Attachment_3_-_FPS3_DD254_(To_Be_Proposed)_05_Dec_13.pdf

ATTACHMENT 3

DD 254 (TO BE PROPOSED)

FOR

FORCE PROTECTION SITE SECURITY SYSTEM (FPS3)

5 DECEMBER 2013

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER

a. ORIGINAL (Complete date in all cases) Date (YYYYMMDD)

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs)

Revision No.

Date (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases) Date (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under ____________________________ (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated _______________, retention of the identified classified material is authorized for the period of ______________.

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

10. CONTRACTOR WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION NATO SECRET i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify).

k. OTHER Specify)

DD FORM 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manager or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct Through (Specify):

to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

b. TITLE

c. TELEPHONE (Include Area Code)

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD FORM 254 (BACK), DEC 1999

ATTACHMENT 3

For Official Use Only Information

1. For Official Use Only Information:

a. The “For Official Use Only” (FOUO) marking is assigned to information at the time of its creation by a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

b. Use of the above markings does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

2. Identification Markings:

a. An unclassified document containing FOUO information will be marked “For Official

Use Only” at the bottom of the front cover (if any), on the first page, on each page containing FOUO information, on the back page, and on the outside of the back cover (if any). No portion markings will be shown.

b. Within a classified document, an individual page that contains FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains FOUO information, but no classified information, the portion will be marked “FOUO.”

c. Any FOUO information released to a contractor by a DoD User Agency is required to be marked with the following statement prior to transfer: This document contains information EXEMPT FROM MANDATORY DISCLOSURE under the FOIA Exemptions ____ apply.

d. Removal of the FOUO marking can only be accomplished by the originator or other competent authority. When the FOUO status is terminated, all known holders will be notified to the extent practical.

3. Dissemination: Contractors may disseminate FOUO information to their employees and subcontractors who have a need for the information in connection with a classified contract.

4. Storage: During working hours, FOUO information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during non-working hours. When such internal security control is not exercised, lock buildings for rooms will provide adequate after-hours protection, or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. Transmission: FOUO information may be sent via first-class mail or parcel post. Bulky shipments may be sent by fourth class mail. When sending FOUO records over facsimile equipment, use cover sheets and consider the location of the sending and receiving machines to ensure authorized personnel are available to receive FOUO information. Discussion of FOUO material on the telephone is authorized if necessary for the performance of the contract.

6. Disposition & Disclosure: When no longer needed, FOUO information may be disposed of by tearing each copy into pieces to preclude reconstructing, and placing it in a regular trash container. Unauthorized disclosure of FOUO information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions.

BerthelotteB Typewritten Text Contract Number:

Contractor Name:

Contract Period of Performance:

BerthelotteB Typewritten Text

BeltzJ Typewritten Text DD Form 254 Reference Block 10j FOUO CONTINUATION OF FPS3 DD254

BeltzJ Typewritten Text

BeltzJ Typewritten Text

BeltzJ Typewritten Text

BeltzJ Typewritten Text

BeltzJ Typewritten Text

ATTACHMENT 4

Unclassified Controlled Nuclear Information (UCNI)

1) DoD UCNI shall be identified, controlled, marked, transmitted, and safeguarded in the DoD Components, the Intelligence Community, and the North Atlantic Treaty Organization (NATO), and among DoD contractors, consultants, and grantees. Within NATO, DoD UCNI shall be marked, controlled, and safeguarded as “NATO RESTRICTED” information. Reference DODI 5210.83

2) Contracts requiring access to or the preparation of unclassified information that is or could be DoD UCNI shall require compliance with this Instruction and any applicable DoD Component regulations, and shall specify requirements for identifying, marking, handling, and safeguarding DoD UCNI.

