DD_Form_254_Attachment.pdf

Attachment 1, DD Form 254 Continuation Sheet

Additional Information for DD Form 254 Department of Defense Contract Security Classification Specification

BLOCK:

10.a. Access to COMSEC material is restricted to U.S. citizens holding final U.S. Government clearances. Such information is not releasable to personnel holding only reciprocal clearances.

10.g. Access to classified NATO information requires a final U.S. Government clearance at the appropriate level.

10.j. FOUO information provided under this contract shall be safeguarded as specified in the attachment “Protecting

For Official Use Only (FOUO) Information.”

11.e. Actual knowledge of, generation, or production of classified information is not required for performance of the contract. Cleared personnel are required to perform this service because security measures which are in force do not preclude access to classified information.

11.j. See attached OPSEC addendum

11.k. Request DCS services from the Commander, Defense Courier Service, ATTN: Operations Divisions, Fort

George G. Meade, MD 20755-3570. Only certain classified information qualifies for shipment by DCS. It is the responsibility of the contracting activity to comply with DCS policy and procedures.

13.i. Release of Information. SCI with restrictive caveats (e.g., ORCON, PROPIN, etc.) will be released to contractors only when originator approval has been obtained. The contractor will control SCI, which has been originated or obtained under this contract as follows: The contractor may release such material to any contractor employee working against a billet under this contract only when a need-to-know exists. The contractor will release such material to any Special Security Office personnel assigned to 460 SW/SSO or DIA upon demand by such personnel. The contractor may release such material to any other personnel, including contractor and subcontractor employees, and employees of any Federal Government agency, only upon prior written approval from the 460

SW/SSO. An access certification to an AFSPC contractor-occupied SCIF does not constitute approval to release

AFSPC contractual material to these other personnel; Contract Monitor approval is nevertheless required. Contract

Monitor approval of an AFSPC contractor visit certification or permanent certification to another facility will constitute approval to discuss contractual material at facility to be visited.

13.j. Any SCI released to the contractor in support of this contract remains the property of DOD department, agency, or command that releases it. The contractor will maintain active accountability of all SCI released to his/her custody, regardless of whether the release is within a contractor or US Government SCIF. Upon completion/cancellation of the contract, the contractor must return all such material to 460 SW/SSO unless a follow-on contract specifies that the material will be transferred to a subsequent contract. SCI inventories will be conducted

IAW DIA Manual 50-5 and AFM 14-304.

13.k. This contract requires the use of the Defense Courier Service (DCS). 460 SW/SSO will validate DCS requirements.

13.l. Contractor Special Security Officers (CSSOs) must coordinate with the 460 SW/SSO and obtain the concurrence of 460 SW/SSO prior to subcontracting any portion of SCI efforts involved in this contract.

13.m. No contractor personnel will be granted access to SCI material under this contract unless they are filling a

DOD SCI billet. The contractor will coordinate with the 460 SW/SSO to ensure adequate billets are requested under this contract. Multiple contract employees sponsored by the organizations other than Space Command must be certified to 460 SW/SSO for use on the contract.

13.n. Contractor will not use references to SCI accesses, even by unclassified acronyms, in advertising, promotional efforts, or recruitment for employees.

13.o. The following activity is designated as the User Agency SS for SCI requirements IAW DIA Manual 50-5; 460

SW/SSO, Buckley AFB, CO 80011.

REQUIRED COORDINATION

XXXXXXXXXX

Program/Project Manager

Squadron Security Manager

COMSEC Manager

OPSEC Manager

460 SW/SSO

FRANK P. PABLO

460 SW/IP

AP3.1. INTRODUCTION

AP3.1.1. General.

FOR OFFICIAL USE ONLY INFORMATION (FOUO)

(Addendum to DD Form 254, Item 10.j.)

(REF: DOD 5200.1-R, Appendix 3)

AP3.1.1.1. The requirements of the Information Security Program apply only to information that requires protection to prevent damage to the national security and has been classified in accordance with E.O. 13527

(reference (e)) or its predecessors. There are other types of information that require application of controls and protective measures for a variety of reasons. This information is known as "unclassified controlled information." Since classified information and unclassified controlled information exist side-by-side in the work environments -- often in the same documents -- this Appendix is provided as an attempt to avoid confusion and promote proper handling. It covers several types of unclassified controlled information, and provides basic information about the nature of this information and the procedures for identifying and controlling it. In some cases, the Appendix refers to other DoD Directives that provide more detailed guidance.

