6._DD_Form_254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DD Form 254 Continuation Sheet for 30 SW Range Operations

Contract

Item 8 continued: Actual performance locations:

A. LOCATION

B. CAGE CODE

C. COGNIZANT SECURITY OFFICE

45 Space Wing

740 O’Malley Drive

Patrick AFB, FL 32925

45 Space Wing Information Protection Office

1201 Edward H. White Street

Patrick AFB, FL 32925

30 Space Wing

1515 Iceland Ste 220

Vandenberg AFB, CA 93437

30 Space Wing Information Protection Office

1031 California Blvd, Suite C-109 Vandenberg AFB CA 93437

Missile Defense Agency

70 13th Street, Bldg 6510

Vandenberg AFB CA 93437

Missile Defense Agency/GMD

13th Street, Bldg 6510, Rm 108

Vandenberg AFB CA 93437

Reference Block 10.a. Communications Security (COMSEC) Information:

Contractor shall comply with the requirement of DoD 5200.22-M, National Industrial Security Program Operating Manual (NISPOM), AFI 33-201, Vol I, Communication Security (COMSEC) and CNSS No. 12, National Information Assurance Policy for US Space Systems used to support national security missions. Access to COMSEC material or information is restricted to U.S. personnel holding final US Government clearances and is not releasable to personnel holding only a reciprocal clearance. All contractor employees who require access to classified COMSEC information in the performance of their contractual duties shall be briefed prior to being granted access. The Program Manager shall designate the number of personnel requiring cryptographic access. The number will be limited to the minimum necessary and will be on a strict need-to-know basis. The contractor shall maintain a record of all COMSEC briefings.

Reference Block 10.d. Formerly Restricted Data (FRO):

A. The contractor is permitted access to Formerly Restricted Data in performance of this contract. Access and handling of FRO must comply with the NISPOM and Doot 5210.02, Access to and Dissemination of Restricted and Formerly Restricted Data. The Government Program Manager will validate contractor requests for this information on a case-by-case basis. FRO information is not releasable to employees who are not citizens, foreign nationals or those having limited access authorizations. A final government clearance at the appropriate level Is required. Records will be maintained per NISPOM. The Department of Energy (DoE) requires that any contractor requiring access to FRO for the purpose of reviewing analyzing, and creating new FRO products or matereal, must complete relevant training.

1) Restricted Data means all data concerning (a) design, manufacture, or utilization of atomic weapons (b) the production of special nuclear material or (c) the use of special nuclear material on the production of energy, but shall not include data declassified or removed from the Restricted Data category pursuant to Section 142.

2) Formerly Restricted Data is information which has been removed from the Restricted Data category after the DoE and the DoD have jointly determined that the information relates primarily to the military utilization of atomic weapons and can be adequately safeguarded as National Security Information in the US. Such data may not be given to any other nation except under the terms of an agreement for cooperation.

B. The Atomic Energy Act of 1954, as amended, provides for the development, use, and control of atomic energy. Toe Act establishes policy for handling atomic energy-related classified Information designated as Restricted Data and Formerly Restricted Data. The Act provides responsibility to DoE to control the dissemination and declassification of Restricted Data. This clause is intended to ensure reasonable conformity in policy and procedures 1s used by contractors for the control of RD and FRO.

C. In accordance with the Atomic Energy Act, all atomic energy Information remains classified unless action is taken to declassify material only by DoE. No other organization can declassify atomic energy information and once it ls declassified, it cannot be reclassified.

D. DoDI 5210.02, Access to and Dissemination of Restricted Data and Formerly Restricted Data, states that it Is OoO policy that access to and dissemination of RD and FRO information within and between DoD components, including OoD contractors, will be governed by the same criteria that governs the access to other classified information, which is contained in DoDI 5210.02, OoO 5200.2-R (now OoDM 5200.01), and OoO 5220.22-R.

E. Protection requirements for FRO are contained in DoDM 5200.01, Volume 1, DoO Information Security Program, which states that: Classified information, including Critical Nuclear Weapon Design Information in the custody of the Department of Defense marked as RD and FRO In accordance with the Atomic Energy Act of 1954, as amended, shall be stored, protected, and destroyed in the same manner as information of a comparable level of security classification. Contractor IT systems and networks must be certified and accredited for FRO prior to transmission, processing, or storage of such data. FRO must be marked IAW instructions in the NISPOM

F. For contractor with overseas operations include the following statement: The disclosure by a contractor of FRO to foreign governments shall not be permitted until an agreements signed by the U.S. and participating government(s) and disclosure guidance and security arrangements have been established.

