Attachment_4_DD_254.docx

DEPARTMENT OF DEFENSE

1. CLEARANCE AND SAFEGUARDING

TOP SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

a. PRIME CONTRACT NUMBER

Date of award

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs) Revision No.

Date (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER

FA2517-17-Q-6014

Due Date (YYYYMMDD) To be entered by CO for the RFP due date

|X|

NO. If Yes complete the following

Classified material received or generated under FA2517-16-F-6000 (Preceding Contract Number) is transferred to this follow-on contract

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

7. SUBCONTRACTOR

8. ACTUAL PERFORMANCE

Headquarters NORAD and USNORTHCOM/J6 250 Vandenberg Street, Suite B016 Peterson AFB, CO 80914-3814

250 Vandenberg Street, Suite B016 Peterson AFB, CO 80914-3819

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

COMMAND AND CONTROL C2 SYSTEMS, VIDEO TELECOMMUNCIATIONS (VTC) SUITE MAINTENANCE SUPPORT. Contractor to perform maintenance / warranty support as needed when called for Tier 3 Maintenance Support at NORTH AMERICAN AEROSPACE DEFNSE COMMAND AND UNITED STATE NORTHERN COMMAND (NORAD and USNORTHCOM) Headquarters, Building 2, the General Officer Quarters (GO/FO) on Peterson Air Force Base, and Cheyenne Mountain Air Force Station, Colorado Springs, CO. Government Escort will be provided as necessary.

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

e. INTELLIGENCE INFORMATION:

k. OTHER Specify)

DD Form 254, DEC 1999 Previous editions are obsolete

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct |X|

Through (Specify):

No public release of information authorized, public disclosure or confirmation of any subject related to the support contract is not authorized without first obtaining written approval from the Contracting Officer.

Public Release POC: N&NC Public Affairs Office, 719-554-6889 250 Vandenberg St., Bldg 2 Peterson AFB, CO 80914-3809 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance. See Attachment (3): See continuation sheet for Attachment 1, 2, 3, & 4 (attached).

Babette C. Whorley, DAFC Debra Helle, DAFC N&NC/J68, N-NC/J6, Security Manager N&NC/J66, Primary Contracting Officer Representative

Josephine A. Spiridigliozzi, DAFC Douglas Nielsen, DAFC N&NC/CSMS, Industrial Security Specialist N&NC/J66, Alternate Contracting Officer Representative

Thomas J. Clark N&NC/J2, Special Security Office

Provide the information requested by AFFARS 5352.204-9000, Notification of Government Security Activity Clause, and AFI 16-1406, Air Force Industrial Security Program, to the Command Security Office (CSMS). Refer to the contract document for these clauses. Shipments of classified or sensitive equipment shall be handled, transported, transmitted and protected IAW NISPOM, DoD 5220.22M and as specified by unit directives. The contractor shall execute a VGSA with the government.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

No

DSS is relieved of inspection responsibility for all classified material that is released to or developed by the contractor while on a military installation. DSS retains inspection responsibility for all non-SCI classified material released to or developed by the contractor and held in the contractors’ facility. The SSO maintains inspection responsibility for all SCI material related to this contract. Information Protection Management Evaluations (IPME) while operating on an Air Force installation shall be conducted by the HQ N&NC/CSMS. HQ N&NC/SSO retains security cognizance of all Intelligence materials released to the contractor.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

TBD

b. TITLE

Contracting Officer

c. TELEPHONE (Include Area Code)

719-

21st Contracting Squadron/LGCBB 135 Dover St, Ste. 2204 Peterson AFB, CO 80914 |X|

a. CONTRACTOR

b. SUBCONTRACTOR

|X|

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

|X|

e. ADMINISTRATIVE CONTRACTING OFFICER

|X|

f. OTHERS AS NECESSARY: HQ NORTHCOM CS

HQ N&NC/J2 SSO

DD Form 254 (BACK), DEC 1999

ATTACHMENT 1

CONTINUATION – DD FORM 254

FA2517-17-Q-6014

ITEM 8: Additional Support Locations:

1. Primary support location: Headquarters (HQ) NORAD and USNORTHCOM, Bldg. 2, Peterson AFB Colorado 80914

2. The contract also requires access to the General Officer and Field Grade Officer Quarters (GO/FO) on Peterson AFB CO 80914.

3. The contract also requires access to Cheyenne Mountain Air Force Station (CMAFS), 1 NORAD Rd. Colorado Springs, CO 80914

ITEM 10: Remarks:

Ref. 10.e (1, 2): SCI requirements apply. Contractor takes its SCI guidance from HQ NORAD and USNORTHCOM J24S, SSO. Contractor will advise SSO of any security issues.

Ref. 10.j.: See DoDM 5200.01, Volume 4, Enclosure 3 for specific FOUO information.