AP3.1.1.2. The types of information covered in this Appendix include "For Official Use Only" information, "Sensitive But Unclassified" (formerly "Limited Official Use") information, "DEA Sensitive Information,"

"DoD Unclassified Controlled Nuclear Information," "Sensitive Information," as defined in the Computer

Security Act of 1987 (reference (j)), and information contained in technical documents.

AP3.2. FOR OFFICIAL USE ONLY INFORMATION (FOUO)

AP3.2.1. Description.

AP3.2.1.1. "For Official Use Only (FOUO)" is a designation that is applied to unclassified information that may be exempt from mandatory release to the public under the Freedom of Information Act (FOIA)

(reference (g)). The FOIA specifies nine exemptions that may qualify certain information to be withheld from release to the public if, by its disclosure, a foreseeable harm would occur. They are:

AP3.2.1.1.1. Information that is currently and properly classified.

AP3.2.1.1.2. Information that pertains solely to the internal rules and practices of the Agency.

(This exemption has two profiles, "high" and "low." The "high" profile permits withholding of a document that, if released, would allow circumvention of an Agency rule, policy, or statute, thereby impeding the agency in the conduct of its mission. The "low" profile permits withholding if there is no public interest in the document, and it would be an administrative burden to process the request.)

AP3.2.1.1.3. Information specifically exempted by a statute establishing particular criteria for withholding. The language of the statute must clearly state that the information will not be disclosed.

AP3.2.1.1.4. Information such as trade secrets and commercial or financial information obtained from a company on a privileged or confidential basis that, if released, would result in competitive harm to the company, impair the Government's ability to obtain like information in the future, or protect the Government's interest in compliance with program effectiveness.

AP3.2.1.1.5. Inter-Agency memoranda that are deliberative in nature; this exemption is appropriate for internal documents that are part of the decision making process and contain subjective evaluations, opinions and recommendations.

AP3.2.1.1.6. Information, the release of which could reasonably be expected to constitute a clearly unwarranted invasion of the personal privacy of individuals.

AP3.2.1.1.7. Records or information compiled for law enforcement purposes that:

AP3.2.1.1.7.1. Could reasonably be expected to interfere with law enforcement proceedings;

AP3.2.1.1.7.2. Would deprive a person of a right to a fair trial or impartial adjudication;

AP3.2.1.1.7.3. Could reasonably be expected to constitute an unwarranted invasion of the personal privacy of others;

AP3.2.1.1.7.4. Disclose the identity of a confidential source;

AP3.2.1.1.7.5. Disclose investigative techniques and procedures; or

AP3.2.1.1.7.6. Could reasonably be expected to endanger the life or physical safety of any individual.

AP3.2.1.1.8. Certain records of Agencies responsible for supervision of financial institutions.

AP3.2.1.1.9. Geological and geophysical information concerning wells.

AP3.2.1.2. Information that is currently and properly classified can be withheld from mandatory release under the first exemption category. "For Official Use Only" is applied to information that is exempt under one of the other eight categories. So, by definition, information must be unclassified in order to be designated FOUO. If an item of information is declassified, it can be designated FOUO if it qualifies under one of those other categories. This means that:

AP3.2.1.2.1. Information cannot be classified and FOUO at the same time; and

AP3.2.1.2.2. Information that is declassified may be designated FOUO, but only if it fits into one of the last eight exemption categories (categories 2 through 9).

AP3.2.1.3. The FOIA (reference (g)) provides that, for information to be exempt from mandatory release, it must fit into one of the qualifying categories and there must be a legitimate Government purpose served by withholding it. Simply because information is marked FOUO does not mean it automatically qualifies for exemption. If a request for a record is received, the information must be reviewed to see if it meets this dual test. On the other hand, the absence of the FOUO marking does not automatically mean the information must be released. Some types of records (for example, personnel records) are not normally marked FOUO, but may still qualify for withholding under reference (g).

