Attach 5 RCU DD Form 254_Rev1.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

Contractor will comply with Risk Management Framework (RMF).

The contractor will notify the Government Contracting Activity and the Government Security Manager within 24 hours of any incident involving the actual or suspected compromise/loss of controlled unclassified information to enable the Government to conduct immediate assessment of potential impact pending formal inquiry/investigation. Actual or suspected compromise of Covered Defense Information will be reported IAW DFARS Clause 252.204-7012.

The Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware. All information received or generated will be properly stored and handled according to the markings on the material. All information received or generated is the property of the U.S. Government. At the termination or expiration of the contract, the U.S. Government will be contacted for proper disposition instructions.

Ref Blk 10e(2): This effort does not require access to SCI information and does not require protection of non-SCI intelligence information.

Ref Blk 10j/11l: The contractor shall comply with DoDI 5200.48_DAFI16-1403, Controlled Unclassified Information, DoDM 5200.01, Vol 1_AFMAN16-1404, Vol 1, Air Force Information Security Program, and DoDM 5400.07_AFMAN33-302 Air Force Manual, DoD Freedom of Information Act (FOIA) Program. The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information. CUI includes accountable or non-accountable CUI information. Access to CUI information is authorized to the prime contractor only. Further release requires prior approval from the owner of the CUI.

Ref Blk 10k: The technical data associated with this effort export controlled and cannot be exported without authorized exemption or license. Anyone requesting export-controlled data must hold a valid current DD2345 Military Critical Technical Data Agreement to “receive” export-controlled data even if they do not intend to export the data or product. Foreign Military Sales (FMS) agreements and other programs have license exemptions. Contact your local Foreign Disclosure Office. see DoDD 5230.25 Withholding Technical Data

Ref Blk 11d: The contractor will fabricate and store CUI hardware at their facility in the performance of this effort. The contractor shall provide the Government with the physical address(es) and Security Point(s) of Contact for each location where hardware will be fabricated or stored prior to commencing performance. The contractor will not need access to JWICS or SIPRNET or other information system/netowrk specific connections for contract performance.

Ref Blk 11j: OPSEC requirements apply. See Statement of Objectives (SOO) for requirements.

Ref Blk 11l: The contractor shall comply with DoDI 5200.48, Controlled Unclassified Information, AFI 16-1404 Air Force Information Security Program, Air Force Guidance Memorandum 2021-16-01, Air Force Guidance Memorandum for CUI, 22 July 2021, and DoDM 5400.07-Air Force Manual 33-302, DoD Freedom of Information Act (FOIA) Program. DoD Components: Refer to DoDI 5200.48_DAFI 16-1403, when considering specific requirements to be imposed on the contractor for the protection of CUI.The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

1. Responsibilities.

1. Air Force components that originate or are responsible for technical documents must determine their documents’ distribution availability and mark them appropriately before disseminating them. Components are responsible for the proper handling, securing, disseminating, and disposing of scientific and technical information.

1.1. The AFI 61-204 Instruction is based upon DODD 5230.24 and applies to all technical documents. “It also applies to engineering drawings, standards, specifications, technical manuals, blueprints, drawings, plans, instructions, computer software and documentation, photographs, technical orders, databases, and any information that can be used or adapted for use to design, engineer, produce, manufacture, operate, repair, overhaul, or reproduce any military or space equipment or technology concerning that equipment. It applies to any medium that transfers information, including paper, microform, electronic storage, and video recordings.” These technical documents can be defined as”…information that conveys scientific and technical information or information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process or to design, procure, produce, support, maintain, operate, repair or overhaul material. This data may be graphic or delineations in media, such as drawings or photographs, text in specifications or related performance or design type documents or computer printouts. Examples of technical data include research and engineering data, engineering drawings and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information and computer software documentation.

2. Marking Scientific and Technical Documents.

2.1. Mark all scientific and technical documents, whether produced in hard-copy or in digital format that may be disseminated.

2.1.1. Apply the single most appropriate distribution statements. Fill in the reason, the date of determination, and the controlling DoD office. Other changes to these distribution statements are prohibited. NOTE: Distribution statements apply to secondary distribution only; they do not apply to primary distribution from the controlling DoD office. Distribution control markings must be clearly discernible as documents and/or data are opened. Record media casings must also be clearly marked.