Item 10e: Intelligence Information

The contractor shall handle non-SCI or "collateral" intelligence information IAW Chapter 9, Section 3 or DoD 5220.22-M, the National Industrial Security Program Operating Manual, (NISPOM). Particular emphasis is placed on the contractor(s) correctly understanding and heeding intelligence portion markings. As classified material, the contractor shall afford collateral Intelligence information the same protections, safeguards, and precautions required by any classified material required by DoDM 5200.01 Vol1 -Vol 4, Information Security Program and AFI 31-401, Information Security Program Management, unless special intelligence related handling instructions are specifically Imposed, usually In the TO&P. The contractor shall neither disclose nor release intelligence derived Information, whether its status is collateral or SCI, without the prior consent of the Program Manager.

Item 10h Foreign Government Information:

Access to foreign government information may be required in the performance or this contract. The Program Manager will validate contractor requests for FGI on a case-by-case basis. Access to FGI requires a final government clearance at the appropriate level. FGI shall be protected in the same manner as the equivalent U.S. government classified information. Information supplied by or provided to a foreign government(s) shall be handled in accordance with the NISPOM, Chapter 10, Section 3 and DoDM 5200-01 V1-V4. All other foreign disclosure requirements are covered by AFI 16-201 and as established in Delegated Disclosures Letters (OOL). Any releases to foreign governments will go through the Range and Network program office, which will forward the request to the Foreign Disclosure Officer (FOO) for review and approval. A training program must be developed to insure personnel are aware of foreign disclosure guidelines.

Item 10.j For Official Use Only (FOUO):

Controlled Unclassified Information (CUI) is now the term which collectively refers to FOUO and Unclassified Controlled Nuclear Information (UCNI). CUI information provided under this contract shall be managed and safeguarded IAW DoDM 5200.01, Volume 4, Controlled Unclassified Information (CUI).

Item 10k. Other:

SIPRNET The government will provide classified SIPRNET network access to include e-mail and web browser. Contractors will be held accountable for actions they initiate on the network and will conduct business IAW USAF instructions and policies. Sponsoring Government Contracting Activity (GCA) will provide tnformat1on Assurance training prior to contractor access to SIPRNet services.

STE access (if required): STE access is required for contract performance. Access will be controlled by the Government Contracting Activity (GCA). Contractor will follow requirements IAW AFI 33-201 V9, Operational Instructions for Secure Voice Devices.

Access to government AIS · The Contractor will require access to the government LAN to perform their contractual duties. Contractors requiring access to government AIS (LAN) must meet the requirements contained in AFI 33-115, Volume 2, licensing Network Users and Certifying Network Professionals and all Installation requirements.

Access to Public Key Enabled sites. Contractor organizations that require access to DoD websites will be required to be Public Key Infrastructure (PKI) compliant DoD approved commercial certificates for users requiring access to DoD websites can be obtained from:

Access to NIPRNet requires the Favorable adjudication of a National Agency Check with Written Inquires (NACI). Contractors requiring access above the user level require Secret or Top Secret clearance IAW Information Assurance guidance.

Access to Restricted Areas (RAs) and the issuance of an AECC badge requires the Favorable adjudication of a NACI. Certain areas such as Controlled Access Areas or Closed Areas will require a

SECRET clearance.

Item 11c. Receive and Generate Classified Material:

Classified material whether original or derivative in nature, will be handled in accordance with DoDM 5200.01 Vol 1-Vol 3 or the provisions set forth in Chapters 4 and 5 of the NISPOM as applicable.

Item 11d. Fabricate, Modify or Store Classified materials:

The Contractor is required to provide adequate storage for classified hardware up to and including the level of SECRET. COMSEC CCI (when keyed) key material and/or other COMSEC related hardware and materials must be protected IAW the NISPOM, NSNCSS Policy Manual 3-16, and NCSS No. 12, National Information Assurance Policy for US Space Systems used to Support National Security Missions. If the hardware is such a size and/or quantity that cannot be safeguarded in an approved storage container use of an approved 'Closed Area' will be required.

Item 11f. Access to Classified Information Outside the US:

Contractor requires access to U.S. Classified Information outside the U.S. Possession and Trust Territories.

The User Agency will furnish complete classification guidance for the service to be performed. The highest level of classification for the contract is SECRET.

All other foreign disclosure is covered by AFI 16-201, and Delegated Disclosures Letters provided by local Foreign Disclosure Officers. A training program must be developed to insure personnel are aware of foreign disclosure guidelines.