AP3.2.2. Markings.

AP3.2.2.1. Information that has been determined to qualify for FOUO status should be indicated by markings when included in documents and similar material. Markings should be applied at the time documents are drafted, whenever possible, to promote proper protection of the information.

AP3.2.2.2. Unclassified documents and material containing FOUO information shall be marked as follows:

AP3.2.2.2.1. Documents will be marked "FOR OFFICIAL USE ONLY" at the bottom of the front cover (if there is one), the title page (if there is one), the first page, and the outside of the back cover (if there is one).

AP3.2.2.2.2. Pages of the document that contain FOUO information shall be marked "FOR

OFFICIAL USE ONLY" at the bottom.

AP3.2.2.2.3. Material other than paper documents (for example, slides, computer media, films, etc.) shall bear markings that alert the holder or viewer that the material contains FOUO information.

AP3.2.2.2.4. FOUO documents and material transmitted outside the Department of Defense must bear an expanded marking on the face of the document so that non-DoD holders understand the status of the information. A statement similar to this one should be used:

"This document contains information exempt from mandatory disclosure under the F0IA.

Exemption(s) apply."

AP3.2.2.3. Classified documents and material containing FOUO information shall be marked as required by

Chapter 5 of this Regulation, with FOUO information identified as follows:

AP3.2.2.3.1. Overall markings on the document shall follow the rules in Chapter 5. No special markings are required on the face of the document because it contains FOUO information.

AP3.2.2.3.2. Portions of the document shall be marked with their classification as required by

Chapter 5. If there are unclassified portions that contain FOUO information, they shall be marked with "FOUO" in parentheses at the beginning of the portion. Since FOUO information is, by definition, unclassified, the "FOUO" is an acceptable substitute for the normal "U."

AP3.2.2.3.3. Pages of the document that contain classified information shall be marked as required by Chapter 5. Pages that contain FOUO information but no classified information will be marked

"FOR OFFICIAL USE ONLY" at the top and bottom.

AP3.2.2.4. Transmittal documents that have no classified material attached, but do have FOUO attachments shall be marked with a statement similar to this one: "FOR OFFICIAL USE ONLY ATTACHMENT."

AP3.2.2.5. Each part of electrically transmitted messages containing FOUO information shall be marked appropriately. Unclassified messages containing FOUO information shall contain the abbreviation "FOUO" before the beginning of the text.

AP3.2.3. Access to FOUO Information. FOUO information may be disseminated within the DoD Components and between officials of the DoD Components and DoD contractors, consultants, and grantees as necessary in the conduct of official business. FOUO information may also be released to officials in other Departments and Agencies of the Executive and Judicial Branches in performance of a valid Government function. (Special restrictions may apply to information covered by the Privacy Act, reference (h).) Release of FOUO information to Members of

Congress is covered by DoD Directive 5400.4 (reference (gg)) and to the General Accounting Office by DoD

Directive 7650.1 (reference (ll)).

AP3.2.4. Protection of FOUO Information.

AP3.2.4.1. During working hours, reasonable steps should be taken to minimize risk of access by unauthorized personnel. After working hours, FOUO information shall be stored in unlocked containers, desks or cabinets if Government or Government-contract building security is provided, or in locked desks, file cabinets, bookcases, locked rooms, or similar items.

AP3.2.4.2. FOUO documents and material may be transmitted via first-class mail, parcel post or -- for bulk shipments -- fourth-class mail. Electronic transmission of FOUO information (voice, data or facsimile) should be by approved secure communications systems whenever practical.

AP3.2.4.3. Record copies of FOUO documents shall be disposed of in accordance with the Federal Records

Act (44 U.S.C. 33 (reference (p))) and Component records management directives. Non-record FOUO documents may be destroyed by shredding or tearing into pieces and discarding the pieces in regular trash containers.

AP3.2.5. Further Guidance. Further guidance on one type of FOUO information is contained in DoD 5400.11-R

(reference (ww)), "Department of Defense Privacy Program."

GENERAL:

OPERATIONS SECURITY (OPSEC)

(Addendum to DD Form 254, Item 11.j.)

1. PURPOSE: This section outlines the requirements and procedures necessary to protect Critical Information for Operations Security (OPSEC).