ITEM 11: Remarks:

Ref. 11.e: Contract is for equipment maintenance services on equipment which processes classified information. Actual knowledge of, generation, or production of classified information is not required for performance of the contract. Cleared personnel are required to perform this service because access to classified information cannot be precluded by escorting personnel.

Ref. 11.j.: See Attached OPSEC requirements. (Attachment 4)

ITEM 13: Security Guidance Remarks:

The contractor requires access to classified source data up to and including TOP SECRET in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of Multiple sources on the classified by line necessitates compliance with the NISPOM (or DoD 5200.1-R, Amendments identified in SECDEF Memo dated 16 April 2004, “Interim Information Security Guidance” addressing changes made by Executive Order 12958, “Classified National Security Information, and AFI 16-1404, Air Force Information Security Program, 29 May 2016, (if operating on an Air Force installation), and use of bibliography. Applicable Security Classification Guides include the following (as amended):

· DoD 5220.22-M, National Industrial Security Program Operating Manual

· DoDD 5220.22-R, Industrial Security Regulation

· DoD 5220.22-S, COMSEC supplement to the Industrial Security Manual

· DoDD 5230.9 Clearance of DOD Information for Public Release

· DODI S-3600.2 Information Operation Security Classification Guidance

· DoD 5105.21-M-1, Sensitive Compartmented Information Administrative Security Manual, Aug 1998

· DoDD 5200.1, Information Security Program, Jan 1997

· DoDD 5200.2, Personnel Security Program, Jan 1987

· DoDD 5240.1, DoD Intelligence Activities, 25 Apr 1988

· DoDD 5240.2, DoD Counter Intelligence (CI), 22 May 1997

· DoDI 5240.6, Counterintelligence (CI) Awareness and Briefing Program, 16 Jul 1996

· DoDI S-5240.9, Support to DoD Offensive Counterintelligence Operations (OFCO), 28 Nov 89

· DoDI 5240.10, DoD Counterintelligence Support to Unified and Specified Commands, 18 May 1990 w/Change #1, 8 Apr 1992

· DoDD 5105.67, DoD Counterintelligence Field Activity, 19 Feb 2002

· DoDD O-8530.1, Computer Network Defense (CND), 8 Jan 2001

· DoDI O-8530.2, Support to Computer Network Defense (CND), 9 Mar 2001

· CJCS Notice 5114, Implementation of E.O. 12958 – Classified National Security Information

· CJCS Notice 5121, Implementation of E.O. 13142 – Amendment to E.O. 12958 – Classified National Security Information

· CJCSI 3170.01B, Requirements Generation System, 15 Apr 2001

· CJCSM 3213.02A, Joint Staff Focal Point Communications Procedures Manual, 31 Jan 97, CH 1 08 Aug 2003

· EAP CJCS Volume I, Appendix (Security Classification Guide), 1 Sep 04

· CCJCSM 5222.01B, 28 Feb 2005, National Military Command System (NMCS) Security Classification Manual

· CJCSI 3231.01A, 7 Jan 00, Safeguarding the Single Integrated Operational Plan (SIOP), OPR JS-J3

· Air Force Instruction (AFI) 14-303, Release of Collateral Intelligence to U.S. Contractors

· AFI 10-701 Operation Security (OPSEC)

· AFI 16-1406, Air Force Industrial Security Program, 25 Aug 2015

· Air Force Handbook (AFH) 31-602, Industrial Security Program, 1 Feb 97

· DCID 1/7, Security Controls on the Dissemination of Intelligence Information, 30 Jun 1998

· DCID 6/1, Security Policy for Sensitive Compartmented Information and Security Policy Manual

· DCID 6/4, Personnel Security Standards and Procedures for Governing Eligibility for Access to Sensitive Compartmented Information (SCI), 13 Oct 1999, including Annexes A-F

· DCID 6/3, Protecting Sensitive Compartmented Information within Information Systems, 5 Jun 1999

· DCID 6/5, Policy for protection of certain non-SCI Sources And Methods Information (SAMI), 12 Feb 2001

· Executive Order 12333, United States Intelligence Activities, 4 Dec 1981, as amended 24 Jan 2003

· Executive Order 12958, Classified National Security Information, 17 Apr 1995, as amended 25 Mar 2003

· Executive Order 12968, Access to Classified Information, 4 Aug 1995

· Executive Order 12972, Amendment to EO 12958, 19 Sep 1995

· Executive Order 13231, Critical Infrastructure Protection in the Information Age, 16 Oct 2001

· PDD-62, Combating Terrorism, 22 May 1998

· PDD-63, Protecting America’s Critical Infrastructure, 22 May 1998

· National Security Strategy

· National Military Strategy

· National Response Plan

· Defense Planning Guidance

· Unified Command Plan, 1 Oct 2002

· Joint Planning Document

· Homeland Security Presidential Directive/HSPD-5, Management of Domestic Incidents, 28 Feb 2003