3. Dissemination of Scientific and Technical Information.

3.1. Do not disseminate any scientific or technical document, including one in draft or preliminary form that does not have a clearly marked distribution statement.

3.2. Primary dissemination of scientific or technical information must be in accordance with all regulations and instructions applicable to the scope of primary dissemination or the document’s distribution statement, whichever covers the broader audience.

Below is the marking that is to be used for all documents that require STINFO markings.

DISTRIBUTION F: Further dissemination only as directed by AFLCMC/HNC or DOD higher authority (AFLCMC/HNC).

WARNING: This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C Sec 2751 et seq.) or the Export Administration Act of 1979, as amended (Title 50 U.S.C. App. 2401 et seq.). Violators of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DOD Directive 5230.25.

HHANDLING AND DESTRUCTION NOTICE: Comply with distribution statement and destroy by any method that will prevent disclosure of contents or reconstruction of the document. (STINFO markings should be located on the title page of the published or drafted document, briefing, drawing, etc. Markings require the following: (1) Distribution Statement, (2) Warning, and (3) Handling and Destruction Notice).

Ref Blk 11m: The Following FARS and DFARS Clauses apply: Far Clause 52.204-2, FAR Clause 52.204-21, DFARS Clause 252.204-7012, DFARS 252.204-7000, DFARS 252.204-7008 and DFARS 252.204-7009. The National Industrial Security Program Operating Manual (NISPOM), February 2006, Incorporating Change 2 May 18, 2016 applies.

STINFO: Disseminating Scientific and Technical Information (STINFO): Responsibilities.

1. Air Force components that originate or are responsible for technical documents must determine their documents’ distribution availability and mark them appropriately before disseminating them. Components are responsible for the proper handling, securing, disseminating, and disposing of scientific and technical information.

1.1. The AFI 61-204 Instruction is based upon DODD 5230.24 and applies to all technical documents. “It also applies to engineering drawings, standards, specifications, technical manuals, blueprints, drawings, plans, instructions, computer software and documentation, photographs, technical orders, databases, and any information that can be used or adapted for use to design, engineer, produce, manufacture, operate, repair, overhaul, or reproduce any military or space equipment or technology concerning that equipment. It applies to any medium that transfers information, including paper, microform, electronic storage, and video recordings.” These technical documents can be defined as”…information that conveys scientific and technical information or information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process or to design, procure, produce, support, maintain, operate, repair or overhaul material. This data may be graphic or delineations in media, such as drawings or photographs, text in specifications or related performance or design type documents or computer printouts. Examples of technical data include research and engineering data, engineering drawings and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information and computer software documentation.

2. Marking Scientific and Technical Documents.

2.1. Mark all scientific and technical documents, whether produced in hard-copy or in digital format that may be disseminated.

2.1.1. Apply the single most appropriate distribution statements. Fill in the reason, the date of determination, and the controlling DoD office. Other changes to these distribution statements are prohibited. NOTE: Distribution statements apply to secondary distribution only; they do not apply to primary distribution from the controlling DoD office. Distribution control markings must be clearly discernable as documents and/or data are opened. Record media casings must also be clearly marked.

3. Dissemination of Scientific and Technical Information.

3.1. Do not disseminate any scientific or technical document, including one in draft or preliminary form that does not have a clearly marked distribution statement.

3.2. Primary dissemination of scientific or technical information must be in accordance with all regulations and instructions applicable to the scope of primary dissemination or the document’s distribution statement, whichever covers the broader audience.

Below is the marking that is to be used for all documents that require STINFO markings.

DISTRIBUTION F: Further dissemination only as directed by AFLCMC/HNCJ or DOD higher authority (AFLCMC/HNC).

WARNING: This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C Sec 2751 et seq.) or the Export Administration Act of 1979, as amended (Title 50 U.S.C. App. 2401 et seq.). Violators of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DOD Directive 5230.25.

HANDLING AND DESTRUCTION NOTICE: Comply with distribution statement and destroy by any method that will prevent disclosure of contents or reconstruction of the document. (STINFO markings should be located on the title page of the published or drafted document, briefing, drawing, etc. Markings require the following: (1) Distribution Statement, (2) Warning, and (3) Handling and Destruction Notice).