2. MISSION: To maintain a continuing awareness of adversary interest in center actions and adversary intelligence collection capabilities. To understand the need to identify and protect classified and unclassified indicators, which occur, reveal sensitive information. To evaluate the effectiveness of OPSEC measures taken to preclude or reduce adversary acquisition and exploitation of sensitive information.

3. DEFINITION: OPSEC is the process of analyzing friendly actions attendant to military operations and other activities to:

a. Identify those actions that can be observed by adversary intelligence systems.

b. Determine indicators hostile intelligence systems might obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

c. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

4. OBJECTIVES:

a. To protect planned operational center activities by preventing the inadvertent disclosure of unclassified information relating to or revealing a possible classified operation.

b. To preserve secrecy concerning specific scenario events and a NORAD response to these events.

c. To identify OPSEC vulnerabilities and recommend protective measures which will serve to enhance the security of future operations.

5. TASKS: Task requirements are outlined in the Statement of Work for this effort.

ATTACHMENT 1 - DEFINITIONS/TERMS EXPLAINED

Acquisition - The acquiring by contract with appropriated funds of supplies or services (including construction) by and for the use of the Federal Government through purchase or lease, whether the supplies or services are already in existence or must be created, developed, demonstrated, and evaluated. Acquisition begins at the point when agency needs are established and includes the description of requirements to satisfy agency needs, solicitation and selection of sources, award of contracts, contract financing, contract performance, contract administration, and those technical and management functions directly related to the process of fulfilling agency needs by contract.

ACO - Administrative Contracting Officer

AIS - Automated Information System

CAGE - Commercial and Government Entity Code

Carve-Out - A classified contract issued in connection with an approved Special Access Program in which DSS has been relieved of inspection responsibility in whole or in part.

Certifying Official - Contracting Officer or Designated Representative

Chief, Information Protection (CIP) - This activity implements and oversees the industrial security program for an installation and designated on-base contractors. The installation commander designates the servicing security activity

(SSA). At Buckley AFB, the SSA i s the CIP with 460 SW/IPC (Industrial Security) acting on his behalf.

Classified Contract - Any contract that requires access to classified information (TOP SECRET, SECRET, or

CONFIDENTIAL) by the contractor or its employees in the performance of the contract. A contract may be a classified contract even though the contract document itself is not classified.

Classified Information - Any information or material that is owned by, produced by or for, or under the control of the

United States Government, and determined pursuant to Executive Order 12958, or prior orders to require protection against unauthorized Disclosure, and is so designated.

Cleared Facility - A cleared facility is a non-government owned or operated industrial, educational, commercial, or other facility for which DoD has made an administrative determination (from a security viewpoint) that the entity is eligible for access to classified information. Cleared facilities comply with and are subject to the requirements of the

DoD 5220-22-M, National Industrial Security Program Operating Manual (NISPOM), regardless of geographic location or responsible oversight agency. On-base cleared facilities receive, store, dispatch, and process classified information under the provisions of the NISPOM, the exception being when and where unique operating conditions or circumstances dictates otherwise.

Contracting Activity - An element of an agency designated by the agency Commander and given broad authority regarding acquisition functions.

Contracting Officer (CO) - Any person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings. The term includes certain authorized representatives of the contracting officer acting within the limits of their authority as delegated by the contracting officer. Also used interchangeable with Procuring Contracting Officer (PCO).

Cognizant Security Office (CSO) - Defense Security Service Operating Location which has industrial security jurisdiction over the geographic area in which a contract facility is located.

Communication Security (COMSEC) - Communications Security refers to protective measures taken to deny unauthorized persons information derived from telecommunications.

Critical Nuclear Weapons Design Information (CNWDI) - It may be Top Secret Restricted Data or Secret Restricted

Data revealing theory of operation or design of the components of a thermonuclear or implosion type fission bomb, warhead, demolition or test device.

DSS - Defense Security Service

DTIC - Defense Technical Information Center

EMSEC - Emission Security (formerly TEMPEST)

Facility Security Clearance (FCL) - All contractors requiring access to classified information require an FCL. An

FCL is an administrative determination that a company or firm is eligible for access to classified information. FCL eligibility is determined by the contractor’s demonstrated reliability, integrity, stability, and mandated ownership prerequisite.