3) Access to DOD UCNI

a) No explicit designation or security clearance is required for access to DoD UCNI; however, a person granted access to DoD UCNI must have a need to know the specific DoD UCNI to which access is granted in the performance of DoD-authorized activities.

b) The individual granting access to DoD UCNI shall notify each person granted such access of applicable regulations, including the physical protection and access requirements, concerning the protection of DoD UCNI as well as any special dissemination limitations that apply to the specific DoD UCNI to which access is being granted, prior to dissemination of the DoD UCNI to the person.

c) The requirement to notify persons granted access to DoD UCNI of applicable regulations concerning protection and dissemination of DoD UCNI may be met by attachment of an appropriate cover sheet to the front of each document or material containing DoD UCNI prior to its transmittal to the person granted access.

4) Marking DOD UCNI

a) An unclassified document with DoD UCNI shall be marked “DOD UNCLASSIFIED CONTROLLED

NUCLEAR INFORMATION” (or abbreviated “DOD UCNI”) at the bottom on: the outside of the front cover, if any; the outside of the back cover, if any; the first page; and each individual page containing DoD UCNI.

b) Within an unclassified document, an individual page containing DoD UCNI shall be marked to show which of its portions contain DoD UCNI. In marking sections, parts, paragraphs, or similar portions, the parenthetical term “(DCNI)” shall be used and placed at the beginning of the applicable portions.

c) In a classified document, an individual page that has both DoD UCNI and classified information shall be marked at the top and bottom of the page with the highest security classification of information appearing on that page or with the overall classification of the document. In marking sections, parts, paragraphs, or similar portions, the parenthetical term “(U//DCNI)” shall be used and placed at the beginning of those portions containing DoD UCNI. In a classified document, an individual page that has DoD UCNI, but no classified information, shall be marked “UNCLASSIFIED//DOD UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION” (or “UNCLASSIFIED//DOD UCNI”) at the top and bottom of the page, unless the page is marked with the overall classification of the document. The DoD UCNI information may be included in the same portion with other classified or unclassified information, if all relevant statutory and regulatory markings and citations are included. DoDM 5200.01-V2 (Reference (k)) provides additional guidance on marking classified documents.

BerthelotteB Typewritten Text Contract Number:

Contractor Name:

Contract Period of Performance:

BerthelotteB Typewritten Text

BeltzJ Typewritten Text DD Form 254 Reference Block 10k Other CONTINUATION OF FPS3 DD254

BeltzJ Typewritten Text

BeltzJ Typewritten Text

BeltzJ Typewritten Text

BeltzJ Typewritten Text

BeltzJ Typewritten Text

BeltzJ Typewritten Text

BeltzJ

d) Other material (e.g., electronic media, photographs, films, tapes, or slides) containing DoD UCNI shall be conspicuously marked “DOD UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION” (or “DOD UCNI”) to ensure that a recipient or viewer is aware of the status of the information.

5) Transmission of DOD UCNI

a) Recipients shall be made aware of the status as DoD UCNI for all such information disseminated to them.

Transmission of DoD UCNI shall be by means which preclude unauthorized disclosure or dissemination (e.g., secure phone, encrypted e-mail).

b) Documents containing DoD UCNI shall be marked as prescribed in section 4 of this enclosure.

Transmittal documents shall call attention to the presence of DoD UCNI attachments using an appropriate statement in the text or including at the bottom of the transmittal document a statement similar to: “The attached document contains DoD Unclassified Controlled Nuclear Information (DoD UCNI).”

c) When not commingled with classified information, DoD UCNI may be sent by first-class mail in a single, opaque envelope, or wrapping.

d) DoD UCNI shall not be discussed or transmitted over an unprotected telephone or telecommunications circuit (to include facsimile transmissions) except in case of an emergency.

e) Each part of electronically transmitted messages containing DoD UCNI portions shall be marked appropriately. Unclassified messages, including e-mail, with DoD UCNI portions shall have the abbreviation “DOD UCNI” at the top of the message, before the beginning of the text, and the parenthetical marking “(DCNI)” preceding each portion of text containing DoD UCNI information.

Classified messages containing DoD UCNI portions shall be marked with the highest classification of information within the message; use the parenthetical marking “(U//DCNI)” preceding each portion of text containing DoD UCNI information.

f) DoD UCNI processed, stored, or produced on stand-alone or networked computers or other information technology systems shall enforce protection from unauthorized disclosure or dissemination.

g) A document marked as having DoD UCNI may be reproduced minimally without permission of the originator and consistent with the need to carry out official business.

