Attach_5_-_DD_Form_254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

FOR OFFICIAL USE ONLY (FOUO)

The following procedures will be used to protect FOR OFFICIAL USE ONLY (FOUO) information.

1. HANDLING: Access to FOUO material shall be limited to those employees who need the material to do their jobs. The FOR OFFICIAL USE ONLY marking is assigned to information when created by a DOD User Agency. FOR OFFICIAL USE ONLY is not a classification, but requires extra precautions to ensure it is not releasable to the public.

2. MARKING:

a. Mark an unclassified document containing FOUO information “FOR OFFICIAL

USE ONLY” at the bottom of each page containing FOUO information and on the bottom of the front page or front cover (if any) and on the back of the last page and on the back cover (if any).

b. In a classified document, mark:

(1) An individual paragraph that contains FOUO, but not classified information, by placing “FOUO” at the beginning of the paragraph.

(2) The top and bottom of each page that has both FOUO and classified information, with the highest security classification of the information on that page.

(3) “FOUO” at the bottom of each page that has FOUO information but is not classified.

(4) If a classified document also contains FOUO information or if the classified material becomes FOUO when declassified, place the following statement on the bottom of the cover or the first page, under the classification marking: “NOTE: If declassified, review the document to make sure material is not FOUO and not exempt under DODR 5400.7/AF Supplement before public release.”

c. Mark other records, such as computer printouts, photographs, films, tapes, or slides

“FOR OFFICIAL USE ONLY” so that the receiver or viewer knows the record contains FOUO information.

d. Mark each part of a message that contains FOUO information. Unclassified messages containing FOUO information must show the abbreviation “FOUO” before the message begins.

e. Make sure that documents that transmit FOUO materials call attention to any FOUO attachments.

3. STORAGE: To safeguard FOR OFFICIAL USE ONLY records during normal duty hours, place them in an out-of-sight location if your work area is accessible to persons who do not have a valid need for the information. After normal duty hours, store FOUO records to prevent unauthorized access. File them with other unclassified records in unlocked files or desks when normal internal building security is provided. When there is no internal security, locked buildings or rooms usually provide adequate after-hours protection. For additional protection, store FOUO material in locked containers such as file cabinets, desks, or bookcases.

Expenditure of funds for security containers or closed areas solely for the protection of FOUO data is prohibited.

4. TRANSMISSION: FOUO material shall be transmitted by the same methods as other

UNCLASSIFIED material. Discussion of FOUO material on the telephone is authorized if necessary for performance of the contract. FOUO information may be transmitted over telephone lines in digital form, by telecopies, or by other commercial teletype lines without encryption.

5. RELEASE: FOUO information may be released only to DoD components, officials of DoD component, and other DoD contractors when needed to conduct official DoD business.

6. DESTRUCTION: When no longer needed, FOUO information may be disposed of by any method which will preclude its disclosure to unauthorized individuals.

OPERATIONS SECURITY

This attachment provides guidance to contractors when DOD Operations Security (OPSEC) requirements are imposed by DOD User Agencies.

Ensures appropriate levels of standardized OPSEC training and education are established and provided to all AF personnel, to include civil service personnel, and to all contractors who may potentially have access to mission critical information.

The general aim of OPSEC is to promote mission effectiveness by preserving essential secrecy about US intentions, capabilities, and current activities.

OPSEC is directed to the protection of UNCLASSIFIED intelligence indicators on classified or sensitive programs of such nature that the disclosure of the indicators may lead to the compromise of classified or sensitive information. Security essential to defense activities may be compromised whenever open sources (such as technical articles, press releases, National Technical Information Services publications, the Congressional Record, Commerce Business Daily, or contract awards) and detectable activities (such as communications, logistics actions, research, development and test activities, or radar emissions) provide information that hostile Intelligence Services (HOIS) can piece together resulting in actions harmful to US interests.

