dd_0254.pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

b. LEVEL OF SAFEGUARDING REQUIRED

2. THIS SPECIFICATION IS FOR: (X and complete as applicable)

a. PRIME CONTRACT NUMBER

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable)

a. ORIGINAL (Complete date in all cases)

REVISION NO.

c. FINAL (Complete Item 5 in all cases)

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specs)

DATE (YYYYMMDD)

DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

10. CONTRACTOR WILL REQUIRE ACCESS TO: 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL:YES NO YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

d. FORMERLY RESTRICTED DATA

e. INTELLIGENCE INFORMATION

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

f. SPECIAL ACCESS INFORMATION

g. NATO INFORMATION

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

j. FOR OFFICIAL USE ONLY INFORMATION

k. OTHER (Specify)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE TEMPEST REQUIREMENTS

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

l. OTHER (Specify)

DD FORM 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE. Adobe Professional 7.0

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release

a. TYPED NAME OF CERTIFYING OFFICIAL

Direct Through (Specify)

d. ADDRESS (Include Zip Code)

Yes No to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract.

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office.

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

b. TITLE c. TELEPHONE (Include Area Code)

e. SIGNATURE

17. REQUIRED DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD FORM 254 (BACK), DEC 1999

FOR OFFICIAL USE ONLY (FOUO)

(DOD 5400.7-R, AF Supplement)

FOUO is not a classification. Originators mark records when they create them to call attention to FOUO content. An FOUO marking does not mean you must withhold a record under the FOIA. You still need to review requested records. Examine records with and without markings to identify information that needs protection and is exempt from public release or to decide whether discretionary release is appropriate.

Information in a technical document that requires a distribution statement per AFI 61-204, Disseminating Scientific and Technical Information, must show that statement. The originator may also mark the information FOUO, if appropriate.

Mark an unclassified document containing FOUO information “For Official Use Only” at the bottom, on the outside of the front cover (if any), on each page containing FOUO information, on the back page, and on the outside of the back cover (if any).

In unclassified documents, the originator may also mark individual paragraphs that contain FOUO information to alert users and assist in review.

In a classified document, mark: An individual paragraph that contains FOUO, but not classified information, by placing “(FOUO)” at the beginning of the paragraph.

The top and bottom of each page that has both FOUO and classified information, with the highest security classification of information on that page.

“FOUO” at the bottom of each page that has FOUO but not classified information.

If a classified document also contains FOUO information or if the classified material becomes FOUO when declassified, place the following statement on the bottom of the cover or the first page, under the classification marking: NOTE: If declassified, review the document to make sure material is not FOUO and not exempt under DOD 5400.7, AF Supplement before public release.

Mark other records, such as computer printouts, photographs, films, tapes, or slides, “For Official Use Only” or “FOUO” so the receiver or viewer knows the record contains FOUO information.

Mark FOUO material sent to authorized persons outside the DOD with an explanation typed or stamped on the document.

Transmitting FOUO:

DOD components, officials of DOD components, and authorized DOD contractor consultants, and grantees send FOUO information to each other to conduct official DOD business. Tell recipients the status of such information, and send the material in a way that prevents unauthorized public disclosure. Make sure documents that transmit FOUO material call attention to any FOUO attachments. Normally, you may send FOUO records over facsimile equipment. When deciding whether to send FOUO records over facsimile equipment, balance the sensitivity of the records against the risk of disclosure. To prevent unauthorized disclosure, consider attaching special cover sheets (i.e. AF Form 3227, Privacy Act Cover Sheet, for Privacy Act Information), the location of sending and receiving machines, and ensure authorized personnel are available to receive FOUO information as soon as it is transmitted. FOUO information may be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Mark the records “For Official Use Only,” and tell the recipient the information is exempt from public disclosure under the FOIA and whether it needs special handling.

Electronically and Facsimile Transmitted Messages. Each part of electronically and facsimile transmitted messages containing FOUO information shall be marked appropriately. Unclassified messages containing FOUO information shall contain the abbreviation “FOUO” before the beginning of the text. Such messages and facsimiles shall be transmitted in accordance with communications security procedures whenever practicable.*

Transporting FOUO:

Records containing FOUO information shall be transported in a manner that prevents disclosure of the contents. When not commingled with classified information, FOUO information may be sent via first-class mail or parcel post. Bulky shipments, such as distributions of FOUO Directives to testing materials, that otherwise qualify under postal regulations may be sent by fourth class mail.

Mark each part of a message that contains FOUO information. Unclassified messages containing FOUO information must show the abbreviation “FOUO” before the text begins.

Safeguarding FOUO Information:

During normal duty hours: During normal working hours, records determined to be FOUO shall be placed in an out-of-sight location if the work area is accessible to non-government personnel.

During Non-duty Hours: At the close of business, FOUO records shall be stored so as to prevent unauthorized access. Filing such material with other unclassified records in unlocked files or desks, etc., is adequate when normal U.S. Government or Government-contractor internal building security is provided during non-duty hours. When such internal security control is not exercised, locked buildings or rooms normally provide adequate after-hours protection. If such protection is not considered adequate, FOUO material shall be stored in locked receptacles such as file cabinets, desks, or bookcases. FOUO records that are subject to the provisions of the National Security Act of 1959 (reference (aa)) shall meet the safeguards outlined for that group of records.