6) Safeguarding DOD UCNI

a) During normal working hours, documents and materials determined to contain DoD UCNI shall be safeguarded and controlled by measures designed to reduce the risk of access to DoD UCNI by unauthorized individuals.

b) At the close of business, DoD UCNI shall be stored to preclude disclosure. Storage of such information with other unclassified information in unlocked receptacles (e.g., desks, bookcases) is adequate contractor internal building security is provided during non-duty hours. When such internal building security is not provided, locked rooms or buildings normally provide adequate after-hours protection. If such protection is not considered adequate, DoD UCNI shall be stored in locked receptacles (e.g., locked file cabinet, locked desk drawer, safe).

Non-record copies of DoD UCNI shall be destroyed by shredding or burning or, if the sensitivity or volume of the information justifies it, in accordance with the procedures specified by DoDM 5200.01-V3 (Reference (l)) for classified information.

BerthelotteB Typewritten Text Contract Number:

Contractor Name:

Contract Period of Performance:

BerthelotteB

BerthelotteB

Text1: Contract Number:

Contractor Name:

Contract Period of Performance:

Text2: CONTINUATION OF DD FORM 254 Block 13: Security Guidance (Continued), Blocks 10 and 11

Item 10. Contractor will require access to:

Ref Block 10a. Communications Security (COMSEC) Information. See Attachment 1; (COMSEC).

Ref Block 10b. Restricted Data: Access to RD requires a final U. S. Government clearance at the appropriate level.

Ref Block 10d. Formerly Restricted Data: Access to FRD requires a final U.S. Government clearance at the appropriate level.

Ref Block 10e(2). Non-SCI. See Attachment 2.

Ref Block 10g. NATO Information. All contractor personnel located on HAFB must be given a NATO Briefing.

Ref Block 10h. Foreign Government Information. Access to FGI requires a final U.S. Government clearance at the appropriate level.

Ref Block 10j. For Official Use Only (FOUO). See Attachment 3.

Ref Block 10k. Unclassified Controlled Nuclear Information (UCNI). See Attachment 4

Item 11. In performing this contract, the contractor will:

Ref Block 11c. Have authority to receive and generate classified material.

Ref Block 11f. Have Access to U.S. Classified Information Outside the U.S. Puerto Rico, U.S. Possession and Trust Territories.

Ref Block 11g. The contractor is authorized to use the services of DTIC and is required to prepare and process a DD Form 1540 - Registration for Scientific and Technical Information Services in accordance with the NISPOM. The contracting officer must be involved in certifying the need to know to DTIC. NOTE: Special Access Required (SAR) and Intelligence material is not releasable to DTIC.

Ref Block 11h. Have COMSEC Requirements. See Attachment 1.

Ref Block 11i. Have TEMPEST Requirements (EMSEC). See Attachment 5.

Ref Block 11j. Have Operations Security (OPSEC) Requirements: OPSEC requirements apply. See block 14.

Ref Block 11k. Be Authorized to Use of the Defense Courier Service, Defense Courier Division (TCJ3-C), United States Transportation Command, 508 Scott Drive, Scott AFB, IL 62225.

Ref Block 11l Other: Air Force Federal Acquisition Regulation (FAR) Supplement. See Attachment 6 Inspections: See Attachment 7.

Text13: Contract Number:

Contractor Name:

Contract Period of Performance:

Text14: DD Form 254, Reference Blocks 10a, 11h and 15 (COMSEC) CONTINUATION OF FPS3 DD 254

ATTACHMENT 1

COMMUNICATIONS SECURITY (COMSEC)

Block 10a – A contractor who requires access to COMSEC material or information must submit a request to the appropriate Air Force or National Security Agency Central Office of Record through the contracting or program office. If applicable, mark box 10a “YES.” COMSEC information includes all material or information accountable thru the COMSEC Material Control System (CMCS) or not accountable thru CMCS, including all controlled cryptographic items (CCI).

