Attachment_3_DD254_Cont'd.pdf

DD254 Cont’d 1 July 2014

Attachement #3(DD) Form 254

“Contract* Security Classification Specification”

ITEM 13 SECURITY GUIDANCE:

1. The following items apply to this contract.

GENERAL GUIDANCE:

The Contractor must:

Maintain accountability for all classified material released to his or her custody.

Not reproduce classified materials without the written permission of the releasing agency.

If permission is granted, each copy will be controlled in the same manner as the original.

Not destroy any classified without advance approval of the releasing agency.

Restrict access to only those individuals who possess the required security clearance and who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, other government agencies, and private individuals or an organization is prohibited unless authorized in writing by the releasing agency.

Not release classified material to foreign nationals or immigrant aliens whether or not they are consultants, US contractors, or employees of the contractor, and regardless of the level of their security clearance, except with advance written permission from the originator.

Ensure that each employee having access to the classified material is fully aware of the special security requirements for this material and maintains records in a manner that permits the contractor to furnish on demand the name of individuals who have access to the material in their custody.

Upon completion or termination of the classified contract, or sooner, when the purpose of the release has been served, the contractor must return to the COR all classified material

(furnished or generated), unless retention or destruction is authorized in writing by the originator of the classified or the releasing command.

ITEM 14:

Provide the information requested by the Notification of Government Security Activity Clause, AFFARS 5352.204-9000 to the Information Security Program Manager (ISPM) address in Item

17 of the DD Form 254. Contractor will enter into a Visitor Group Security Agreement with the local installation and adhere to requirements.

DD254 Cont’d 1 July 2014

3. Upon completion of this contract, all classified material provided to or generated by the contractor will be returned to the Air Force activity. If the material has been superseded or is no longer applicable, the Air Force activity will provide disposition instructions.

4. E.O. 13526, Classified National Security Information, and DoDM 5200.01, Information

Security Program, contains new classification, declassification, and marking requirements that are not found in the current DoD 5220.22M, National Industrial Security Program Operating

Manual (NISPOM). Refer to E.O.13526 and DoDM 5200.01 for guidance until the NISPOM is revised.

5. The contractor will follow all applicable security guidance related to the protection of classified information. Baseline guidance includes the National Industrial Security Program

Operating Manual (NISPOM), applicable Program Security Directives (PSDs) and Security

Classification Guides (SCGs) and Standard Operating Procedures.

Attachment # 3

Extract from DoD-R 5400.7/AF Sup

PROTECTING FOR OFFICIAL USE ONLY INFORMATON

1. FOR OFFCIAL USE ONLY INFORMATION:

a. The “Official Use Only” (FOUO) marking is assigned to controlled unclassified information at the time of its creation by a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 8 of the Freedom of Information Act

(FOIA).

b. Use of the above markings does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate purpose is served by withholding the information or portions of it.

2. IDENTIFICATION MARKINGS:

a. An unclassified document containing FOUO information will be marked “For Official

Use Only” at the bottom of the front cover (if any), on the first page, on each page containing

FOUO information, on the back page, and on the outside of the back cover (if any). No portion marking will be shown.

b. Within a classified document, an individual page that contains FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked, “FOUO”.

c. Any FOUO information released to a Contractor by a DoD User Agency will be marked with the following statement prior to transfer:

This document contains information EXEMPT FROM MANDATORY DISCLOSURE under the FOIA. Exemptions _________ apply.

d. Removal of the FOUO markings can only be accomplished by the originator or by other competent authority. When the FOUO status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: Contractors may disseminate FOUO information to their employees and subcontractors who have a need or the information in connection with a classified contract.

4. STORAGE: During working hours, FOUO information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other classified records in unlocked files or desks is adequate when internal building security is provided during non-working hours in open storage areas. When such internal security control is not exercised, locked buildings or rooms will provide adequate after-hours protection, or the material can be stored in locked receptacles such as file cabinets, or bookcases.

5. TRANSMISSION: FOUO information may be sent via first-class mail or parcel post.

Bulky shipments may be sent by fourth class mail.

6. DISPOSITION & DISCLOSURE: When no longer needed, FOUO information may be disposed of by tearing each copy into pieces to preclude reconstructing, and placing it in a regular trash container. Unauthorized disclosure of FOUO information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure.

The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions.

Attachment # 3

OPERATIONS SECURITY

This attachment provides guidance to contractors when DOD Operations Security (OPSEC) requirements are imposed by DOD User Agencies.

The general aim of OPSEC is to promote mission effectiveness by preserving essential secrecy about US intentions, capabilities, and current activities.

OPSEC is directed to the protection of UNCLASSIFIED intelligence indicators on classified or sensitive programs of such nature that the disclosure of the indicators may lead to the compromise of classified or sensitive information. Security essential to defense activities may be compromised whenever open sources (such as technical articles, press releases, National

Technical Information Services publications, the Congressional Record, Commerce Business

Daily, or contract awards) and detectable activities (such as communications, logistics actions, research, development and test activities, or radar emissions) provide information that hostile

Intelligence Services (HOIS) can piece together resulting in actions harmful to US interests.

OPSEC, thus, encompasses activities which are unique to the OPSEC process, i.e., (a) determining, through threat/vulnerability analysis, whether there are unacceptable/undesirable intelligence indicators and what they are; (b) developing and implementing countermeasures to best eliminate or minimize them.

OPSEC is concerned with all sources of exploitable information. It covers the total problem by addressing vulnerabilities and countermeasures for a specific program. It is the protection of things we do, our operations, tests, and activities. OPSEC is oriented principally to those instances in which evaluations indicate program weaknesses which could lead to the disclosure of classified information.

Unlike other security programs, OPSEC does not readily lend itself to complete identification of security requirements (counter-measures) during initial contract preparation. In order to judiciously apply OPSEC measures to a contractor’s facility or on-base activity, OPSEC planners must first know the security profile and specific vulnerabilities/weaknesses of the facility or activity in question. In order to achieve this starting point, input from the contractor in the form of an initial OPSEC plan must be developed and provided by the contractor. Contractor

OPSEC plans are then reviewed by the Brooks OPSEC Officer (311 HSW/IN) for approval.

Once approved, contractor OPSEC plans are then tailored to specific program requirements and countermeasures are specified accordingly; extensive and ongoing coordination is essential.

OPSEC countermeasures and plans must be flexible to address changes in the threat environment.

When requested by the installation commander, the Cognizant Security Officer (CSO) will perform OPSEC inspections of contractor facilities located on military installations, the CSO has principal responsibility for inspecting the contractor’s compliance with OPSEC requirements.

Cognizant User Agency representatives may accompany the CSO if requested. OPSEC inspections will be accomplished as part of the regular industrial inspection.

Refer to DOD 5220.22-M Sup 1 (Feb 1995), Chapter 11, Section 4 and 5; AFI 31-601 and supplements; AFI 10-701 and supplements.