GS-11, DAF

Program Manager Security Manager Chief, Servicing Security Agency

(850) 884-3346 (850) 884-6055 1 SOW/IPC (850) 884-5143

** See attached addendums for items 10a, j, k and 11j.

14. ADDITIONAL SECURITY REQUIREMENTS. Provide the information requested by the Notification of Government Security Yes No

Activity clause and Visitor Group Security Agreements Clause, AFFARS 5352.204-9000, to the Servicing Security Activity indicated in Item 13 above.

Refer to the contract document for these clauses. The visitor group will operate per DoDM 5200.01, AFI 16-1404, Hurlburt Field supplements and unit security program operating instructions, plans and procedures.

15. INSPECTIONS. Long term visitor groups will be inspected as part of the supported organizations annual Information Yes No

Protection Management Inspection, conducted by the SSA, while operating on an Air Force Installation. The contractor will comply with the visitor group security agreement provided by the USAF Program/Project Manager at the performance location. The above does not apply to intelligence, SCI and SAP.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

AMANDA C. SZABOLCS

b. TITLE Contracting Officer

c. TELEPHONE (Include Area Code)

850-884-0102

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

427 Cody Ave Building 90333 Hurlburt field, FL 32544

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY 1 SOW/IPC

DD Form 254 (Dec 99)

LAST REVIEWED/UPDATED

September 2011

ADDENDUM to DD FORM 254 (BLOCK 10a)

COMSEC

COMSEC material/information may not be released to DoD contractors without Air Force Cryptological Support Center (AFCSC) approval. Contractors will forward requests for COMSEC to the COMSEC officer through the CAASETA program office. The con-tractor is governed by AFKAG-1, AFKAG-2, and appropriate Air Force Security Instructions/Manuals (AFSSI/AFSSM) or Air Force

Instructions (AFI). Access to COMSEC material or information is restricted to US citizens holding final U.S. Government clearances and is not releasable to personnel holding only a reciprocal clearance. Personnel requiring COMSEC access will be briefed in accord-ance with AFI 33-201 volumes 2 and 9 (COMSEC User Requirements). The Air Force program/project manager will designate the number of personnel requiring COMSEC access. The number will be limited to the minimum necessary and will be on a strict need-to-know basis. If contractor is working within a squadron/unit, the contractor will go through the squadron/units’ COMSEC Respon-sible Officer for the use of COMSEC.

IN PERFORMING THIS CONTRACT:

Contractor may be required to provide storage for classified hardware to the level of Top Secret. The contractor will follow all in-structions from AF AFIs, AFSSIs, AFSSMs, and AFKAGs

A COMSEC account will be established, if necessary, and COMSEC will be protected per DoD 5220.22-S.

See AFI 33-203 volumes 1 and 3, The Air Force Emission Security Program, for additional guidance and requirements.

The contractor is authorized to use the services of DCS if they have acquired an account through AFCSC. The contracting activity must request DCS services from the Commander, Defense Courier Service, ATTN Operations Division, Ft George G. Meade MD

20755. Only certain classified information qualifies for shipment by DCS. It is the responsibility of the contracting activity to comply with DCS policy and procedures. .

REQUIREMENTS:

The requirements of DoD 5220.22-M and NSA/CSS Policy Manual 3-16 are applicable to this effort.

All contractor personnel to be granted access to classified COMSEC information must be U.S. citizens granted FINAL clearance by the government prior to being given access. Immigrant aliens, interim cleared personnel, or personnel holding a contractor granted

CONFIDENTIAL clearance are not eligible for access to classified COMSEC information released or generated under this contract without the express permission of the Director, NSA.

Contractor employees or cleared commercial carriers shall not carry classified COMSEC material on commercial passenger aircraft anywhere in the world without the approval of the procuring contracting officer.

No contractor generated COMSEC or government furnished material may be provided to the Defense Technical Information Center

(DTIC). Contractor generated technical reports will bear the statement "Not Releasable to the Defense Technical Information Center per DoD Directive 5100-38."

Classified paper COMSEC material may be destroyed by burning, disintegration, chopping or high security crosscut shredding. Cryp-tographic key tapes must be “terminally” destroyed (destroyed to the point where it cannot be reconstructed) utilizing devices listed on the Evaluated Products List (EPL) for Punched Tape Destruction Devices or the EPL for High-Security Disintegrators. Contact the

COMSEC office for a list of approved devices. When a method other than burning is used, all residues must be reduced to pieces

5mm or smaller in any dimension. When classified COMSEC material other than paper is to be destroyed, specific guidance must be obtained from the User Agency.

Unclassified COMSEC information released or generated under this contract shall be restricted in its dissemination to personnel in-volved in the contract. Release in open literature or exhibition of such information without the express written permission of the Di-rector, NSA, is strictly prohibited.