Block 11h – If CMCS - accountable material or information will be provided to the contractor, mark this block “YES.” If material or information NOT accountable thru the CMCS will be provided to the contractor, mark this block “NO.” Important: Marking this block “YES” means the contractor requires access to COMSEC - accountable material which can only be provided by a COMSEC account. That supporting account may be any official military or NSA COMSEC account. If a supporting COMSEC account already exists marking this block “YES” does NOT require the contractor to establish a new one.

If accountable COMSEC information or material is needed by the contractor ONLY in support of this contract and the work location is within CONUS the contractor may seek to establish an Air Force COMSEC User Account supported by the Hanscom AFB COMSEC Office (CA624505) if desired. If a Hanscom user account is established, advanced credentialing of Hanscom COMSEC office personnel is required to facilitate official visits, inspections (including no-notice inspection) and other support as may be needed. Hanscom COMSEC office inspectors, HQ AFMC COMSEC staff, and AFNIC COMSEC staff have sole inspection authority of all Hanscom COMSEC user accounts and materials provided by CA624505.

Block 15 – Hanscom COMSEC office inspectors, HQ AFMC COMSEC staff, and AFNIC COMSEC staff have sole inspection authority of all Hanscom COMSEC user accounts and materials provided by CA624505.

General Guidance Access to classified COMSEC information shall be restricted to U.S. citizens who have been granted a final security clearance by the U.S. Government, have a valid need-to-know (as defined in the National Industrial Security Program Operating Manual), and have successfully completed a non-lifestyle, counterintelligence scope polygraph examination, when required by the U.S. Government or appropriate security office, administered in accordance with DoD or agency requirements and applicable law. Non-U.S. citizens, including immigrant aliens, are not eligible for access to classified COMSEC information. For access to some types of COMSEC information a Cryptographic Access Briefing or COMSEC Briefing may be required. (NSA Contractor accounts refer to NSA/CSS PM 3-16 Para 7 and 8 for briefings required under specific types of access.) Access to unclassified controlled cryptographic items (CCI) will be limited to U.S. Citizens who have a need for such access.

If a National Security Agency (NSA) Contractor COMSEC Account is established (or already exists), NSA/CSS Policy Manual 3-16 and appropriate follow-on documents shall apply. If contractor personnel will have access to COMSEC information via an Air Force COMSEC user account, U.S.A.F. COMSEC regulations (e.g.: AFI 33-201, AFI 33-201 V2, AFI 33-201 V9, et al), Command COMSEC supplements (and appropriate follow-on documents) and guidance provided by the supporting AF COMSEC Office regarding operation of Air Force COMSEC user accounts shall apply.

All individuals with access to COMSEC information via an AF COMSEC user account who:

• Have access to cryptographic media classified SECRET or above;

• Operate Key Generating equipment (e.g.: KG-83, KoK-22, Etc);

• Prepare, authenticate, or decode nuclear control orders (actual or exercise);

• Are responsible for keying cryptographic equipment to SECRET or above; or

• Are responsible for crypto engineering or designated installation technicians;

MUST be enrolled in the AF Cryptographic Access Program PRIOR to having such access.

Audit and inspection of NSA contractor COMSEC accounts shall be in accordance with NSA/CSS PM 3-16 Section XVII. Audit and Inspection of AF COMSEC user accounts shall be in accordance with AFI 33-201V2. COMSEC and non-COMSEC inspections of AF user accounts will not be conducted concurrently.

