Attach 5_SFOM Draft dd0254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

GEODSS DD Form 254

Attachment 2

OPERATIONS SECURITY (OPSEC)

Addendum to DD Form 254, Item 11.j.

1. PURPOSE: This section outlines the requirements and procedures necessary to protect Critical Information for Operations Security (OPSEC).

2. MISSION:

· To maintain a continuing awareness of adversary interest in center actions and adversary intelligence collection capabilities.

· To understand the need to identify and protect classified and unclassified indicators, which occur, reveal sensitive information.

· To evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

3. DEFINITION:

OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

· Identify those actions that can be observed by adversary intelligence systems.

· Determine indicators hostile intelligence systems might obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

· Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

4. OBJECTIVES:

· To protect planned operational center activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

· To preserve secrecy concerning specific scenario events and a NORAD response to these events.

· To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. TASKS:

Task requirements are outlined in the Performance Work Statement for this effort and at a minimum must include:

· Release of the organizations Critical Information List to the contractor.

· Threat information available (Threat Working Group Minutes).

· Contractor receiving OPSEC training from the sponsoring organization.

· Specific OPSEC countermeasures as needed.

Attachment 2

SCI ADDENDUM

1. Reference Block 14: This contract requires access to Sensitive Compartmented Information (SCI). Per (list applicable DoD publications, ICDs, DCIDs, DoDM 5105.21, Volumes 1,2 3 and AFMAN 14-401, Joint DoDISS Cryptologic SCI Information Systems Standards (JDCSISSS), NISPOM Supplement, etc.) provides the necessary guidance for physical, personnel, information and information systems security measures and is part of the SCI security specifications for the contract.

Executive Order 12333 – United States Intelligence Activities (AMMENDED by EO 13470, 2008)

Executive Order 13526 – Classified National Security Information (29 Dec 09) {replaced EO 12958}

ICD 503 - Information Systems

ICD and ICPGs 704 - Personnel Security

ICD and ICS/Tech Specs 705 - Physical Security

DCID 1/20P – Security Policy Concerning Travel and Assignment of Personnel with Access to SCI

DCID 6/1 – Security Policy for Sensitive Compartmented Information and Security Policy

DCID 6/9 - Physical Security (for facilities accredited under 6/9 standards)

DoDM 5105.21 V1, V2, V3 - SCI Administrative Security Manual(s)

DoDM 5200.01 V1, V2, V3, V4 – DoD Information Security

DoDM 5200.02 - Procedures for the DoD Personnel Security Program (PSP)

DoDM 5220.22 Volume 2 – National Industrial Security Program (NISP)

AFMAN 14-304 - Security, Use and Dissemination of SCI

AFMAN 16-1405 – Air Force Personnel Security Program

AFI 16-1404 – Air Force Information Security Program

AFI 16-1406 – Air Force Industrial Security Program

DIAM 50-4 - Defense Intelligence Agency Manual

NISPOM Supplement

NIST 800-53 Rev 4

2. Name, organization, telephone number and address of the Contract Officer Representative (COR) for the SCI portion of this contract is:

NameOffice SymbolPhone

3. All DD Form 254s prepared for subcontracts involving access to SCI under this contract must be forwarded to the COR for approval and then to (SSO, location) for review and concurrence prior to award of the contract. Inquiries pertaining to classification guidance on SCI will be directed to the COR listed in para. 2 above. SCI security management issues shall be directed to USSF SSO, 150 Vandenberg St., ste 1105, Peterson AFB, CO. 80914, DSN: 692-2402, Com: (719) 554-2402.

4. SCI access is subject to U.S. Government review and approval as outlined in the aforementioned SCI security guidance. Upon completion or cancellation of the contract, the SSO/CSSO will debrief all personnel not required for contract closeout and those positions will be disestablished.

5. Names of contractor personnel requiring access to SCI and justification for SCI access will be submitted for coordination and action to USSF SSO, Peterson AFB after the COR’s approval/concurrence. Upon receipt of written approval from the COR, the Facility Security Officer (FSO) and/or Contractor Special Security Officer (CSSO) may submit the necessary forms to the Defense Security Service (DSS) for a Single Scope Background Investigation (SSBI) for those personnel nominated for SCI in accordance with the National Industrial Security Program Operating Manual (NISPOM).

6. The SSO/CSSO can grant access to only those who possess the necessary security clearance and who are actually providing services under the contract. Further dissemination to other contractors, sub-contractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the releasing agency.

7. SCI materials furnished in support of this contract remains the property of the DoD department or command that released it. Upon completion or cancellation of the contract, all SCI materials furnished will be returned to the direct custody of the originator of the materials.

8. Classified foreign intelligence materials must not be released to foreign nationals or immigrant aliens whether or not they are also consultants, U.S. contractors, or employees of the contractor regardless of the level of their security clearance, except with advance written permission from the originator.

9. Contractor personnel must maintain accountability for all intelligence (to include foreign intelligence) materials released to their custody.

10. Contractor personnel must not reproduce classified foreign intelligence without advance approval of the releasing agency. If permission is granted, each copy will be controlled in the same manner as the original. The CSSO must not destroy any classified foreign intelligence without advance approval of the releasing agency.

