Attachment_VI_-_DDForm254-Draft-_Final.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

Attachment 1 to the DD Form 254. FOR OFFICIAL USE ONLY (FOUO)

ADDENDUM CONTINUATION OF DD FORM 254

CONTRACT: TBD

DoD CONTROLLED UNCLASSIFIED INFORMATION ADDENDUM

In addition to classified information, certain types of unclassified information also require application of access and distribution controls and protective measures for a variety of reasons.

Such information is referred to collectively as Controlled Unclassified Information (CUI). DoD

CUI includes For Official Use Only (FOUO), Law Enforcement Sensitive (LES), DoD

Unclassified Controlled Nuclear Information (DoD UCNI), and LIMITED DISTRIBUTION, as well as some of those developed by other Executive Branch agencies. Contractors shall comply with related CUI applicable provisions identified in DoDM 5200.01, V-4, dated February 24, 2012.

ALL DoD unclassified information MUST BE REVIEWED AND APPROVED FOR RELEASE through standard DoD Component processes before it is provided to the public. The contractor will notify the Government Contracting Officer of unauthorized disclosures of DoD CUI.

The originator of a document is responsible for determining at origination whether the information may qualify for CUI status, and if so, for applying the appropriate CUI markings.

FOR OFFICIAL USE ONLY (FOUO)

FOUO is a dissemination control applied by the Department of Defense to unclassified information when disclosure to the public of that particular record, or portion thereof, would reasonably be expected to cause a foreseeable harm to an interest protected by one or more of

FOIA Exemptions 2 through 9. The document’s originator will determine at origination whether the information may qualify for FOUO status and to ensure markings are applied as required.

Contractors will comply with DoDM 5200.01, V-4, dated February 24, 2012. In regards to DoD

CUI and related FOUO. The following are select areas of emphasis:

1. ACCESS/DESIGNATION: Access to FOUO material shall be limited to those employees needing the material to do their jobs. No person may have access to information designated as

FOUO unless that person has been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. FOUO is not a classification. When a classified document or portion thereof is declassified, FOUO markings may be applied, if applicable, to protect the information. Marking information FOUO does not automatically qualify it for exemption from public release pursuant to the FOIA. If a request for a record is received, the information shall be reviewed to determine if it truly qualifies for exemption.

2. MARKING: Mark FOUO documents in accordance with DoDM 5200.01, V-4, ENCLOSURE 3, dated February 24, 2012, unless directed by the AF Activity to use approved variations. For example, for any e-mail containing FOUO, ensure the subject line alerts a reader the information includes FOUO (Subject Line Example: (FOUO) SUBJECT XYZ). Also, include the following warning Statement at the top of each email containing FOUO:

This e-mail contains FOR OFFICIAL USE ONLY (FOUO) information which must be protected under the Freedom of Information Act (5 U.S.C 552) and/or the Privacy Act of

1974 (5 U.S.C. 552a). Unauthorized disclosure or misuse of this PERSONAL

INFORMATION may result in disciplinary action, criminal and/or civil penalties.

Further distribution is prohibited without the approval of the author of this message unless the recipient has a need to know in the performance of official duties. If you have received this message in error, please notify the sender and delete all copies of this message.

3. STORAGE: During working hours, reasonable steps shall be taken to minimize the risk of access by unauthorized personnel (e.g., not reading, discussing, or leaving FOUO information unattended where unauthorized personnel are present). After working hours, FOUO information may be stored in unlocked containers, desks, or cabinets if Government or Government-contract building security is provided. If such building security is not provided or is deemed inadequate, the information shall be stored in locked desks, file cabinets, bookcases, locked rooms, etc.

Expenditure of funds for security container or close areas solely for the protection of FOUO material is prohibited unless specifically authorized by the Government Contracting Officer.

4. TRANSMISSION: FOUO information and material may be transmitted via first class mail, parcel post, or, for bulk shipments, via fourth class mail. Whenever practical, electronic transmission of FOUO information (e.g., data, website, or e-mail) shall be by approved secure communications systems or systems utilizing other protective measures such as Public Key

Infrastructure (PKI) or transport layer security (e.g., https). Use of wireless telephones should be avoided when other options are available. Transmission of FOUO by facsimile machine (fax) is permitted; the sender is responsible for determining that appropriate protection will be available at the receiving location prior to transmission (e.g., machine attended by a person authorized to receive FOUO; fax located in a controlled government environment).

5. RELEASE: FOUO material shall not be released outside the contractor's facility except to representatives of the DOD.

6. DESTRUCTION: When no longer needed, FOUO material shall be disposed of by a method that precludes its disclosure to unauthorized individuals.

DoD UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION

DoD UCNI is unclassified information on security measures (including security plans, procedures, and equipment) for the physical protection of DoD Special Nuclear Material (SNM), SNM equipment, SNM facilities, or nuclear weapons in DoD custody.