Item 11h. COMSEC Account:

(On-base contractors)

The contractor will be required to establish and maintain a COMSEC user account following the procedures and requirements contained in AFI 33-201, Volume 2, Communications Security (COMSEC) User Requirements, the NISPOM, and installation COMSEC account procedures.

(Off-base contractors)

NSA accounts will be established for and maintained by contractor IAW NSNCSS Manual 3-16. The Contractor will comply with the additional security requirements and the management of NSA information/material as defined in the manual.

Item 11j. TEMPEST Requirements:

(Collateral} TEMPEST security measures must be considered If electronic processing of classified information is involved. The contractor shall comply with EMSEC requirements before processing classified data in accordance with AFI 33-203, Vol 1, Emission Security (EMSEC), and AFSSI 7700, Emission Security. Document the IA countermeasures and the EMSEC assessments on AF Form 4170, Emission Security Assessments/Emission Security Countermeasures Review, according to AFSSI 7702.

(SCI) TEMPEST security measures must be considered if electronic processing of SCI is involved in accordance with DoDM 5105, V1-V3 and AFMAN 14-304, Chapter 7 The Contractor shall comply with EMSEC requirements before processing classified data in accordance with AFI 33-203, Vol 1, Emission Security (EMSEC), AFSSI 7700, Emission Security, and AFSSI 7702, Emission Security Countermeasures Review. SCI, regardless of classification level, must be processed only on an information system accredited tor SCI processing (e.g., Joint Worldwide Intelligence Communications System (JWICS)). It may not be processed on, transferred to, or stored on SIPRNET, even it the information is SECRET/IS, SECRET//HCS, etc., as the SIPRNET is not accredited for SCI. Any transfer to and/or processing of SCI on SIPRNET constitutes a data spillage from a higher to a lower-security information domain. Document the IA countermeasures and the EMSEC assessments on AF Form 4170, Emission Security Assessments/Emission Security Countermeasures Review, according to AFSSI 7702.

(SAP) TEMPEST security measures must be considered 1t electronic processing of SAP information is involved. The contractor shall comply with EMSEC requirements before processing classified data in accordance with AFI 33-203, Vol 1. Emission Security (EMSECJ, and AFSSI 7700, Emission Security. SAP information, regardless of classification, shall be processed only on an information system specifically accredited tor SAP processing and operating at a classification level that meets or exceeds the classification level of the SAP data. Document the IA counter measures and the EMSEC assessments on AF Form 4170, Emission Security Assessments/Emission Security Countermeasures Review, according to AFSSI 7702.

Item 11j. OPSEC:

The contractor will accomplish the following minimum requirements in support of 30 SW & 45 SW Operations Security (OPSEC) Program. Compliance with security requirements imposed by documents generated in response to DoDI 5200.39, Critical Program Information (CPI) protection within the Department of Defense, 16 July 2008, is required. Compliance with OPSEC measures if imposed by programs supported or by documents generated by 30 SW/45 SW may be necessary. OPSEC program will be IAW DoDM 5205.2, dated 3 November 2008. Program OPSEC plans shall be coordinated with and approved by the 30 SW/45 SW OPSEC PM and shall be imposed on subcontractors as appropriate. Program protection measures will be approved by the 30 SW/45 SW and shall be applied at ALL locations where Critical Information is developed, produced, analyzed, maintained, transported, stored, tested, or used In training.

The Contractor shall appoint an OPSEC representative, participate in the Wing Operations Security (OPSEC) Program and adhere to instructions received from the Wing Operations Signature Manager, Installation Commander, or higher authority to conform with AFI 10-701

The contractor shall comply with the 30 SW/45 SW OPSEC Plan, and apply protective measures therein. The contractor shall develop an OPSEC Plan in accordance with DoDM 5205.2 The contractor shall take direction from local OPSEC Offices.

Include OPSEC as a part of their ongoing security awareness program conducted In accordance with Chapter 3, Section 1, of the National Industrial Security Operating Manual

Be responsive to the 30 SW/45 SW OPSEC Manager on a non-interference basis.

Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of military operations performed by the contractor in support of the mission. Sensitive unclassified information Is that Information marked FOR OFFICIAL USE ONLY (FOUO), Privacy Act (PA) Of 1974, COMPANY PROPRIETARY, and as identified by the Air Force Program Office.

Disposition of Critical Information, FOUO, and PA obtained or produced pursuant to this contract will be shredded/degaussed to prevent reconstruction.

