Attachment_2_Tab_6_DD_FORM_254_-_STATC_FY-17.pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

TOP SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYMMDD)

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs) Revision No.

Date (YYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYMMDD)

FA0021-16-R-0040 161026

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under _______________ (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

Defense Security Service (IOFSA) 1899 Powers Ferry Road, Atlanta, GA 30339

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

720 STG/ATC

Hurlburt Field, FL 32544

***Multiple Locations, See Block 13***

N/A

See Block/Item 15 of this form

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

The Special Tactics Air Traffic Control (STATC) training will provide Air Traffic Control (ATC) training to Air Force Special Operations Command (AFSOC) units assigned with the STATC mission.

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR’S

FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify).

k. OTHER Specify)

Automated Information Systems

NIPRNET

NONE

DD Form 254 (Dec 99)

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

Direct

Through (Specify):

Public Release of classified information, to include SCI is not authorized. Contractor will obtain contracting officer approval IAW DFAR 252.204-7000 for unclassified release. All releases will be coordinated with:

HQ AFSOC/PA

229 C9D6, STE 103

Hurlburt Field, FL 32544

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.

1. Supported USAF organizations will provide security classification guides and other classification guidance to the contractor as required for contract performance.

Contractors will comply with all Hurlburt Field, supported unit and special program requirements.

2. Classified markings on all working, draft, and final copies of deliverable material shall be in accordance with Executive Order 13526, The Controlled Access Program Coordination Office (CAPCO) guidelines, DOD 5220.22-M, DoD 5200.1R and applicable instructions contained in the respective security classification guides.

3. For on-base contractors, the NISPOM security standards can be satisfied by incorporating AFI 31-401, Information Security Program Management and AFI 31-601, Industrial Security Program Management, requirements into the Visitor Group Security Agreement.

4. All classified material provided by AFSOC shall be returned by the contractor at contract completion. Individuals are responsible for Safeguarding classified information entrusted to them.

5. Use only AF certified AIS for performance on base and will comply with all AF AIS procedures.

Ref Item 1a: TS ACCESS AT POPE AND FT BRAGG ONLY Ref Item 8a: 21 STS, JB-Pope-Bragg, NC 28308 (Assigned location with simulator); 22 STS, McChord AFB, WA 98438-1326 (Assigned location with simulator); 23 STS, 601 Independence Road, Hurlburt Field, FL 32544 (Assigned location with simulator); STTS, 100 Servais Way, Hurlburt Field, FL 32544 (Assigned location with simulator); 21 STS, JB-Pope-Bragg, NC 28308 (Co-located support as required); 26 STS, Cannon AFB, NM (TDY Support); 320 STS, Kadena AB, Okinawa APO 96367 (TDY support); 321 STS, RAF Mildenhall, England APO 09127 (TDY support);123 STS, Air National Guard, Louisville, KY 40213 (TDY support); 125 STS, Air National Guard, Portland, OR 97216 (TDY support) Ref Item 10g: Access to NATO information requires a final US Government clearance at the appropriate level. The AFSOC NATO Registry can be contacted at 850-884- 5909.

Ref Item 10h: This item includes any foreign Government information except NATO. Access to foreign government information requires a final US Government clearance at the appropriate level. Contractor employees will be briefed, and acknowledge in writing, their responsibilities for handling foreign government information prior to being granted access. The contractor will maintain strict compliance with NISPOM Ch 10. Prior approval of the contracting activity is required for subcontracting. All foreign visits will be coordinated in advance with the AFSOC Foreign Disclosure Office (850) 884-4096.

Ref Item 11a: The highest level of security clearance required for contract performance is (Top Secret). Using activities will provide security classification guidance for performance of this contract. The government will oversee the handling and storage of classified information in support of this contract. The government will provide storage capability for all classified material required for this contract. All classified information shall be returned to the government upon termination of the contract.

Ref Item 11e: Contract is for training services only. Classification markings on the material to be furnished will provide the guidance necessary for performance of the contract.

FREDDY S. STOKES, GS-12, DAF ROBERT B. JEFFERS, GS-11, DAF PATRICK H. KICK, GS-12, DAF Program Manager Alternate Security Manager Chief, Servicing Security Agency

(850) 884-3706 (850) 884-6055 1 SOW/IPC (850) 884-5143

** See attached addendums for items 10h, j, k and 11 j **

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office.

Use Item 13 if additional space is needed.)

