Atch_2_-_DD_Form_254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

ATTACHMENT 1

NORAD and USNORTHCOM – SECURITY GUIDANCE Continuation for DD 254 Block 13

ITEM 10: Remarks:

Ref. 10.e (1, 2): SCI requirements apply. Contractor takes its SCI guidance from HQ NORAD and USNORTHCOM J24S, SSO. Contractor will advise SSO of any security issues.

Ref. 10f. Access to SAP information requires a final U.S. Government clearance at the appropriate level. Contractor requires access to SIPR network, a NATO briefing for all appropriate contractor personnel is required due to NATO information residing on the SIPR network. Actual knowledge of, generation or production of NATO information is not required for the performance of the contract.

Ref. 10.h.: Access requires a final U.S. Government clearance at the appropriate level. (SECRET//REL TO USA, AUS, CAN, GBR, NZL)

Ref 10j.: DoD Components; refer to DoDM 5200.01, Volume 4, “DoD Information Security Program: Controlled Unclassified Information (CUI),” available at http://www.esd.whs.mil/DD/DoD-Issuances/, when considering protection for CUI. Non-DoD Components must consult with their Component specific information security policy office to determine if they have any existing authority by law, government-wide policy or government- wide regulation to impose this requirement.

ITEM 11: Remarks:

Ref. 11.e: Contract is for equipment maintenance services on equipment which processes classified information. Actual knowledge of, generation, or production of classified information is not required for performance of the contract. Cleared personnel are required to perform this service because access to classified information cannot be precluded by escorting personnel.

Ref. 11.i.: See Attached EMSEC requirements.

NOTE: See AFSSI 7700, Emission Security, for additional guidance and requirements.

Ref. 11.j.: See Attached OPSEC requirements. (Attachment 3)

ITEM 13: Security Guidance Remarks:

The contractor requires access to classified source data up to and including TOP SECRET in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of Multiple sources on the classified by line necessitates compliance with the NISPOM (or DoD 5200.1-R, Amendments identified in SECDEF Memo dated 16 April 2004, “Interim Information Security Guidance” addressing changes made by Executive Order 12958, “Classified National Security Information, and AFI 16-1404, Air Force Information Security Program, 29 May 2016, (if operating on an Air Force installation), and use of bibliography. Applicable Security Classification Guides include the following (as amended):

· DoD 5220.22-M, National Industrial Security Program Operating Manual

· DoDD 5220.22-R, Industrial Security Regulation

· DoD 5220.22-S, COMSEC supplement to the Industrial Security Manual

· DoDD 5230.9 Clearance of DOD Information for Public Release

· DODI S-3600.2 Information Operation Security Classification Guidance

· DoD 5105.21-M-1, Sensitive Compartmented Information Administrative Security Manual, Aug 1998

· DoDD 5200.1, Information Security Program, Jan 1997

· DoDD 5200.2, Personnel Security Program, Jan 1987

· DoDD 5240.1, DoD Intelligence Activities, 25 Apr 1988

· DoDD 5240.2, DoD Counter Intelligence (CI), 22 May 1997

· DoDI 5240.6, Counterintelligence (CI) Awareness and Briefing Program, 16 Jul 1996

· DoDI S-5240.9, Support to DoD Offensive Counterintelligence Operations (OFCO), 28 Nov 89

· DoDI 5240.10, DoD Counterintelligence Support to Unified and Specified Commands, 18 May 1990 w/Change #1, 8 Apr 1992

· DoDD 5105.67, DoD Counterintelligence Field Activity, 19 Feb 2002

· DoDD O-8530.1, Computer Network Defense (CND), 8 Jan 2001

· DoDI O-8530.2, Support to Computer Network Defense (CND), 9 Mar 2001

· CJCS Notice 5114, Implementation of E.O. 12958 – Classified National Security Information

· CJCS Notice 5121, Implementation of E.O. 13142 – Amendment to E.O. 12958 – Classified National Security Information

· CJCSI 3170.01B, Requirements Generation System, 15 Apr 2001

· CJCSM 3213.02A, Joint Staff Focal Point Communications Procedures Manual, 31 Jan 97, CH 1 08 Aug 2003

· EAP CJCS Volume I, Appendix (Security Classification Guide), 1 Sep 04

· CCJCSM 5222.01B, 28 Feb 2005, National Military Command System (NMCS) Security Classification Manual