Email transmission of Critical Information, FOUO, and PA obtained or produced pursuant to this contract will be encrypted or password protected. In addition email containing FOUO and PA will be marked in the subject line. FOUO will also be included at the beginning and end to the email.

Item 11k. Defense Courier Service:

This contract requires use of the Defense Courier Service (OCS). The Contractor Special Security Officer (CSSO) will prepare and submit DCS Form 10 In original triplicate to the program SSO tor validation prior to their submittal to the appropriate OCS station.

Item 11l. Other:

Information Assurance requirements:

The terms Information Assurance and Information System, as used in this clause, as defined in 00018500.01and is incorporated herein by reference. Information systems (IS) shall be engineered and managed to protect and defend information an. d information systems from security risks, including the risks to timely accreditation in accordance with current DoD poltc1es, procedures, and statutes, to include:

The National Security Act

The Clinger-Cohen Act

National Security Telecommunications and Information Systems Security Policy No 11 Federal Information Processing Standards

DoD Directive 8500.01, Information Assurance

Do0 Instruction 8500 02, Information Assurance Implementation

Information assurance (IA} requirements shall be established and maintained throughout the acquisition lifecycle in accordance with 00018580.1 . All DOD information system shall meet security requirements in accordance with 0000 8500.01 and 00018500.02, and be accredited by the Designated Approving Authority (DAA) prior to operation.

Prior to classified processing, the contractor will ensure that ISs comply with the NISPOM, Chapter 8 and meet the confidentiality, integrity, authentication and non-repudiation and ava1iability requirements tor a PL-2 system as identified in the Defense Security Service (OSS) Industrial Security Field Operations (ISFO) Process Manual for Certification and Accreditation of Classified Systems under the NISPOM.

Protection of Unclassified DOD Information on Non-Government Information Systems:

The Contractor must comply with the information safeguards as specified in DODI 8582.01, dated 6 June 2012, Security of Unclassified DOD Information on Non-DOD Information Systems, DoD Commercial Mobile Device (CMO) Interim Policy dated 17 Jan 2012, Use of Commercial Mobile Devices Not Connected to Department of Defense Networks dated 31 Jul 2012, and Air Force (AF) Guidance memorandum to AF Manual 33-282 dated 4 April 2013. The aforementioned policies apply to Government issued, Contractor provided, or personal devices.

Non-enterprise activated Commercial Mobile Devices (CMO) is defined as any mobile handheld device that is not connected to any DOD network (wired or wireless) or to a PC that is/Will be connected to a DOD network. The devices can be used for any non-sensitive unclassified DOD tasks and process/store publicly released information. Non-enterprise activated commercial mobile devices, regardless of ownership, are prohibited from storing and/or processing classified information, Personally Identifiable Information (PII), Health Insurance Portability and Accountability Act (HIPAA) information, Controlled Unclassified Information (CUI) For Official Use Only (FOUO) and DOD sensitive information.

Definitions:

Non-Sensitive Information-· Information available 1n the public domain or DOD information that has been approved for public release.

Sensitive Information – information or the loss, misuse, or unauthorized access to or modification of, could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of title 5, United States Code, "The Privacy Act but which has not been specifically authorized under criteria established by Executive order or an Act of Congress to be kept secret in the interest of national defense or foreign policy (Section 278g-3 of title 15, United States Code, "The Computer Security Act of 1987").

Apply security controls contained in NISP SP 800-53 for the protection of unclassified controlled technical information on non-DOD information systems.

Trusted Download Procedures

Contractors are not authorized to use a trusted download procedure to extract lower level classified or unclassified information from classified information systems unless the procedures are Jointly approved by Defense Security Service (OSS) Office of the Designated Accrediting Authority (OAA) and the cognizant Government Contracting Activity (GCA) Information Assurance Manager (1AM). Air Force Space Command memorandum, Guidance for Manual Data Transfers across Security Domains, dated 1O Jan 2012, specifically Identifies approved data transfer methodologies.

Security Incident Reporting

In addition to the reporting requirements directed by the NISPOM, the contractor will provide a concurrent report of loss or compromise of classified information to the cognizant Government Contracting Activity (GCA) Information Assurance Manager (1AM and Designated Accrediting Authority (DAA).

For incidents involving contractor SCI information or programs. CSSOs shall report through the COR to the appropriate SCI security official. Contractors shall go through the contracting officer to the organization that issued the contract when emergency matters exists that affect plans or operations when there 1s a danger of compromise.