Recipients of COMSEC information under this contract may not release information to subcontractors without permission of the User

Agency.

COMSEC systems requirements and assistance can be found at the following:

Email: 1sow.ia@hurlburt.af.mil

Contact: 1 SOCS/SCXS at 884-5666 mailto:1sow.ia@hurlburt.af.mil

November 2012

ADDENDUM TO DD FORM 254 (BLOCK 10j)

FOR OFFICIAL USE ONLY (FOUO)

(References: DoD Manual 5200.01, Volume 4, February 24, 2012 and DoD Directive

5400.7/Air Force Supplement, 22 July 1999)

1. GENERAL: "For Official Use Only (FOUO)" is a designation that is applied to unclassified information that may be exempt from mandatory release to the public under the Freedom of In-formation Act (FOIA) (reference (g)). The FOIA specifies nine exemptions that may qualify cer-tain information to be withheld from release to the public if, by its disclosure, a foreseeable harm would occur. FOUO is information that has not been given a security classification pursuant to the criteria of an Executive Order. Additional information on FOUO may be obtained by con-tacting the User Agency. FOUO is assigned to information at the time it is created in a DoD

Agency or derivatively.

2. MARKING:

a. FOUO information received (released by a DoD component) should contain the follow-ing marking, when received: THIS DOCUMENT CONTAINS INFORMATION EXEMPT

FROM MANDATORY DISCLOSURE UNDER FOIA. EXEMPTION(S) ___

APPLIES/APPLY.

b. Information that has been determined to qualify for FOUO status should be indicated by markings when included in documents and similar material. Markings should be applied at the time documents are drafted, whenever possible, to promote proper protection of the in-formation. Unclassified documents and material containing FOUO information shall be marked as follows:

“Documents will be marked "FOR OFFICIAL USE ONLY" at the bottom of the front cover (if there is one), the title page (if there is one), the first page, and the outside of the back cover (if there is one). Pages of the document that contain FOUO infor-mation shall be marked "FOR OFFICIAL USE ONLY" at the bottom. Each para-graph containing FOUO information shall be marked as such. Material other than pa-per documents (for example, slides, computer media, films, etc.) shall bear markings that alert the holder or viewer that the material contains FOUO information.”

c. Within a classified document, an individual page that contains both FOUO and classified information shall be marked at the top and bottom with the highest security classification of information appearing on the page. Individual paragraphs shall be marked at the appropriate classification level, as well as unclassified or FOUO, as appropriate. An individual page that contains FOUO information but no classified information shall be marked “FOR OFFICIAL

USE ONLY” at the top and bottom of the page, as well as each paragraph that contains

FOUO information. NOTE: For “production efficiency” the entire document may be marked top and bottom with the highest level of classification contained within it, as long as every paragraph is marked to reflect the specific classification of the information it contains.

d. Mark other records, such as computer print outs, photographs, films, tapes, or slides 'FOR

OFFICIAL USE ONLY" so that the receiver or viewer knows the record contains FOUO in-formation.

e. Mark each part of a message that contains FOUO information. Unclassified messages con-taining FOUO information must show the abbreviation "FOUO" before the text begins.

3. ACCESS: Access to FOUO Information. FOUO information may be disseminated within the

DoD Components and between officials of the DoD Components and DoD contractors, consult-ants, and grantees as necessary in the conduct of official business. FOUO information may also be released to officials in other Departments and Agencies of the Executive and Judicial Branch-es in performance of a valid Government function. (Special restrictions may apply to infor-mation covered by the Privacy Act, reference (h).) Release of FOUO information to Members of

Congress is covered by DoD Directive 5400.4 (reference (gg)) and to the General Accounting

Office by DoD Directive 7650.1 (reference (ll)).

4. DISSEMINATION: FOUO may be disseminated between officials of DoD Components, DoD contractors, consultants and grantees to conduct official business for DoD. Recipients shall be made aware of the status of such information and transmission shall be by means that pre-clude unauthorized public disclosure. FOUO documents and material transmitted outside the

Department of Defense must bear an expanded marking on the face of the document so that non-

DoD holders understand the status of the information. A statement similar to this one should be used:

"This document contains information exempt from mandatory disclosure under the F0IA. Ex-emption(s) ______ apply.”

5. TRANSMISSION: FOUO information shall be transmitted in a manner that prevents disclo-sure of the contents. When not commingled with classified information, it may be sent via first-class mail or parcel post. Bulky shipments, i.e. testing materials, that otherwise qualify under postal regulations, may be sent by fourth-class mail. FOUO information may also be sent over facsimile equipment; however, when deciding whether to use this means, balance the sensitivity of the records against the risk of disclosure. Consider the location of sending and receiving ma-chines and ensure authorized personnel are available to receive the FOUO information as soon as it is transmitted. Transmittal documents shall call attention to the presence of FOUO attach-ments. FOUO information may also be sent via e-mail, if it is sent via a system that will prevent unintentional or unauthorized disclosure.