The POC for Communications Security (COMSEC) at Hanscom Air Force Base is:

66 ABG/SCXP (COMSEC), 20 Schilling Cir, Bldg 1305, Hanscom AFB, MA 01731 Telephone (commercial) (Secure) 781-225-1349 (DSN) (Secure) 845-1349 (U) Fax: 781-225-2166 Text17: Contract Number:

Contractor Name:

Contract Period of Performance:

Text18: DD Form 254 Reference Block 10e(2) – Non-SCI CONTINUATION OF FPS3 DD 254

ATTACHMENT 2

GENERAL INTELLIGENCE MATERIAL/FOREIGN DISCLOSURE

1. Special Requirements for General and Foreign Intelligence Material. In addition to the requirements and controls for classified material, the Director, Central Intelligence, sets up additional requirements and controls for intelligence in the possession of contractors. The contractor must:

a. Maintain control of all intelligence materials released in his or her custody in accordance with DoD 5220.22-M, the National Industrial Security Program Operating Manual (NISPOM), February 2006, paragraphs 5-200, 201 and 202 for control. Contractor agrees that all intelligence material released, all reproductions and other material generated (including reproductions) are the property of the US Government.

b. Maintain control of all reproduced intelligence data in the same manner as the original.

c. Destroy intelligence materials in accordance with approved methods identified in the NISPOM.

d. Restrict access to those individuals with a valid need-to-know who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, or other government agencies and private individuals or organization is prohibited unless authorized in writing by the Contracting Officer’s Representative (COR) with prior approval of the Unit IN/SIO.

e. Not release intelligence data to foreign nationals or immigrant aliens, regardless of their security clearance or contract status, without advance written permission from the COR, Foreign Disclosure Policy Office and Unit IN/SIO.

f. Ensure that each employee having access to intelligence material is fully aware of the special security requirements for this material.

2. Returning Intelligence to the Air Force. Contractors must return intelligence data to the COR at the termination or completion of a contract unless the COR has provided written approval for the contractor to retain for an additional two years. If retention is required beyond the two year period, the contractor must again request and receive written retention authority from the COR. If the COR grants retention authority, the COR must provide a copy of the written approval to the Unit IN/SIO.

3. Release of Classified and Unclassified Intelligence Information to Foreign Government and Their Representatives. Any military activity or defense contractor receiving a request from a foreign government or a representative thereof, for intelligence data about this program, shall forward the request to the Unit IN/SIO for coordination with the cognizant foreign disclosure office. Information released under Foreign Military Sales (FMS) must comply with the specific USAF disclosure guidance issued for the specific FMS customer.

Text22: Contract Number:

Contractor Name:

Contract Period of Performance:

Text23: DD Form 254 Reference Block 11i – Have a Tempest Requirement CONTINUATION OF FPS3 DD254

ATTACHMENT 5

EMMISSIONS SECURITY REQUIREMENTS

1. The contractor shall ensure that compromising emanations (EMSEC) conditions related to this contract are minimized. The following procedures relate to classified processing conducted within the US. Within NATO countries, prime contractors and sub-contractors using contractor or NATO-controlled equipment will adhere to NATO requirements for EMSEC procedures. Contractors operating US-only equipment, whether in a NATO-controlled facility or US-controlled facility, must comply with Air Force EMSEC procedures as specified by the cognizant EMSEC Manager.

2. For contracts which require the processing of classified information in a contractor facility, the contractor shall provide countermeasure assessment data to the Contracting Officer (CO), in the form of an EMSEC Countermeasures Assessment Request (ESAR). The ESAR shall provide only specific responses to the data required in paragraphs 4.1 - 4.4, below. The contractor's standard security plan is unacceptable as a "stand-alone" ESAR response. The ESAR information will be used to complete an EMSEC Assessment and Countermeasures Review of the contractor's facility, to be performed by the government EMSEC authority using current Air Force EMSEC directives.

3. The contractor will not process classified information until an ESAR is contractually submitted, the EMSEC Assessment and Countermeasures Review have been conducted, and the system has been accredited/approved by DSS in accordance with Chapter 8 of the NISPOM.

3.1 Recognizing that contractors utilize Information Systems (IS) for multiple contracts, ESAR assessments compiled and approved for a particular system under one AFLCMC contract are considered approved under other existing, follow-on and new AFLCMC contracts for that particular contractor, as long as no changes are made to the security profile of the IS. The approval(s) should be kept on file for all affected contracts.