· USA Patriot Act, 24 Oct 2001

· National Strategy for the Physical Protection of Critical Infrastructure and Key Assets, Feb 2003

· SECDEF message, DoD Intelligence and Law Enforcement Policy to Support the War on Terrorism and Enhanced Domestic Force Protection, 4 Apr 2003

· DEPSECDEF Memorandum, Collection, Reporting and Analysis of Terrorist Threats to DoD within the U.S., 2 May 2003

· DEPSECDEF Memorandum, Implementation Guidance on Restructuring Defense Intelligence-and Related Matters, 8 May 2003

· DCI Memorandum, Homeland Security Information Sharing Memorandum of Understanding, 4 Mar 03

· JP 1, Joint Warfare of the Armed Forces of the United States, 14 Nov 2000

· JP 2-0, Doctrine for Intelligence Support to Joint Operations, 9 Mar 2000

· JP 2-01.2, Joint Doctrine and Tactics, Techniques and Procedures for Counterintelligence Support to Operations, 7 May 2002

· JP 3-0, Doctrine for Joint Operations, 10 Sep 2001

· JP 5-0, Doctrine for Planning Joint Operations, 13 Apr 1995

· Joint DoDIIS / Cryptologic SCI Information Systems Security Standards, 11 Apr 2003

· DIA Manual (DIAM) 50-4, Department of Defense (DoD), Intelligence Information System (DoDIIS), Information Systems Security (INFOSEC) Program, 30 Apr 1997

· DIAM 50-24, Security for Using Communications Equipment in a SCIF, 31 Aug 1990

· USNORTHCOM Ballistic Missile Defense (BMD) Operations Security Classification Guide (SCG), 1 Jan 05

· Missile Defense Agency (MDA) Ground-based Missile Defense (GMD) SCG, 6 Sep 02

· Missile Defense Agency (MDA) Ballistic Missile Defense System (BMDS) SCG, 26 Apr 04

· USSTRATCOM Global Ballistic Missile Defense (GBMD)SCG, dated 18 Oct 04

· NC HOI 10-220,”USNORTHCOM Focal Point Program”

· USNORTHCOM Mobile Consolidated Command Center (MCCC) SCG, 14 Apr 03

· Integrated Tactical Warning System and Attack Assessment (ITW/AA) System SCG, 22 Sep 00. OPR is NORAD J33

Additional SCG guidance will be provided as required

ATTACHMENT 2

NORAD and USNORTHCOM SPECIAL SECURITY OFFICE (SSO) - SCI SUPPLEMENT

ITEM 13a: Contract Expiration date (13 March 18)

ITEM 13b: The SCIFs at HQ NORAD-USNORTHCOM will be used to perform SCI contractual requirements. SCI material released to the contractor under this contract will be separately stored and maintained only in such properly accredited facilities. Non NORAD-USNORTHCOM SCIFs will be used only when covered by a co-utilization Memorandum of Agreement (MOA) between HQ NORAD-USNORTHCOM and the sponsor of the facility. The supporting SSO is HQ NORAD-USNORTHCOM SSO.

ITEM 13c: The following documents with subsequent revisions or changes will be used for specific SCI security classification guidance on this contract:

AFMAN 14-304

DoD 5105.21-M-1 Signals Intelligence Security Regulation (SISR). DCID 6/9, DCID 6/3, DCID 6/4 Joint DoDIIS / Cryptologic SCI Information Systems Security Standards (JDCSISSS)

ITEM 13d: Inquires pertaining to classification guidance on SCI will be directed to the Contract Monitor.

ITEM 13e: SCI data furnished to or generated by the contractor will require security handling and controls beyond those in the National Industrial Security Program Operating Manual (NISPOM). These supplemental instructions will be furnished and/or made available to the contractor through the Contract Monitor by the User Agency Special Security Office, HQ NORAD and USNORTHCOM SSO.

ITEM 13f: Names of contractor personnel requiring access to SCI will be submitted to the SCI Control Monitor (CM). The contractor will provide HQ NORAD and USNORTHCOM SSO an SCI manpower list showing job description of each SCI position, levels of access required per position, and statement of work justifying SCI-level clearances through the COR.

ITEM 13g: The contractor will establish and maintain a current access list of those employees (by position) working on this contract. A copy of this list will be provided to the SCI Contract Monitor (CM).

ITEM 13h: The contractor will advise the SCI Contract Monitor (CM) immediately upon reassignment of personnel to other duties not associated with this contract. The COR and unit Security Manager will ensure that HQ NORAD and USNORTHCOM SSO is notified and the individual is debriefed from SCI access by HQ NORAD and USNORTHCOM SSO.