Information is designated DoD UCNI when it is determined that its unauthorized disclosure could reasonably be expected to have a significant adverse effect on the health and safety of the public or the common defense and security by increasing significantly the likelihood of the illegal production of nuclear weapons or the theft, diversion, or sabotage of DoD SNM, SNM equipment, SNM facilities, or nuclear weapons in DoD custody. Contractors will identify unclassified information determined needing protected as DoD UCNI, and not so designated/marked, to the Government Contracting Officer for appropriate review by a cognizant designation official.

Contractors requiring access to DoD UCNI shall comply with DoDI 5210.83. Contractors will also comply with DoDM 5200.01, V-4, dated February 24, 2012 and applicable Nuclear (Non-NC3) Overlay. The following are select areas of emphasis:

1. ACCESS/DESIGNATION: No explicit designation or security clearance is required for access to DoD UCNI; however, a person granted access to DoD UCNI must have a need to know the specific DoD UCNI to which access is granted in the performance of official duties or of

DoD-authorized activities. The individual granting access to DoD UCNI shall notify each person granted such access of applicable regulations, including the physical protection and access requirements, concerning the protection of DoD UCNI as well as any special dissemination limitations that apply to the specific DoD UCNI to which access is being granted, prior to dissemination of the DoD UCNI to the person. The requirement to notify persons granted access to DoD UCNI of applicable regulations concerning protection and dissemination of DoD UCNI may be met by attachment of an appropriate cover sheet to the front of each document or material containing DoD UCNI prior to its transmittal to the person granted access.

2. MARKING: Mark FOUO documents in accordance with DoDM 5200.01, V-4, ENCLOSURE 3, dated February 24, 2012.

3. PROTECTION/STORAGE: When not commingled with classified information, DoD UCNI may be sent by first-class mail in a single, opaque envelope or wrapping. Except in emergencies, transmission of DoD UCNI, to include voice, facsimile, and e-mail, shall be via approved secure communications circuits and equipment only. During working hours, reasonable measures shall be taken to minimize the risk of access by unauthorized personnel (e.g., not reading, discussing, or leaving DoD UCNI unattended where unauthorized personnel are present). After working hours, DoD UCNI may be stored in unlocked containers, desks, or cabinets if Government or

Government-contract building security is provided. If such building security is not provided or is deemed inadequate, DoD UCNI shall be stored in locked buildings, rooms, desks, file cabinets, bookcases, or similar items.

4. TRANSMISSION: When sending DOD UCNI via NIPRNet email, mark the subject line

(DoD UCNI) and include the following statement at the top of the email:

“This email and/or attached documents contain DOD UNCLASSIFIED CONTROLLED

NUCLEAR INFORMATION (DoD UCNI). Transmission of DoD UCNI shall be by means which preclude unauthorized disclosure or dissemination (e.g., secure phone, encrypted e-mail). DoD UCNI shall not be discussed or transmitted over an unprotected telephone or telecommunications circuit (to include facsimile transmissions) except in case of an emergency. During normal working hours, documents and materials determined to contain DoD UCNI shall be safeguarded and controlled by measures designed to reduce the risk of access to DoD UCNI by unauthorized individuals. A person granted access to DoD UCNI must have a need to know the specific DoD UCNI to which access is granted in the performance of official duties or of DoD-authorized activities. DoD UCNI is exempt from mandatory disclosure pursuant to section

552(b)(3)FOIA.”

5. RELEASE: DoD UCNI is exempt from mandatory public disclosure under Exemption 3 of the FOIA.

6. DESTRUCTION: Non-record DoD UCNI documents may be destroyed by shredding or burning or by any of the means approved for the destruction of classified information. Record copies of DoD UCNI documents shall be disposed in accordance with applicable record management regulations.

AFNWC/NDM Attachment # 1 of 1 to the DD Form 254

CONTRACT: TBD

AFNWC INFORMATION TECHNOLOGY/INFORMATION ASSURANCE ADDENDUM

All personnel (contractors, subcontractors, their employees, associates, consultants, etc.) who have access to unclassified or classified information or systems must abide by all AFI’s, AFSSI, AFMAN, DOD, STIG, DISA, etc.. when accessing any government Information System (IS).

If access to any IS is required all personnel must participate in the appropriate Information

Technology, Information Assurance, Information Protection, Force Protection, acceptable use, and notice of consent requirements in order to receive access to the proprietary areas, buildings, systems, etc.. The contractor must ensure all personnel working on the contract or having access to any IS must abide by AF guidelines, training requirements, etc.. All personnel must comply with information assurance standards and practices.

Any information systems hardware requirements that are outside the normal standard desktop user setup (computer, monitor and peripherals) that may be required under contractual agreements will need to be identified before contract award and reviewed by AFNWC/IT-S.

Any software requirements that are outside the AF Standard Desktop Core that may be required under contractual agreements will need to be identified before contract award and reviewed by

AFNWC/NDM

SIGNATURE

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments [1] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form) Attachment 1 to the DD Form 254 (Rev 2).docx

Ref 10c: This contractor is permitted access to CNWDI in performance of this contract. The government program manager or designated representative will ensure the contractor security supervisor is briefed for CNWDI.