3.2 Any requests for interim approval to process classified information, until ESAR information can be submitted and EMSEC procedures completed, must be approved by DSS. Such interim approval should not exceed 90 days.

4. When any of the information required in paragraphs 4.1 – 4.4 below changes (such as equipment, location or classification level), the contractor shall notify the contracting officer of the changes so an EMSEC Reassessment may be accomplished. The contractor shall submit to the System Program Office (SPO) a new ESAR, specifically identifying the configuration changes. It should be submitted at least thirty (30) days before the changes are projected to occur. The provisions of Paragraph 3 apply to these changes.

4.1. SYSTEM DESCRIPTION

4.1.1 SYSTEM/FACILITY: Full name and address of company submitting request and RFP/contract number and duration. Also provide a brief title identifying the overall system or facility (e-g. XYZ Missile words processing system, ABC aircraft interactive graphics system, etc.).

4.1.2 LOCATION: Provide the following information for the facility where processing will take place.

4.1.2.1. Identify the address (including city, state, zip code, facility, building and room number) where the system or facility is located. If the address is the same as 4.1.1., only indicate the building and room number where the equipment is located.

4.1.2.2. Make, title, and attach drawings/maps showing the inspectable space, Controlled Access Areas, and floor layout of the RED and BLACK equipment. The floor layout of the equipment (RED and BLACK) should include the locations of any transmitters, receivers, and cryptographic equipment, as well as RED and BLACK IS. The drawing may be free hand. Include the scale (roughly). Indicate on the map surrounding buildings to a distance of 200 meters. Identify significant occupants, organizations, and activities in the buildings within 200 meters. If the U.S. Government or the contractor identified in 4.1.1 above does not wholly occupy the building containing the RED equipment, identify and indicate the location of those other occupants.

Text24: Contract Number:

Contractor Name:

Contract Period of Performance:

Text25: DD Form 254 Reference Block 11i – Have a TEMPEST Requirement CONTINUATION OF FPS3 DD254

4.1.2.2.2. Definition of Controlled Access Area (CAA)—The complete building or facility area under direct physical control within which unauthorized persons are denied unrestricted access and are either escorted by authorized persons or are under continuous physical or electronic surveillance.

4.2. RESPONSIBLE PERSONNEL:

4.2.1 INFORMATION SYSTEM SECURITY MANAGER (ISSM): Provide name, title, office symbol and telephone number. Include the same for the Company Appointed EMSEC (TEMPEST) Authority, if applicable.

4.2.2 SYSTEM CUSTODIAN: If different from above, provide name, title, and office symbol and telephone number.

4.3. OPERATIONAL RISK:

4.3.1 Identify the highest level of classified processing.

4.3.2 Provide an estimate of the total classified processing volume in a given measure of time. The estimate can be in hours per day, pages of classified generated per week, or megabytes or gigabytes processed per day/month. (e.g., 2 hrs/day, 15 pages/mo, or 320 mb/week), AND a percentage of total material processed for each level (e.g. 10% Top Secret; 55% Secret; 20% Confidential; 15% unclassified).

4.4 EQUIPMENT:

4.4.1 List the manufacturer and exact model number, nomenclature (terminal, disk drive, video system, etc.) and quantity of each equipment involved in classified processing. Do not provide a complete inventory of all the company's processing equipment.

4.4.2 List any encryption equipment (i.e., STE, KG-84, KG-194, etc.), that might be used for processing and transmission of classified information.

4.4.3. List any transmitters/transceivers (SATCOM, RF, UHF/VHF, WLAN, etc.) operating in the area (same room and adjacent rooms) of the equipment processing classified information, and indicate their approximate distance from the RED equipment.

5. EMSEC is applied on a case-by-case basis and further information may be required to complete the ESAR; should this be the case, the contractor shall provide this information to the contracting officer, PMO or SPO when requested.

6. Current requirements of AFI 33-214 Vol. 2 and AFI 33-203 dictate that the information used to complete the EMSEC Assessment and Countermeasures Review be validated annually. The ISSM shall certify annually to the PMO, SPO, or contracting officer that no changes to the information provided in paragraphs 4.1 through 4.4 of the ESAR have occurred.