Yes No

Provide the information requested by the Notification of Government Security Activity clause and Visitor Group Security Agreements Clause, AFFARS 5352.204-9000, to the Servicing Security Activity indicated in Item 13 above. Refer to the contract document for these clauses. The visitor group will operate per DoD 5200.1-R, AFI 31-401, AFI 31-601, Hurlburt Field supplements and unit security program operating instructions, plans and procedures. See appropriate addendum.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

Long term visitor groups will be inspected as part of the supported organizations annual Information Security Program Review, conducted by the SSA, while operating on an Air Force Installation. The contractor will comply with the visitor group security agreement provided by the USAF Program/Project Manager at the performance location.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

MARIA JAINE A. SIPIN

b. TITLE

Contracting Officer

c. TELEPHONE (Include Area Code)

850-884-7829

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

AFICA / 765 SCONF

427 CODY AVE

HURLBURT FIELD FL 32544-5434

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY 1 SOW/IPC

LAST REVIEWED/UPDATED

June 2016

ADDENDUM TO DD FORM 254 (BLOCK 10h)

FOREIGN GOVERNMENT INFORMATION

1. Foreign Government Information is information provided to the United States by a foreign government other than NATO. The contractor is permitted access to Foreign Government In-formation, in the performance of this contract. Access to Foreign Government Information re-quires a U.S. Government clearance at the appropriate level. Comply with the requirements in the NISPOM Chapter 10, Section 3. Prior approval of contracting and foreign disclosure officer is required before subcontracting.

2. Questions/Concerns with Foreign Government Information must be coordinated/directed with the Contracting Officer and Program Manager.

3. Questions/Concerns with Foreign Visits must be coordinated in advance with AFSOC For-eign Disclosure Office: DSN 579-4714 or Comm (850) 884-4714.

ADDENDUM TO DD FORM 254 (BLOCK 10j)

FOR OFFICIAL USE ONLY (FOUO)

(References: DoD Manual 5200.01, Volume 4, February 24, 2012 and DoD Directive

5400.7/Air Force Supplement, 22 July 1999)

1. GENERAL: "For Official Use Only (FOUO)" is a designation that is applied to unclassified information that may be exempt from mandatory release to the public under the Freedom of In-formation Act (FOIA) (reference (g)). The FOIA specifies nine exemptions that may qualify cer-tain information to be withheld from release to the public if, by its disclosure, a foreseeable harm would occur. FOUO is information that has not been given a security classification pursuant to the criteria of an Executive Order. Additional information on FOUO may be obtained by con-tacting the User Agency. FOUO is assigned to information at the time it is created in a DoD

Agency or derivatively.

2. MARKING:

a. FOUO information received (released by a DoD component) should contain the follow-ing marking, when received: THIS DOCUMENT CONTAINS INFORMATION EXEMPT

FROM MANDATORY DISCLOSURE UNDER FOIA. EXEMPTION(S) ___

APPLIES/APPLY.

b. Information that has been determined to qualify for FOUO status should be indicated by markings when included in documents and similar material. Markings should be applied at the time documents are drafted, whenever possible, to promote proper protection of the in-formation. Unclassified documents and material containing FOUO information shall be marked as follows:

“Documents will be marked "FOR OFFICIAL USE ONLY" at the bottom of the front cover (if there is one), the title page (if there is one), the first page, and the outside of the back cover (if there is one). Pages of the document that contain FOUO infor-mation shall be marked "FOR OFFICIAL USE ONLY" at the bottom. Each para-graph containing FOUO information shall be marked as such. Material other than pa-per documents (for example, slides, computer media, films, etc.) shall bear markings that alert the holder or viewer that the material contains FOUO information.”

c. Within a classified document, an individual page that contains both FOUO and classified information shall be marked at the top and bottom with the highest security classification of information appearing on the page. Individual paragraphs shall be marked at the appropriate classification level, as well as unclassified or FOUO, as appropriate. An individual page that contains FOUO information but no classified information shall be marked “FOR OFFICIAL

USE ONLY” at the top and bottom of the page, as well as each paragraph that contains

FOUO information. NOTE: For “production efficiency” the entire document may be marked top and bottom with the highest level of classification contained within it, as long as every paragraph is marked to reflect the specific classification of the information it contains.

d. Mark other records, such as computer print outs, photographs, films, tapes, or slides 'FOR

OFFICIAL USE ONLY" so that the receiver or viewer knows the record contains FOUO in-formation.

e. Mark each part of a message that contains FOUO information. Unclassified messages con-taining FOUO information must show the abbreviation "FOUO" before the text begins.

3. ACCESS: Access to FOUO Information. FOUO information may be disseminated within the

DoD Components and between officials of the DoD Components and DoD contractors, consult-ants, and grantees as necessary in the conduct of official business. FOUO information may also be released to officials in other Departments and Agencies of the Executive and Judicial Branch-es in performance of a valid Government function. (Special restrictions may apply to infor-mation covered by the Privacy Act, reference (h).) Release of FOUO information to Members of

Congress is covered by DoD Directive 5400.4 (reference (gg)) and to the General Accounting

Office by DoD Directive 7650.1 (reference (ll)).

4. DISSEMINATION: FOUO may be disseminated between officials of DoD Components, DoD contractors, consultants and grantees to conduct official business for DoD. Recipients shall be made aware of the status of such information and transmission shall be by means that pre-clude unauthorized public disclosure. FOUO documents and material transmitted outside the

Department of Defense must bear an expanded marking on the face of the document so that non-

DoD holders understand the status of the information. A statement similar to this one should be used:

"This document contains information exempt from mandatory disclosure under the F0IA. Ex-emption(s) ______ apply.”