Additionally it is expected that all contract personnel assigned in direct support of an AF unit will integrate into the unit's security training program to include but not limited to:

1. Initial Security Orientation

2. Annual Refresher Training

3. Computer Awareness Training

4. OPSEC Awareness Training

5. Antiterrorism/Force Protection Exercises

The contractor shall comply with the general security provisions of the following documents, including changes or revisions or replacements:

30 SW Information Defense Plan (IDP), 4 Dec 2014

30 SW Operations Security (OPSEC) Policy and Critical Information List (CIL), dated September 2013 45 SW Information Defense Plan (IDP), current version

45 SW Operations Security (OPSEC) Plan current version

AFl-10-701, Operations Security (OPSEC), dated 8 June 2011 AFI 16-201, Air Force Foreign Disclosure and Technology Transfer Program, Dated 1 December 2004

AFI 16-701, Special Access Programs, dated 1 November 1995

AFI 31-401 (AFGM). Information Security Program Management, date 1 November 2005 (AFGM is dated 29 February2012)

AFI 31-406, Applying North Atlantic Treaty Organization (NATO) Protection Standards, dated 29 July 2004

AFI 31-501, Personnel Security Program Management, dated 27 January 2005 AFI 31-601, Industrial Security Program Management, dated 29 June 2005

AFI 33-200, Information Assurance Management, dated 29 December 2008 (current release incorporates through change 2, dated 15 October 2010)

AFI 33-201, Volume 1. Communications Security (COMSEC) dated 1 May 2005 (Incorporating Change 2, 15 October 2008)

AFI 33-201, Volume 2, Communications Security (COMSEC) User Requirements dated 26 April 2005 (will become AFSSI 4211)

AFI 33-115, Volume 2, Licensing Network Users and Certifying Network Professionals, dated 14 April 2004 (new release Incorporates through change 3, dated 26 October 2007)

AFI 33-230, Information Assurance (IA) Assessment and Assistance Program, dated 4 August 2004 (will become AFSSI 8560) AFPEO/SP Policy 63-17, AFPEO/SP Space Research and Technology Protection (SRTP) Policy, dated 17 January 2003

AFSSI Emission Security, dated 24 October 2007 (current Issue incorporates change 1, dated 14 April 2009)

AFSSI 7702, Emission Security Countermeasures Review, dated 30 January 2008 (current release incorporates change 1, dated 17 October 2008)

Committee on National Security Systems (CNSS) No. 12, National Information Assurance Policy for U.S. Space Systems used to Support National Security Missions, dated 20 March 2005

DOOM 5105.21 V1-V3, Department of Defense Sensitive Compartmented Information Administrative Security Manual, Dated August 1998

DOOM 5200.01, Volume 1, DOD Information Security Program: Overview, Classification and Declassification, date 24 February 2012 (Replaced DOD 5200.1-R, cancelled DOD 5200 .1-1, and incorporates OTMs 04-010 and 11-004)

DOOM 5200.01, Volume 2, DOD Information Security Program: Marking of Classified Information, dated 24 February 2012 Incorporating Change 2, March 19, 2013

DOOM 5200.01, Volume 3, DOD Information Security Program: Protection of Classified Information, dated 24 February 2012 Incorporating Change 2, March 19, 2013

DOOM 5200.01, Volume 4, DOD Information Security Program: Controlled Unclassified Information (CUI), dated 24 February 2012

DOOM 5200.39, Critical Program Information within the Department of Defense, dated 16 July 28 July 2008

DOOM 520.502, DOD Operations Security (OPSEC) Program, dated 6 March 2006

DODO 5205.07, Special Access Program (SAP) Policy, dated 1 July 2010

DOOI 5210.02, Access to and Dissemination of Restricted Data and Formerly Restricted Data dated 3 June 2011 (Replaced DOD Directive 5210.2)

DOD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), dated 28 February 2006 (This release cancelled DOD 5220.22-S- 1, COMSEC Supplement to the Industrial Security Manual for Safeguarding Classified Information)

DOOM 5220 02-R, Industrial Security Regulation, dated 4 December 1985

DOD Instruction 5230.29,' Security and Policy Review of DOD Information for Public Release,' dated 8 January 2009

DOD 5400.7-R, DOD Freedom of Information Act (FOIA), dated 4 September 1998

DODI 5400.04, Provisions of Information to Congress, dated 17 March 2009 (Superseded 0000 5400.4)

DOD 17650 01, Government Accountability Office (GAO) and Comptroller General Requests for Access to Records, dated 27 January 2009 (superseded 0000 7650 1)