Ref Blk 12: Contractor is to submit requests through the Contracting Officer for OPSEC Program Manager review and public release authorization. The Contracting Officer will provide contractor with written approval/disapproval. Information requiring AF or DoD-level review will be reviewed by the unit's OPSEC Program Manager or Coordinator who will in-turn forward to the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690. Transmission of public release request via e-mail is not authorized. Public release of Sensitive Compartmented Information (SCI) is not authorized. AFLCMC/HNCAM, 230 Hall Blvd, STE 131, San Antonio, TX 78243.

Public Release: Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority. The contractor is responsible for obtaining the approval of the GCA prior to release of any information received or generated under the contract, except for certain types of information authorized by the NISPOM. Subcontractors must submit requests for public release through the prime contractor. The prime contractor is responsible for submitting the subcontractor’s request for public release to the GCA public release authority.

FARS and DFARS Clauses required to be put into the contract:

FAR Clause 52.204-21 Basic Safeguarding of Covered Contractor Information. This clause applies to information not intended for public release that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.

DFARS Clause 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting – (This is required for all Solicitations and Contracts). This clause requires a company to safeguard CDI, as defined in the clause, and to report to the DoD the possible exfiltration, manipulation, or other loss or compromise of unclassified CDI: or other activities that allow unauthorized access to the contractor’s unclassified information system on which unclassified CDI is resident or transiting. The company must submit the malware to DoD if the company is able to isolate it and send it safely.

DFARS Clause 252.204-7000 Disclosure of Information. This clause prohibits the contractor from releasing any unclassified information pertaining to the contract or any program related to the contract, unless they have CO approval or the information is in the public domain before the date of release.

DFARS Clause 252.204-7008 Compliance with Safeguarding Covered Defense Information Controls (Only required in all Solicitations). This clause requires contractors and subcontractors to safeguard covered defense information that resides in or transmits through covered contractor information systems by applying specified network security controls as identified in NISTSP 800-171.

DFARS Clause 252.204.7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information (This is required in all Solicitations and Contracts). This clause is required for contractor services that include support for the Government’s activities related to safeguarding covered defense information and cyber incident reporting.

The Contractor shall comply with DoDM 5400.07/Air Force Manual 33-302, DoD Freedom of Information Act (FOIA) Program requirements. Protection of unclassified DoD information not approved for public release on non-DoD Information Systems will be protected IAW DoDI 8582.01, Security of Unclassified DoD Information on non-DoD Information Systems.

The Contractor shall distribute controlled unclassified information IAW DoD Instruction 3200.14, Principles and Operational Parameters of the DoD Scientific and Technical Information Program, and DoD Instruction 2040.02, International Transfer of Technology, Articles, and Services. The Contractor shall properly mark all such documents IAW DoD Instruction 5230.24, Distribution Statements on Technical Documents. Technical documents not subject to distribution are defined in DoD Instruction 5230.24, DoD Directive 5230.25, and DoD Manual 5010.12-M, Procedures for the Acquisition and Management of Technical Data.

The contractor shall identify CPI and Resident CPI (formerly called Critical Technology) which need to be protected. The CPI identified shall be approved by the USG Program Manager. The CPI identification shall include a review of the system, unique integration, support equipment and the Non-Resident design/process/material aspects of the program. All identified CPI shall be protected with appropriate countermeasures. In the case of Resident CPI the use of Anti-Tamper shall be considered and documented in an Anti-Tamper Recommendation Report in accordance with the DAG Chapter 13 and DoDI 5200.39. The contractor shall identify system security engineering requirements in the contractor’s Requirements Management Specification, write Test Plans and accomplish Verification Testing to mitigate protection risks to an appropriate level.

Program Manager/Contracting Officer’s Representative: Jason Reyes, AFLCMC/HNCAA, 210-925-1358, Jason.Reyes.14@us.af.mil text:

AFLCMC/HNCAA

PROGRAM MANAGER

text:

AFLCMC/HNCAA

COMSEC

text:

AFLCMC/HNC-SO

INDUSTRIAL SECURITY MANAGER

text:

AFLCMC/INHS

SPECIAL SECURITY OFFIER (SSO)

text:

AFLCMC/IP

INFORMATION PROTECTION

AFLCMC/HNCAA

rep: VELA, JOSE

AFLCMC/HNCAA

rep: LARA, JESUS A.

AFLCMC/HNC-SO

rep: CEROVAC, DARLENE

AFLCMC/INHS

rep: JULIAN, JOSHUA L.

AFLCMC/IP

230 Hall Blvd, Ste 100 San Antonio, TX 78243