6. STORAGE: To safeguard FOR OFFICIAL USE ONLY records during normal duty hours, place them in an out-of-sight location if your work area is accessible to persons who do not have a valid need for the information. After normal duty hours, store FOUO records to prevent unau-thorized access. File them with other unclassified records in unlocked files or desks when nor-mal internal building security is provided. When there is no internal building security, locked buildings or rooms normally provide adequate after-hours protection. If such protection is not considered adequate, FOUO material shall be stored in locked containers such as file cabinets, desks, or bookcases. Expenditure of funds for security containers or closed areas solely for the protection of FOUO data is prohibited.

7. DESTRUCTION: When no longer needed, FOUO information shall be disposed of by any method that will preclude its disclosure to unauthorized individuals. Destruction of all FOUO, Unclassified, and Official Business related paper products on Hurlburt field is accomplished by shredding.

8. Direct any and all questions concerning FOUO to the 1 SOW/IPI Office at 884-4322.

ADDENDUM TO DD FORM 254 (BLOCK 10k)

AUTOMATED INFORMATION SYSTEMS

1. This section outlines the requirements, procedures and Air Force publications that must be adhered to by contractors as a condition of use of Hurlburt Field Automated Information Systems

(AIS) and Local Area Network (LAN).

2. Information Assurance (IA) practices are the actions that protect information and information systems by ensuring their continued availability, integrity, confidentiality, and non-repudiation.

This includes providing for restoration of information systems by incorporating disaster recovery capabilities to ensure continuity of operations under all conditions.

3. Key publications governing the use and security of AF AIS are listed below. Many include additional publications by reference, which are equally applicable.

AFI 33-115v2, Licensing Network Users and Certifying Network Professionals

AFSSI 8502, Organizational Computer Security

AFI 33-119, Air Force Messaging [Email Management and Use]

AFI 33-129, Web Management and Internet Use

AFSSI 7700, Emission Security

AFI 33-210, Air Force Certification and Accreditation (C&A) Program (AFCAP)

AFI 10-712, Telecommunications Monitoring and Assessment Program (TMAP)

AFSOCI 33-202, Portable Electronic Device Security

AFSSI 8580, Remanence Security

Command Policy on Use of Portable Electronic Devices (PED), 21 March 2011

4. All personnel are required to safeguard information and information systems against unau-thorized access, modification, destruction or disclosure.

5. Per the Hurlburt Field NIPRnet System Security Authorization Agreement (SSAA), contrac-tor owned hardware and software will not be connected to Hurlburt Field unclassified or classi-fied LAN.

6. Non-Air Force wireless network devices are forbidden on Hurlburt Field.

7. All portable electronic devices (PED) are prohibited from use or possession within Hurlburt

Field buildings where information (regardless of classification) is processed, stored or discussed.

8. All information systems, software, and/or enclaves operating on Hurlburt Field must be certi-fied and accredited through the DoD Information Assurance Certification and Accreditation Pro-gram (DIACAP) prior to being implemented or connected to the network.

9. The 1 SOW Information Assurance Office is the source for IA related information.

Email: 1sow.ia@hurlburt.af.mil

Contact: 1 SOCS/SCXS at (850) 884-6605 mailto:1sow.ia@hurlburt.af.mil

ADDENDUM TO DD FORM 254 (BLOCK 11j)

OPERATIONS SECURITY

1. This section outlines the requirements and procedures necessary for contractors to provide

Operations Security (OPSEC) protection for AFSOC’s Critical Information (CI).

2. OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

Identify those actions that can be observed by adversary intelligence systems.

Determine which of those action are indicators to hostile intelligence systems which they can obtain and interpret or piece together to derive critical information in time to be useful for adversaries planning.

Develop, select and execute countermeasures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

3. OPSEC principles are used to help assigned personnel:

Maintain a continuing awareness of adversary interest in SOF actions and adversary intelligence collection capabilities.

To understand the need to identify and protect unclassified indicators that reveal sensitive information.

To evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

4. Our objectives are:

Protect planned operational activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

To preserve secrecy concerning specific scenario events and a USSOCOM or AFSOC response to these events.

To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. AFSOC employed contractors will be OPSEC in-briefed by the assigned unit/directorate’s

OPSEC program manager/coordinator on the unit/directorate‘s OPSEC requirements within 30 days of assignment. Individual training will be developed and applied as required by the level of contact with AFSOC critical information.

6. OPSEC requirements, Critical Information Lists (CILs) and assistance can be found at the following:

7. OPSEC requirements and assistance can be found at the following:

Email: 1sow.io@hurlburt.af.mil

Contact: 1 SOW/IO at 884-4565