FA810221R0008_DD254_18Mar2022.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, MAY 2019

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

20220531 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification whs.mc-alex.esd.mbx.formswebmaster@mail.mil

WHS

List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

400 Collins RD NE Cedar Rapids, IA 52498-0505 Name:

N/A

303 Fountains Parkway, Suite 303, Fairview Heights, IL 62208 618-206-5524 / dcsa.dcsa-northern.dcsa-isfo.mbx.st-louis-field-office@mail.mil

CSO:

N/A CSO: DCSA Irving Field Office (IOFSI) 2250 West John Carpenter Freeway, Suite 450, Irving, TX 75063 469-329-6367 / dcsa.irvingfieldoffice@mail.mil

CSO: 11 WG/IP

1190 Menoher Dr, Suite 30 Andrews AFB, MD 20762 240-857-1545

CSO: 319 ABW/IP

701 Eielson St Grand Forks AFB, ND 58205 607-747-4351

3200 East Renner Road Richardson, TX 75083-3807 Location: Andrews Network Control Station 1558 Alabama Ave, Bldg 1558 Joint Base Base Andrews, MD 20762 Location: Grand Forks Network Control Station 371 Steen Avenue, Bldg 314 Grand Forks AFB, ND 58205

AFLCMC/HBD IP, 75 Vandenberg Drive, Bldg 1630, Hanscom AFB, MA 01731, AFLCMC.HBD.IP@us.af.mil

HQ Defense Counterintelligence and Security Agency, 27130 Telegraph Rd, Quantico, VA 22134

2. All provisions of E.O. 13526 (Classified National Security Information), dated 29 December 2009, regarding classification and marking guidance, will be implemented by contractors operating under the NISPOM.

3. The Contractor will notify the Government Contracting Activity (GCA) and the Government Security Manager within 48 hours of any incident involving the actual or suspected compromise/loss of classified information to enable the Government to conduct immediate assessment of potential impact pending formal inquiry/investigation. Actual or suspected compromise of Covered Defense Information will be reported IAW DFARS Clause 252.204-7012.

4. The following Security Classification Guide(s) (SCG) apply to classified performance on this contract. Subsequent updates shall be provided by the Contracting Officer as an attachment to the contract and shall be executed by the Contractor. High frequency Global Communications System (HFGCS) Program SCG, 01 Aug 2020, Change 1, 20 Nov 2020.

Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware. All classified information received or generated will be properly stored and handled according to the markings on the material. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of the contract, the U.S.

Government will be contacted for proper disposition instructions. Contractor will abide by and shall apply derivative classification and markings governed by the current version of the security classification guidance.

Prior to declassifying or downgrading information marked with a date or event on the "declassify on" line: The Contractor will confirm the OCA has not extended the classification period by reference to the applicable Security Classification or Declassification Guide or by consulting with the Program Office with the OCA.

5. Ref Blk 10a: COMSEC information includes accountable or non-accountable COMSEC information and controlled cryptographic items (CCI).

6. Ref Blks 10a/11h:

On Base: COMSEC/Cryptographic, Safeguarding requirements apply. See AFI 33-201 Volume 2, Communications Security (COMSEC) User Requirements for details.

At Contractor Facility: COMSEC/Cryptographic safeguarding requirements apply. See NSA/CSS Policy Manual 3-16, Control of COMSEC Material for guidance.

7. Ref Blk 10g: To facilitate potential access to NATO classified information, all DoD military, civilian, and contractor personnel who are briefed on their responsibilities for protecting U. S. classified military information, shall also be briefed on the requirements for protecting NATO information. NATO briefing required prior to granting access. See 32 CFR Part 117 section 117.9 (g) (7), for details.

8. Ref Blks 10j/11l: The contractor shall comply with DoDI 5200.48_DAFI16-1403, Controlled Unclassified Information, DoDM 5200.01 Vol 1_AFMAN16-1404 Vol 1, Air Force Information Security Program, and DoDM 5400.07_AFMAN33-302, DoD Freedom of Information Act (FOIA) Program. The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

9. Ref Blk 10k: Program Protection Plan (PPP) will be provided by Government activity.

10. Ref Blk 11c: Any classified information generated in the performance of this contract shall require the contractor to apply derivative classification and markings consistent with the source material or be governed by the current version of the High frequency Global Communications System (HFGCS) Program SCG, 01 Aug 2020, and Letter Changes 1, 20 Nov 2020. and Letter Changes; OPR: AFLCMC/HBDH, 7373 5th Street, Bldg 591, Tinker AFB, OK 73145-9025. SCDG will be provided under separate cover.