ITEM 13i: Release of Information. SCI with restrictive caveats (e.g. ORCON, PROPIN, etc) will be released to contractors only when originator approval has been obtained. The contractor will control SCI which has been originated or obtained under this contract as follows: The contractor may release such material to any contractor employee working against a position under this contract only when need-to-know exists. The contractor will release such material to any Special Security Office personnel assigned to HQ NORAD and USNORTHCOM or DIA upon demand by such personnel. The contractor may release such material to any other personnel, including contractor and subcontractor employees, and employees of any Federal Government agency, only upon prior written approval from the SCI Contract Monitor. An access certification to a NORAD and USNORTHCOM contractor-occupied SCIF does not constitute approval to release NORAD and USNORTHCOM contractual material to these other personnel; Contract Monitor approval is nevertheless required. Contract Monitor approval of a NORAD and USNORTHCOM contractor visit certification or permanent certification to another facility will constitute approval to discuss contractual material at the facility to be visited.

ITEM 13j: Any SCI release to the contractor in support of this contract remains the property of the DoD department, agency, or command that releases it. The contractor will maintain active accountability of all SCI released to his custody, regardless of whether the release is within a contractor or US Government SCIF. Upon completion/cancellation of the contract, the contractor must return all such material to HQ NORAD and USNORTHCOM SSO unless a follow-on contract specifies that material will be transferred to a subsequent contract. SCI inventories will be conducted IAW DIA Manual 50-14.

ITEM 13k: A SCIF must be established and maintained by the contractor. SCI material released to the contractor under this contract will be separately stored and worked on only in facilities either accredited through HQ NORAD and USNORTHCOM, or another accredited agency or properly covered by a co-utilization Memorandum of Agreement (MOA) between HQ NORAD and USNORTHCOM and the sponsor of the facility. HQ NORAD and USNORTHCOM sponsored SCIFs will not be co-utilized for other Government agency contracts unless properly covered by a MOA. The supporting SSO is HQ NORAD and USNORTHCOM SSO.

ITEM 13l: Defense Courier Service is not required under this contract.

ITEM 13m: Electronic processing of SCI is not permitted.

ITEM 13n: Contractor Special Security Officers (CSSOs) must coordinate with the SCI Contract Monitor, and obtain the concurrence of HQ NORAD-USNORTHCOM SSO prior to subcontracting any portion of SCI efforts involved in this contract.

ITEM 13o: No contractor personnel will be granted access to SCI material under this contract unless they are filling a DoD SCI position. The contractor will coordinate with the SCI Contract Monitor to ensure adequate positions are requested under this contract. Multiple contract employees sponsored by organizations other than HQ NORAD and USNORTHCOM must be certified to HQ NORAD and USNORTHCOM for use on this contract.

ITEM 13p: The contractor will nominate a CSSO to HQ NORAD and USNORTHCOM SSO. HQ NORAD and USNORTHCOM SSO will submit nominations for appointment by HQ NORAD and USNORTHCOM. The contractor will designate a Special Security Point of Contact (POC) to HQ NORAD and USNORTHCOM SSO. The POC will be responsible for all personnel and information security transactions between the contractor and HQ NORAD and USNORTHCOM SSO.

ITEM 13q: Contractor will not use references to SCI accesses, even by unclassified acronyms, in advertising, promotional efforts, or recruitment for employees.

ITEM 13r: The following activity is designated as the User Agency SSO for SCI requirements IAW DIA Manual 50-14: HQ NORAD and USNORTHCOM, Special Security Office, Peterson AFB, CO 80914.

Signature Blocks:

SSO: _________________________________________ Contract Monitor: _________________________________

ATTACHMENT 4

OPERATIONS SECURITY (OPSEC)

Addendum to DD Form 254, Item 11.j.

GENERAL:

1. PURPOSE: This section outlines the requirements and procedures necessary to protect Critical Information for Operations Security (OPSEC).

2. MISSION: To maintain a continuing awareness of adversary interest in center actions and adversary intelligence collection capabilities. To understand the need to identify and protect classified and unclassified indicators, which occur, reveal sensitive information. To evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

3. DEFINITION: OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

a. Identify those actions that can be observed by adversary intelligence systems.

b. Determine indicators hostile intelligence systems might obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

c. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

4. OBJECTIVES:

a. To protect planned operational center activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

b. To preserve secrecy concerning specific scenario events and a NORAD response to these events.

c. To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. TASKS: Task requirements are outlined in the Statement of Work for this effort and at minimum must include:

a. Release of the organizations Critical Information List to the contractor.

b. Threat information available (Threat Working Group Minutes).

c. Contractor receiving OPSEC training from the sponsoring organization.

d. Specific OPSEC countermeasures as needed.