Ref 10d: Access to FORMERLY RESTRICTED DATA requires a final U.S. Government clearance at the appropriated level.

Ref 10e (2): Contractor will require access to Intelligence information and must comply with AFI 14-303/AFMC Supplement 1.

The Program Manager has determined that disclosure does not create an unfair competitive advantage for the contractor or a conflict of interest with the contractor’s obligation to protect the information and will submit the AFMC Form 210 to the AFLCMC/INB for approval prior to granting access.

Ref 10.j.: FOUO information provided under this contract shall be safeguarded as specified in the attachment, "Protecting For Official Use Only (FOUO) Information.

Ref 11c and d.: Contractor must provide adequate storage for classified material/hardware to the level of SECRET.

Ref 11e: This contract is for Technical Order support only Ref 11g. See DTIC Online Registration [www.dtic.mil/dtic/registration] for related requirements to access DTIC. The sponsoring GCA must submit the DD Form 1540 “Registration for Scientific and Technical Information Services” to DTIC on behalf of the contractor. For subcontractors, the prime contractor submits the DD 1540 with the GCA verifying need to know. Level of access to DTIC’s information and services is dependent on the level of access specified in an individual’s registration profile. The contractor may also submit DD Form 2345 “Military Critical Technical Agreement” (after registration with DTIC) to the Defense Logistics Information Service (DLIS) for access to unclassified, military critical technical data from other DoD sources. The GCA must certify the need-to-know. Distribution of DTIC or other military critical technical data received as part of this contract shall NOT occur without specific Government approval.

Ref 11j. The contractor will comply with the Missile Sustainment Division OPSEC program. AFNWC/NDM Security Personnel, at Tinker AFB, are the installation point of contact. Contractor personnel will know who their organization’s OPSEC coordinator is and contact them for questions, concerns, or recommendations for OPSEC or Signature Management (SM) related topics. AFI10-701 OPSEC requirements apply to include being familiar with the organization’s critical information and protecting critical and/or sensitive information from disclosure. Contractor personnel will NOT publicly post or publish work-related information that potentially contains critical or sensitive information without explicit approval of their immediate supervisor, security office and/or OPSEC PM/SM/OPSEC coordinator, this includes NOT publicly disseminating, or publishing photographs displaying critical and/or sensitive information, nor publicly referencing, disseminating, or publishing critical and/or sensitive information already compromised. When directed or as part of established Standard Operating Procedures, contractor personnel will destroy (burn, shred, etc.) critical and/or sensitive unclassified information no longer needed to prevent the inadvertent disclosure and/or reconstruction of this material and implement additional protection measures as ordered by the commander, director, or an individual in an equivalent position. Contractor personnel will report attempts by unauthorized personnel to solicit critical and/or sensitive information and treat such attempts as human intelligence (HUMINT) gathering and consider it a HUMINT incident. All contractor personnel who have been involved in or have knowledge of a possible HUMINT incident will report all facts immediately to the nearest supporting AFOSI office.

Ref 11l. Government Notifications. The Contractor will notify the government when so directed and/or specified by provisions in this DD FORM 254, related TBD contract and/or related clauses, attachments, addendums, etc., The Contractor will immediately notify the government Contracting Officer of any changes relating to foreign owned, controlled, or influence (FOCI) type concerns, events and/or changes which may affect the Facility Security Clearance.

Ref 11l. Security Education and Training. Contractor personnel will participate in and receive security education and training at direction of the government Security Manager to include initial, recurring and annual venues. Training may include what defines classified information and CUI; proper protection of classified and CUI; actions to take if classified information or CUI is found unsecured, a vulnerability is noted, or a person seeks unauthorized access; a basic understanding of security policies and principles; requirements for public release of DoD information; personnel responsibilities and the sanctions that can be applied; local threat and techniques foreign intelligence activities use; and other relevant subjects/topics. Training and use of Security Classification Guide/s (SCG/s) will also be done. Contractor personnel not completing required training may be limited or prohibited from doing government work if deemed necessary by the government Program Manager. Related training records should be maintained on file for review by the CSO.

Ref 11 l: Follow the procedures in DoD 5220.22-M. National Industry Security Program Operating Manual (NSPOM), section 5-705, or DoDM 5200.01, Information Security for classified STINFO destruction. Destroy unclassified STINFO documents by any method that will prevent disclosure of contents or reconstruction of the document.

text: TERRY TURNER, Contracting Officer Represenative

AFNWC/NDMLT/405 739-8880

Tinker AFB, OK 73145-8901 text: RAY STOKES, Security Specialist

AFNWC/NDMO/405-739-8815

Tinker AFB, OK 73145-8901 text: MERLE NORMAN, Security Specialist

72 ABW/IPI/405-582-1822

Tinker AFB, OK 73145

Contracting Officer Rep rep: Ray D. Stokes Security Specialist rep: Merle Norman Industrial Security Specialist