· CJCSI 3231.01A, 7 Jan 00, Safeguarding the Single Integrated Operational Plan (SIOP), OPR JS-J3

· Air Force Instruction (AFI) 14-303, Release of Collateral Intelligence to U.S. Contractors

· AFI 10-701 Operation Security (OPSEC)

· AFI 16-1406, Air Force Industrial Security Program, 25 Aug 2015

· Air Force Handbook (AFH) 31-602, Industrial Security Program, 1 Feb 97

· DCID 1/7, Security Controls on the Dissemination of Intelligence Information, 30 Jun 1998

· DCID 6/1, Security Policy for Sensitive Compartmented Information and Security Policy Manual

· DCID 6/4, Personnel Security Standards and Procedures for Governing Eligibility for Access to Sensitive Compartmented Information (SCI), 13 Oct 1999, including Annexes A-F

· DCID 6/3, Protecting Sensitive Compartmented Information within Information Systems, 5 Jun 1999

· DCID 6/5, Policy for protection of certain non-SCI Sources And Methods Information (SAMI), 12 Feb 2001

Additional SCG guidance will be provided as required

ATTACHMENT 2

NORAD and USNORTHCOM SPECIAL SECURITY OFFICE (SSO) - SCI SUPPLEMENT

ITEM 13b: The SCIFs at HQ NORAD-USNORTHCOM will be used to perform SCI contractual requirements. SCI material released to the contractor under this contract will be separately stored and maintained only in such properly accredited facilities. Non NORAD-USNORTHCOM SCIFs will be used only when covered by a co-utilization Memorandum of Agreement (MOA) between HQ NORAD-USNORTHCOM and the sponsor of the facility. The supporting SSO is HQ NORAD-USNORTHCOM SSO.

ITEM 13c: The following documents with subsequent revisions or changes will be used for specific SCI security classification guidance on this contract:

AFMAN 14-304 DoD 5105.21-M-1

Signals Intelligence Security Regulation (SISR). DCID 6/9, DCID 6/3, DCID 6/4 Joint DoDIIS / Cryptologic SCI Information Systems Security Standards (JDCSISSS)

ITEM 13d: Inquires pertaining to classification guidance on SCI will be directed to the Contract Monitor.

ITEM 13e: SCI data furnished to or generated by the contractor will require security handling and controls beyond those in the National Industrial Security Program Operating Manual (NISPOM). These supplemental instructions will be furnished and/or made available to the contractor through the Contract Monitor by the User Agency Special Security Office, HQ NORAD and USNORTHCOM SSO.

ITEM 13f: Names of contractor personnel requiring access to SCI will be submitted to the SCI Control Monitor (CM). The contractor will provide HQ NORAD and USNORTHCOM SSO an SCI manpower list showing job description of each SCI position, levels of access required per position, and statement of work justifying SCI-level clearances through the COR.

ITEM 13g: The contractor will establish and maintain a current access list of those employees (by position) working on this contract. A copy of this list will be provided to the SCI Contract Monitor (CM).

ITEM 13h: The contractor will advise the SCI Contract Monitor (CM) immediately upon reassignment of personnel to other duties not associated with this contract. The COR and unit Security Manager will ensure that HQ NORAD and USNORTHCOM SSO is notified and the individual is debriefed from SCI access by HQ NORAD and USNORTHCOM SSO.

ITEM 13i: Release of Information. SCI with restrictive caveats (e.g. ORCON, PROPIN, etc) will be released to contractors only when originator approval has been obtained. The contractor will control SCI which has been originated or obtained under this contract as follows: The contractor may release such material to any contractor employee working against a position under this contract only when need-to- know exists. The contractor will release such material to any Special Security Office personnel assigned to HQ NORAD and USNORTHCOM or DIA upon demand by such personnel. The contractor may release such material to any other personnel, including contractor and subcontractor employees, and employees of any Federal Government agency, only upon prior written approval from the SCI Contract

Monitor. An access certification to a NORAD and USNORTHCOM contractor-occupied SCIF does not constitute approval to release NORAD and USNORTHCOM contractual material to these other personnel; Contract Monitor approval is nevertheless required. Contract Monitor approval of a NORAD and USNORTHCOM contractor visit certification or permanent certification to another facility will constitute approval to discuss contractual material at the facility to be visited.