Final DD Form 254 - Is completed only when a contract is closed out and the contractor requests and receives approval for retention of classified material.

Follow-On Contract - Any contract award where there was a preceding completed contract to the same contractor for a like work effort.

For Official Use Only (FOUO) - "For Official Use Only (FOUO)" is a designation that is applied to unclassified information that may be exempt from mandatory release to the public under the Freedom of Information Act (FOIA)

(reference (g)). The FOIA specifies nine exemptions that may qualify certain information to be withheld from release to the public if, by its disclosure, a foreseeable harm would occur.

IFB - Invitation for Bid

ISPR – Information Security Program Review

Integrated Visitor Group - An integrated visitor group is a DoD contractor operation located on an Air Force installation that requires access to classified information. It operates under the direct control of the Air Force. It differs from a cleared facility by its close interaction and/or working relationship with an Air Force organization.

Normally, the visitor group operation is integrated into and directly supports the organization’s mission. It does not handle, process, or store classified information independent of the Air Force activity. The specific security requirements applicable to the visitor group must be identified and specified in the Visitor Group Security

Agreement (VGSA). The VGSA outlines safeguarding requirements for both classified and sensitive unclassified information to be disclosed under the terms of the contract. It differs from an intermittent visitor primarily because of its long-term presence on an installation.

Intermittent Visitor - The intermittent visitor can best be described as a cleared DoD contractor who may visit an AF installation on an infrequent basis for brief periods of time on a scheduled or on-call basis to perform contractual services or duties which requires access to classified information. Typical intermittent visitors include, but are not limited to, telephone maintenance technicians, reproduction equipment and computer technicians, etc. Normally, the cognizant security office (CSO) provides industrial security program oversight for these types of visitors via their off-base home office facility (HOF). The intermittent visitor’s presence on a installation normally does not exceed 90 consecutive days.

Information Protection (IP) - Information Protection (IP) is the collective policies and, processes and implementation of risk management and mitigation actions instituted to prevent the compromise, loss, unauthorized access/disclosure, destruction, distortion or non-accessibility of information, regardless of physical form or characteristics, over the life cycle of the information.

ISR - Industrial Security Regulation (DoD 5220.22-R)

NATO - North Atlantic Treaty Organization

NISPOM - National Industrial Security Program Operating Manual (DoD 5220.22-M)

OPSEC - Operations Security - The process of denying adversaries information about friendly capabilities and intentions by identifying, controlling, and protecting indicators associated with planning and conducting military operations and other activities.

PR - Purchase Request

Program Security Officer (PSO) – Individual responsible for SAP security cognizance for the parent unit, supported and subordinate organizations.

RFQ - Request for Quotation

RFP - Request for Proposal

Special Access Program (SAP) - Any approved program which imposes strict clearance and investigative criteria, need-to-know, and access controls beyond those normally required for access to collateral classified information.

Sensitive Compartmented Information (SCI) - Classified information concerning or derived from intelligence sources, methods, or analytical processes, which is required to be handled exclusively within formal access control systems established by the Director of Central Intelligence (DCI).

SCG - Security Classification Guide

Solicitation Stage - Period of time from program concept to contract award. DD Forms 254 for RFP/RFQ/IFB are completed during this time period.

SOW - Statement of Work

Servicing Security Activity (SSA) – This activity implements and oversees the industrial security program for an installation and designated on-base contractors. The installation commander designates the servicing security activity.

Special Security Office (SSO) – Individual responsible for SCI security cognizance for the parent unit, supported and subordinate organizations, and subordinate SCI facilities (SCIF).

User Agencies (UA) - Office of Secretary of Defense boards, councils, Staffs and Commands, DoD agencies and the

Department of the Army, Navy and Air Force including all of their activities.

Visitor Group Security Agreement (VGSA) – A documented and legally binding contractual agreement between an

Air Force activity and a DoD contractor whereby the contractor commits to rendering or performing specific security services for compensation. The VGSA attest to and certifies the existence of such an agreement, including applicable changes and amendments, attachments, supplements and exhibits.