11. Ref Blk 11g: Access to DTIC can be requested through the DD Form 1540, Registration for Scientific and Technical Information Services or online at: http://www.dtic.mil/dtic/registration/registration.html.

The contractor may submit a DD Form 2345 to the Defense Logistics Services Center for access to unclassified, militarily critical technical data from other DoD sources. The GCA must certify the need-to-know to DTIC.

12. Ref Blk 11k: Go to https://www.ustranscom.mil/cmd/associated/dcd/ for Defense Courier Service points of contacts and guidance.

13. Ref Blk 11m: Applicable FARS and DFARS clauses:

FAR Clause 52.204-2 – Security Requirements – Contract involves access to information classified Confidential, Secret or Top Secret.

Compliance with the NISPOM.

FAR Clause 52.204-21 – Basic Safeguarding of Covered Contractor Information – Information not intended for public release that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government.

DFARS 252.204-7000 –Disclosure of Information – Prohibits the contractor from releasing any classified information pertaining to the contract or any program related to the contract, unless they have CO approval.

DFARS 252.204-7008 – Compliance with Safeguarding Covered Defense Information Controls – Requires contractors and subcontractors to safeguard covered defense information that resides in or transmits through covered contractor information systems by applying specified network security controls as identified in NISTSP 800-171.

DFARS 252.204-7009 – Limitations on the use or disclosure of Third-Party Contractor reported Cyber Incident Information – Required for contractor services that include support for the Government’s activities related to safeguarding covered defense information and cyber incident reporting.

DFARS Clause 252.204-7012 – Safeguarding Covered Defense Information (CDI) and Cyber Incident Reporting – Requires a company to safeguard CDI and to report to the DoD the possible exfiltration, manipulation, or other loss or compromise of unclassified CDI.

DFARS Clause 252.239-7000 and 252.239-7001 - For additional EMSEC requirements.

DFARS Clause 252.239-7010 – Cloud Computing Services - requires the cloud service provider to comply with the DoD Cloud Computing Security Requirements Guide and to comply with requirements for cyber incident reporting and damage assessment.

14. Ref Blk 12: Contractor is to submit requests through the Contracting Officer for OPSEC Program Manager review and public release authorization. The Contracting Officer will provide contractor with written approval/disapproval. Information requiring AF or DoD-level review will be reviewed by the unit's OPSEC Program Manager or Coordinator who will in-turn forward to the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690.

AFLCMC/HBDH, 7373 5th Street, Bldg 591, Tinker AFB, OK 73145-9025 for non-SAR related material. Transmission of public release request via e-mail is not authorized.

15. Ref Blk 18e: Complete address for the ACO:

Amanda Jones, AFLCMC/HBK, 3001 Staff Drive Ste 1AD2-104A, Tinker AFB, OK 73145

Program Manager: Capt Matthew D Jensen, AFLCMC/HBDH, (405) 734-9552 Contracting Officer: Jocelyn Johnson, AFLCMC/HBK, (312) 884-5587 Security Manager: Tina N. Holman, AFLCMC/HBD IP, (781) 225-5898 text:

AFLCMC/HBDH

text:

AFLCMC/HBD IP

text:

AFLCMC/IP

Program Manager rep: TINA N. HOLMAN, NH-III, DAF Chief, Information Protection rep: SEAN CRONE, NH-IV, DAF Industrial Lead

Ref Blk 11j: OPSEC requirements apply. See Performance Work Statement (PWS) for requirements.

Enter your name here.: Ref Blks 10a/11h:

On Base:

- Andrews AFB COMSEC account number(s), Andrews AFB, MD, has oversight for COMSEC

- Grand Forks AFB COMSEC account number(s), Grand Forks AFB, ND, has oversight for COMSEC.

At Contractor Facility: NSA has oversight for COMSEC.

Tinker AFB, OK 73145-9025 Address: AFLCMC/HBK 3001 Staff Drive Tinker AFB, OK 73145