11. A SCIF meeting the physical security requirements in DCID 6/9 or ICD 705 is required for this contracting effort. All SCI used for this contract shall be stored, handled, and maintained in an accredited SCIF, be it the local contractor SCIF or similarly SCI accredited facilities used by the contractor. Address of the SCIF for contract execution:

a. (Office Symbol and Company Name, street address, Bldg #, City, State, and Zip Code.

b. Name and Telephone number of FSO/CSSO.

12. Visits. The contractor will submit the written request for SCI visit certifications through the COR for approval of the visit. The certification must arrive at USSF SSO at least three working days prior to the visit.

13. Information assurance and electronic processing; information security (computer) and network connectivity require accreditation of the equipment connectivity.

14. Reference Block 15. This contract requires access to SCI. If the contractor has established a SCIF, DIA and its designees are responsible for all inspections of the contractor SCIF and SCI security management program for ensuring compliance with all SCI security regulations and policies. If a new SCIF must be established in accordance with this contracting effort, permission to build/accredit a SCIF must be requested through the COR and forwarded to the USSF SSO. Special Security Officers reserve the right to conduct program reviews of AF SCI materials and SCI program management to ensure the protection of AF equities.

15. Contract estimated completion date: (DATE)

(Note: Section “F” of the contract usually provides the Period of Performance. Option years are not to be included as an option is not valid until exercised by the government. Minor modification are authorized.)

16. IF APPLICABLE – The prime contractor is responsible for preparing DD Form 254s for SCI access of their subcontractors. Completed subcontractor DD 254s are provided to the supporting SSO for review and validation (SSO signature not required on Sub 254s). Validation consists of ensuring SCI security requirements mirror that of the Prime Contractor’s DD 254. All attachments and addendums should be part of the subcontractor’s DD 254 as well. Supporting SSO will submit the reviewed and validated DD 254 to the MAJCOM SSO (listed on the Prime Contract) for approval.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification Show Attachment Bar

N/A

N/A

The contractor requires access to classified source data and SCIFs up to and including TOP SECRET (TS) Sensitive Compartmented Information (SCI) in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of multiple sources on the "classified by" line necessitates compliance with DoD 5200.01 Vol 2 and AFI 16-1404, and use of the Security Classification Guides (SCGs) identified in item 11a in this DD254.

Ref. 10a: If the contractor is authorized to receive Government furnished cryptographic equipment, the guidance will state that fact. Access to classified COMSEC information requires a final U.S. Government clearance at the appropriate level. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires approval of the GCA. Non-accountable COMSEC information, though not tracked in the COMSEC material control system, may still require a level of control within a document control system. Refer to NSA/CSS Manual 3-16, “Control of Communications Security Material,” and the Committee on National Security Systems Instruction (CNSSI) 4001, “Controlled Cryptographic Items,” for guidance. If access to COMSEC information is required at Government facilities, or the material is under Government control, contractor personnel will follow the security requirements of the host government activity.

Ref. 10e (1)&(2): See SCI Addendum.

Ref 10j.: DoD Components; refer to DODI 5200.48, "Controlled Unclassified Information (CUI)” available at http://www.esd.whs.mil/DD/DoD-Issuances/, when considering protection for CUI. Non-DoD Components must consult with their Component specific information security policy office to determine if they have any existing authority by law, government-wide policy or government- wide regulation to impose this requirement. Controlled Unclassified Information is any information that law, regulation, or government wide policy requires to have safeguarding or disseminating controls, excluding information that is classified under Executive Order 13526, Classified National Security Information, December 29, 2009, or any predecessor or successor order, or the Atomic Energy Act of 1954, as amended.

The National Archives and Records Administration (NARA) CUI Registry (http://www.archives.gov/cui/registry/category-list.html) identifies approved CUI categories and subcategories, provides general descriptions for each, identifies the basis for controls, and sets out procedures for the use of CUI.

Ref. 11e: Contract is for equipment maintenance services on equipment which processes classified information. Actual knowledge of, generation, or production of classified information is not required for performance of the contract. Cleared personnel are required to perform this service because access to classified information cannot be precluded by escorting personnel.

Any classification guidance will be provided by the using activity.

Ref. 11f.: 20 SPCS, Det 4 at U.S. Army Garrison-Kwajalein Atoll in the Republic of the Marshall Islands

Ref. 11m.: Information required by contract clauses 52.204-2, 52.204-9000/52.204-9001 to the Info Sec Prog Mgr (ISPM). Contractor requires access to SIPRNET and JWICS for contract performance.

Ref 12: Public Release: Contractor is to submit requests through the Contracting Officer for OPSEC Program Manager review and public release authorization. The Contracting Officer will provide contractor with written approval/disapproval. (T-1) Information requiring AF or DoD–level review will be reviewed by the unit’s OPSEC Program Manager or Coordinator who will in-turn forward to the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690.” MAJCOM/DRUs will send information requiring AF or DoD-level review directly to SAF/PAX.

text: SCI ADDENDUM

OPSEC ADDENDUM

PAFB, CO 80914