Termination, Disposal and Unauthorized Disclosures:

Termination: The originator or other competent authority; e.g., initial denial and appellate authorities, shall terminate “For Official Use Only” markings or status when circumstances indicate that the information no longer requires protection from public disclosure. When FOUO status is terminated, all known holders shall be notified, to the extent practical. Upon notification, holders shall efface or remove the “For Official Use only” markings, but records in file or storage need not be retrieved solely for that purpose.

Disposal: Non-record copies of FOUO materials may be destroyed by tearing each copy into pieces to prevent reconstructing, and placing them in regular trash containers. When local circumstances or experience indicates that this destruction method is not sufficiently protective of FOUO information, local authorities may direct other methods but must give due consideration to the additional expense balanced against the degree of sensitivity of the type of FOUO information contained in the records.

Record copies of FOUO documents shall be disposed of in accordance with the disposal standards established under 44 U.S.C. 3301-3314 (reference (ab)), as implemented by DOD Component instructions concerning records disposal.

Unauthorized disclosure: The unauthorized disclosure of FOUO records does not constitute an unauthorized disclosure of DOD information classified for security purposes. Appropriate administrative action shall be taken, however, to fix responsibility for unauthorized disclosure whenever feasible, and appropriate disciplinary action shall be taken against those responsible. Unauthorized disclosure of FOUO information that is protected by the Privacy Act (reference (d) may also result in civil and criminal sanctions against responsible persons. The DOD Component that originated the FOUO information shall be informed of its unauthorized disclosure.

*NOTE: For clarification of electronic dissemination, FOUO will not be sent electronically unless it remains behind the Hill AFB/SIINET Firewall.

PAGE

DD Form 254 Addendum

OPSEC

All contractors, subcontractors, their employees, associates, and consultants who have access to critical information must comply with the Air Force-sponsored Operations Security (OPSEC) program.

OPSEC is a systematic means of identifying and protecting information which an adversary could use to their advantage or to our disadvantage. Critical Information (CI) is generally unclassified but sensitive information which has been identified by the OPSEC program as requiring protection. OPSEC Measures (OM) are control standards with which all personnel must comply in order to protect critical information.

Responsibilities:

The 748 SCMG must provide / approve OPSEC training curriculum for use by the contractor. Training must provide listings of critical information that must be protected by all personnel, listings of OPSEC measures which must be used by all personnel to protect critical information, and current foreign intelligence and industrial espionage threats. The contractor must ensure all personnel working on the contract or having access to critical information attend initial and annually recurring refresher training and that the approved curriculum is presented. Training must be provided before personnel are allowed access to critical information. All personnel must comply with OPSEC standards and practices as trained. Additional training may be required based on updates to critical information, OPSEC measures, intelligence threat, or other fundamental changes to the OPSEC program.

The contractor must track OPSEC training statistics to include the personnel working on the contract, when each individual received the required OPSEC training, and when refresher training is due. Training statistics must be forwarded to the 748 SCMG OPSEC program coordinator, Mr. Roland Eden at 777-7449 at the end of each calendar quarter and upon request.

Prior to seeking approval through Hill AFB Public Affairs, any information to be released outside of official U.S. Government channels, via any media, must be approved through an OPSEC review by the 748 SCMG OPSEC program coordinator. All personnel must promptly report OPSEC related incidents, issues, and concerns to the 748 SCMG OPSEC program coordinator Mr. Roland Eden at 777-7449.

Prime Contractor Solicitation #: FD20201400014

Addendum template version: Oct 2010. Previous versions will be used.

DD254 Section 13 Required Signatures:

These Signatures are for contract /subcontract/ solicitation # FD2020-14-00014 image4.emf image1.emf image2.emf image3.emf

7285 4th Street Hill AFB UT 84056 guidance: Ref 10.j: FOUO information provided under this contract shall be safeguarded as specified in the attachment protecting For Official Use Only (FOUO) information.

Ref 11.b:The contractor will receive classified documents for reference only; however, if any classified information is generated in performance of this contract, the contractor will be required to apply derivative classification markings consistent with the source documents/materials and Executive Order 13526, as amended Security Classification Guide: F-16 Multi-mission fighter, dated 1 June 2006. Note: all aspects of this contract must be in compliance with the NISPOM.

Ref 11.j:Ref 11.j: The contractor must comply with the U.S. Government, DOD, Air Force, AFMC, Hill AFB, and 748 SCMG Operation Security (OPSEC) Programs. The contractor must comply with any additional OPSEC requirements referenced.

*Below signatures are located on attached "Electronic Signatures.docx" form attached.

13a. Program Official 13b. Duty phone 13c. Five Year Review Date

Joe Refahiyat 801-775-4602 2019 01 06 416th SCMS/GUMAD Program Engineer

Security Manager Roland Eden Industrial Security

416 SCMS 748 SCMG/OMO 75 ABW/IPD

Hill AFB, UT 84056