OPSEC, thus, encompasses activities which are unique to the OPSEC process, i.e., (a) determining, through threat/vulnerability analysis, whether there are unacceptable/undesirable intelligence indicators and what they are; (b) developing and implementing countermeasures to best eliminate or minimize them.

OPSEC is concerned with all sources of exploitable information. It covers the total problem by addressing vulnerabilities and countermeasures for a specific program. It is the protection of things we do, our operations, tests, and activities. OPSEC is oriented principally to those instances in which evaluations indicate program weaknesses which could lead to the disclosure of classified information.

Unlike other security programs, OPSEC does not readily lend itself to complete identification of security requirements (counter-measures) during initial contract preparation. In order to judiciously apply OPSEC measures to a contractor’s facility or on-base activity, OPSEC planners must first know the security profile and specific vulnerabilities/weaknesses of the facility or activity in question. In order to achieve this starting point, input from the contractor in the form of an initial OPSEC plan must be developed and provided by the contractor. Contractor OPSEC plans are then reviewed by the OPSEC Officer for approval. Once approved, contractor OPSEC plans are then tailored to specific program requirements and countermeasures are specified accordingly; extensive and ongoing coordination is essential. OPSEC countermeasures and plans must be flexible to address changes in the threat environment.

When requested by the installation commander, the Cognizant Security Officer (CSO) will perform

OPSEC inspections of contractor facilities located on military installations; the CSO has principal responsibility for inspecting the contractor’s compliance with OPSEC requirements. Cognizant User

Agency representatives may accompany the CSO if requested. OPSEC inspections will be accomplished as part of the regular industrial inspection.

AFI 16-1406 and supplements; AFI 10-701 and supplements.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments [2] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form) DD Form 254 Attachment 1 FOUO (002).pdf DD Form 254 Attachment 2 OPSEC (20170626).pdf

Base Specific Level

At the TO level there will be a Program Manager and a Contract Officer to ensure the necessary security guidance will be applicable.

10. Contractor will require access:

a. Contractors will require access to COMSEC information at on-base locations listed in item 8a. Contractor will not require their own COMSEC account. Access will be controlled by the sponsoring agency. Contractor will protect COMSEC material IAW directives deemed necessary by the installation COMSEC officer. Access to COMSEC material by personnel holding only reciprocal clearances.

j. The GCA is responsible for providing the contractor with the guidance necessary for the protection of the information. Controlled unclassified information (CUI) provided under this shall be safeguarded as specified in DoD 5400.7-R, DoD Freedom of Information Act Program and DoDM 5200.01, Vol 4. The contractor is responsible for incorporating safeguards in this multiple award contract.

k. Contract will require access to sensitive unclassified Government automated information systems (AIS) at different levels. Visitor Group must comply with all locations IT policies and procedures.

11. In this Contract, the Contractor will:

a. Contract performance is restricted to the locations identified in item 8a. The highest level of security clearance required for contract performance is Top Secret. Using activities will provide security classification guidance for performance of his contract. The Government will oversee the handling and storage capability foe all classified material required for this contract. All classified information shall be returned to the Government upon termination of the contract.

l. CUI Statement Controlled unclassified information (CUI) provided under this shall be safeguarded as specified in DoD 5400.7-R, DoD Freedom of Information Act Program and DoDM 5200.01, Vol 4.

j. Contractor will follow base and unit Operations Security (SOPs, OIs, etc) for the locations identified in item 8a. A copy of the local guidance will be provided to the contractor.

m. AFFARS 5352.204-9000, Visitor Group Security Agreement applies and will be executed between the installation commander and the contractor.

12. Public Release:

Information requiring AF or DoD-level review will be forwarded by the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690

DAF, AFIMSC Security rep: Mr. Armando J. Celaya, Manager GS-11

DAF, AFIMSC OPSEC

rep: John Howe, GS-14, Chief GS-14

DAF, AFIMSC/IP

JBSA Randolph, TX 78150 Address: 2021 First Street West JSBA-Randolph AFB, TX 78105-4302