DOD 18500.01, Cybersecurity, dated 14 March 2014

DOD 18510.01 Risk Management Framework (RMF) for DOD Information Technology (IT) dated 12 March 2014

DOD 18523.01, Communications Security (COMSEC) dated 22 April 2008

DOD 18581.1, Information Assurance (IA) Policy for Space Systems Used by the Department of Defense, dated 21 June 2005

DODI 8582.01, dated 6 June 2012, Security of Unclassified DOD Information on Non-DOD Information Systems

DTM 08-027, Security of Unclassified DOD Information on Non-000 Information Systems, dated 31 July 2009 (incorporates change 2, dated 02 September 2011) (Valid until 1 September 2012 or until replaced by 8500 series DOD issuance)

Executive Order 13526, Classified National Security Information, dated 29 December 2009 Executive Order 13556, Controlled Unclassified Information dated 4 November 2010

Reference Block 14 Additional Security Requirements

Access to Intelligence Information The contractor will require access to other (collateral) classified intelligence Information. The following requirements apply:

a. The Contractor is authorized access to classified Intelligence information. The most restrictive control marking on the intelligence will comply with the approval of the Air Force Assistant Chief of Staff, Intelligence (ACS/I), may include intelligence marked: "DISSEMINATION AND

EXT RACTION OF INFORMATION CONTROLLED BY ORIGINATOR (ORCON), AND CAUTION PROPRIETARY INFORMATION INVOLVED (PROPIN)

b. The Contractor will comply with the special handling and dissemination requirements specified in the NISPOM and the Director of Central Intelligence Directive (DCID).

c. The Contractor is hereby granted permission to reproduce, extract, and distribute (limited to specified Air Force agencies and approved contractor), and destroy or retain the Intelligence as required in support of this contract.

d. Intelligence material that, in the judgment of the Space and Missile System Center Senior Intelligence Officer, should not be handled in this manner and will be so identified in writing at the time of release of the material to the Contractor and procedures for handling and dissemination of that intelligence shall be addressed on an ad hoc basis.

2. Contractor employees and subcontractors who have access to Air Force networks must submit to a National Agency Check and/or have a security clearance. Contractor personnel providing direct support to an Air Force installation will abide by the provisions set forth in the local Security Agreement or the Visitor Group Security Agreement (VGSA) and cooperate under the local security authority's oversight.

Reference Block 12: Public Release

Any Information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release THROUGH:

Eastern Range:

45th Space Wing Public Affairs Office

1201 Edward H White St

Bldg 423, Room 133

Patrick AFB, FL 32925-3237

Tel. (3210 494-7331)

DSN: 854:7331

Western Range:

30th Space Wing Public Affairs Office

Building 12000

Vandenberg Air Force Base, Ca 93437-6267

Tel: (805) 606-3595

DSN: 276-3595

The contractor is required to flow-down all applicable requirements of the DD Form 254 to its Subcontractor(s).

Direct all questions pertaining to the DD Form 254 to the 45 SW or 30 SW Program Offices.

CONCURRANCES Signatures and dates:

45 SW/SCS

45 SW/IP

45 SW/PMD

45 SW/CONS

30 SW/SCS

30 SW/MDA

30 SW/IP

30 SW/PMD

30 SW/CONS

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments [1] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form) DD254 EWOCS DRAFT Continuation Sheets 7 Aug 19.docx

30 SW/PMD

45 CONS/PKDC

13.2 The contractor will require entry to military controlled and restricted areas identified in AOR specific instructions. The contractor shall comply with AFI 31-101, AFI 31-113 and AOR specific plans identified in contract.

13.3 The contractor will participate in base anti-terrorism program according to Exhibit B of this specification.

13.4 The contractor may require unescorted entry to facilities and areas where special controls have been established to protect classified information of mission critical resources. Unescorted entry into SCIFs requires SCI eligibility (SSBI or equivalent investigation); access into restricted or controlled areas processing Secret information require Secret eligibility. NACLC or equivalent investigation, unescorted entry to these areas will be in accordance with AOR specific plan.

13.5 Access to NATO not required.

13.6 The Contractor shall appoint an OPSEC representative, participate in the Wing Operations Security (OPSEC) Program and adhere to instructions received from the Wing Operations Signature Manager, Installation Commander, or higher authority to conform with AFI 10-701.

Commander has requested DSS services. Inspections will be conducted by the local Servicing Security Agency, 45 SW/IP.

1201 Edward H White St Bldg 423, Room 133 Patrick AFB, FL 32925-3237