5. TRANSMISSION: FOUO information shall be transmitted in a manner that prevents disclo-sure of the contents. When not commingled with classified information, it may be sent via first-class mail or parcel post. Bulky shipments, i.e. testing materials, that otherwise qualify under postal regulations, may be sent by fourth-class mail. FOUO information may also be sent over facsimile equipment; however, when deciding whether to use this means, balance the sensitivity of the records against the risk of disclosure. Consider the location of sending and receiving ma-chines and ensure authorized personnel are available to receive the FOUO information as soon as it is transmitted. Transmittal documents shall call attention to the presence of FOUO attach-ments. FOUO information may also be sent via e-mail, if it is sent via a system that will prevent unintentional or unauthorized disclosure.

6. STORAGE: To safeguard FOR OFFICIAL USE ONLY records during normal duty hours, place them in an out-of-sight location if your work area is accessible to persons who do not have a valid need for the information. After normal duty hours, store FOUO records to prevent unau-thorized access. File them with other unclassified records in unlocked files or desks when nor-mal internal building security is provided. When there is no internal building security, locked buildings or rooms normally provide adequate after-hours protection. If such protection is not considered adequate, FOUO material shall be stored in locked containers such as file cabinets, desks, or bookcases. Expenditure of funds for security containers or closed areas solely for the protection of FOUO data is prohibited.

7. DESTRUCTION: When no longer needed, FOUO information shall be disposed of by any method that will preclude its disclosure to unauthorized individuals. Destruction of all FOUO, Unclassified, and Official Business related paper products on Hurlburt field is accomplished by shredding.

8. Direct any and all questions concerning FOUO to the 1 SOW/IPI Office at 884-4322.

ADDENDUM TO DD FORM 254 (BLOCK 10k)

AUTOMATED INFORMATION SYSTEMS

1. This section outlines the requirements, procedures and Air Force publications that must be adhered to by contractors as a condition of use of Hurlburt Field Automated Information Systems (AIS) and Local Area Networks (LAN).

2. Cybersecurity practices are the actions that protect information and information systems by ensuring their continued availability, integrity, confidentiality, and non-repudiation. This in-cludes providing for restoration of information systems by incorporating disaster recovery capa-bilities to ensure continuity of operations under all conditions.

3. Key publications governing the use and security of AF AIS are listed below. Many include additional publications by reference, which are equally applicable.

• AFSSI 7700, Emission Security

• AFI 33-200, Air Force Cybersecurity Program Management

• AFI 33-210, Air Force Certification and Accreditation (C&A) Program (AFCAP)

• AFMAN 33- 152, User Responsibilities and Guidance for Information Systems

• AFI 10-712, Cyberspace Defense Analysis (CDA) Operations and Notice and Consent

Process

4. All personnel are required to safeguard information and information systems against unau-thorized access, modification, destruction or disclosure.

5. Per the Hurlburt Field NIPRnet System Security Authorization Agreement (SSAA), contrac-tor owned hardware and software will not be connected to Hurlburt Field unclassified or classi-fied LAN.

6. Non-Air Force wireless network devices are forbidden on Hurlburt Field.

7. All portable electronic devices (PED) are prohibited from use or possession within Hurlburt Field buildings where classified information is processed, stored or discussed.

8. All information systems, software, and/or enclaves operating on Hurlburt Field must be certi-fied and accredited through the DoD Information Assurance Certification and Accreditation Pro-gram (DIACAP) prior to being implemented or connected to a network.

9. The 1 SOW Cybersecurity Office is the source for cybersecurity related information.

• Email: 1sow.ia@hurlburt.af.mil

• Contact: 1 SOCS/SCXS at (850) 884-6605 mailto:1sow.ia@hurlburt.af.mil

ADDENDUM TO DD FORM 254 (BLOCK 11j)

OPERATIONS SECURITY

1. This section outlines the requirements and procedures necessary for contractors to provide Operations Security (OPSEC) protection for AFSOC’s Critical Information (CI).

2. OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

• Identify those actions that can be observed by adversary intelligence systems.

• Determine which of those action are indicators to hostile intelligence systems which they can obtain and interpret or piece together to derive critical information in time to be useful for adversaries planning.

• Develop, select and execute countermeasures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

3. OPSEC principles are used to help assigned personnel:

• Maintain a continuing awareness of adversary interest in SOF actions and adversary intelligence collection capabilities.

• To understand the need to identify and protect unclassified indicators that reveal sensitive information.

• To evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

4. Our objectives are:

• Protect planned operational activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

• To preserve secrecy concerning specific scenario events and a USSOCOM or AFSOC response to these events.

• To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. AFSOC employed contractors will be OPSEC in-briefed by the assigned unit/directorate’s OPSEC program manager/coordinator on the unit/directorate‘s OPSEC requirements within 30 days of assignment. Individual training will be developed and applied as required by the level of contact with AFSOC critical information.

6. Unit OPSEC requirements, Critical Information Lists (CILs) and assistance can be found by contacting the unit specific OPSEC coordinator.

7. OPSEC requirements and assistance can be found at the following:

• AFI 10-701, Operations Security (OPSEC)

• Email: 1sow.io@us.af.mil

• Contact: 1 SOW/IO at 884-4565