ITEM 13j: Any SCI release to the contractor in support of this contract remains the property of the DoD department, agency, or command that releases it. The contractor will maintain active accountability of all SCI released to his custody, regardless of whether the release is within a contractor or US Government SCIF. Upon completion/cancellation of the contract, the contractor must return all such material to HQ NORAD and USNORTHCOM SSO unless a follow-on contract specifies that material will be transferred to a subsequent contract. SCI inventories will be conducted IAW DIA Manual 50-14.

ITEM 13l: Defense Courier Service is not required under this contract. ITEM 13m: Electronic processing of SCI is not permitted.

ITEM 13n: Contractor Special Security Officers (CSSOs) must coordinate with the SCI Contract Monitor, and obtain the concurrence of HQ NORAD-USNORTHCOM SSO prior to subcontracting any portion of SCI efforts involved in this contract.

ITEM 13o: No contractor personnel will be granted access to SCI material under this contract unless they are filling a DoD SCI position. The contractor will coordinate with the SCI Contract Monitor to ensure adequate positions are requested under this contract. Multiple contract employees sponsored by organizations other than HQ NORAD and USNORTHCOM must be certified to HQ NORAD and USNORTHCOM for use on this contract.

ITEM 13p: The contractor will nominate a CSSO to HQ NORAD and USNORTHCOM SSO. HQ NORAD and USNORTHCOM SSO will submit nominations for appointment by HQ NORAD and USNORTHCOM. The contractor will designate a Special Security Point of Contact (POC) to HQ NORAD and USNORTHCOM SSO. The POC will be responsible for all personnel and information security transactions between the contractor and HQ NORAD and USNORTHCOM SSO.

ITEM 13q: Contractor will not use references to SCI accesses, even by unclassified acronyms, in advertising, promotional efforts, or recruitment for employees.

ITEM 13r: The following activity is designated as the User Agency SSO for SCI requirements IAW DIA Manual 50-14: HQ NORAD and USNORTHCOM, Special Security Office, Peterson AFB, CO 80914.

ATTACHMENT 3

NORAD and USNORTHCOM – OPSEC

Addendum to DD Form 254 – Item 11j

GENERAL:

1. PURPOSE: This section outlines the requirements and procedures necessary to protect Critical Information for Operations Security (OPSEC).

2. MISSION: To maintain a continuing awareness of adversary interest in center actions and adversary intelligence collection capabilities. To understand the need to identify and protect classified and unclassified indicators, which occur, reveal sensitive information. To evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

3. DEFINITION: OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

a. Identify those actions that can be observed by adversary intelligence systems.

b. Determine indicators hostile intelligence systems might obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

c. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

4. OBJECTIVES:

a. To protect planned operational center activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

b. To preserve secrecy concerning specific scenario events and a NORAD response to these events.

c. To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. TASKS: Task requirements are outlined in the Statement of Work for this effort and at minimum must include:

a. Release of the organizations Critical Information List to the contractor.

b. Threat information available (Threat Working Group Minutes).

c. Contractor receiving OPSEC training from the sponsoring organization.

d. Specific OPSEC countermeasures as needed.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, MAY 2019

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

20220531 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification whs.mc-alex.esd.mbx.formswebmaster@mail.mil

WHS

List of Attachments [3] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form) DD254_ATTACHMENT 1_Block 13 Continuation.docx DD254_ATTACHMENT 2_SCI Supplement.docx DD254_ATTACHMENT 3_OPSEC.docx

N/A

N/A CSO: Headquarters NORAD and USNORTHCOM/CSMS 250 Vandenberg Street, Suite B016 Peterson AFB, CO 80914-3819 CSO: Headquarters NORAD and USNORTHCOM/CSMS 250 Vandenberg Street, Suite B016 Peterson AFB, CO 80914-3819

250 Vandenberg Street, Suite B016 Peterson AFB, CO 80914-3814 Location: Cheyenne Mountain Air Force Station (CMAFS) 1 NORAD Road Colorado Springs, CO 80914

Special Security Office / NORAD and USNORTHCOM/J2

Public Release POC: N&NC Public Affairs Office, 719-554-6889

Industrial Security Specialist

Peterson Air Force Base, CO 80914