7. The prime contractor shall ensure that this EMSEC requirement is provided to all subcontractors and/or vendors. The subcontractors and/or vendors shall comply with these EMSEC requirements when classified processing related to this contract is necessary. Subcontractors and/or vendors will provide their ESAR through the prime contractor to the government contracting officer.

8. WITH THE EXCEPTION OF 3.2 ABOVE, CLASSIFIED PROCESSING WILL NOT BE DONE UNTIL THE ABOVE PROCEDURES ARE COMPLIED WITH AND THE IS HAS BEEN ACREDITED BY THE DEFENSE SECURITY SERVICE (DSS).

9. If you have any questions feel free to contact Mr. Shawn Flaherty, Hanscom AFB EMSEC Manager.

Mailing Address: 66 ABG/SCXP SIPRNet: Shawn.Flaherty@hanscom.af.smil.mil 50 Hamilton Street Phone Number: (781) 225 - 0037 Hanscom AFB, MA 01731-1621 Fax Number: (781) 225 - 2133 E-Mail: Shawn.Flaherty.ctr@hanscom.af.mil STE Number: (781) 225 - 2144 Text26: Contract Number:

Contractor Name:

Contract Period of Performance:

Text27: DD Form 254 Reference Block 11l – Other. CONTINUATION OF FPS3 DD254

ATTACHMENT 6

AIR FORCE FAR SUPPLEMENT

PART 5352—SOLICITATION PROVISIONS AND CONTRACT CLAUSE

SUBPART 5352.2—TEXTS OF PROVISIONS AND CLAUSE

5352.204-9000 Notification of Government Security Activity and Visitor Group Security Agreements.

As prescribed in 5304.404-90, insert the following clause in solicitations and contracts:

NOTIFICATION OF GOVERNMENT SECURITY ACTIVITY (March 2012)

(a) Thirty days before the date contractor operations will begin on base, the contractor shall notify the Information Protection activity shown in the distribution block of the DD Form 254, DOD Contract Security Classification Specification, as to:

(1) The name, address, and telephone number of this contract company’s representative and designated alternate in the U.S. or overseas area, as appropriate;

(2) The contract number and military contracting command;

(3) The highest classification category of defense information to which contractor employees will have access;

(4) The Air Force installations in the U.S. (in overseas areas, identify only the APO number(s)) where the contract work will be performed;

(5) The date contractor operations will begin on base in the U.S. or in the overseas area;

(6) The estimated completion date of operations on base in the U.S. or in the overseas area; and

(7) Any changes to information previously provided under this clause.

This requirement is in addition to visit request procedures contained in DOD 5220.22-M, National Industrial Security Program Operating Manual.

(b) Prior to beginning operations involving classified information on an installation identified on the DD Form 254 where the contractor is not required to have a facility security clearance, the contractor shall enter into a security agreement (or understanding) with the installation commander to ensure that the contractor’s security procedures are properly integrated with those of the installation. As a minimum, the agreement shall identify the security actions which will be performed:

(1) By the installation for the contractor, such as providing storage and classified reproduction facilities, guard services, security forms, security inspections under DOD 5220.22-M, classified mail services, security badges, visitor control, and investigating security incidents; and

(2) Jointly by the contractor and the installation, such as packaging and addressing classified transmittals, security checks, internal security controls, and implementing emergency procedures to protect classified material.;

Text28: Contract Number:

Contractor Name:

Contract Period of Performance:

Text29: DD Form 254 Reference Block 11l CONTINUATION OF FPS3 DD254

ATTACHMENT 7

INSPECTIONS

All sub-contract Security Classification Specifications (DD Form 254) issued by prime contractors must include work performance and inspection responsibility locations. In addition, notification clauses will be included in sub-contracts. 1st Lt. Austin Whelan, USAF AFLCMC/HBU, 781-225-6737, will be added to additional distribution blocks.

A copy of all consultant agreements will include work performance locations and shall be forwarded to 1st Lt Austin Whelan, USAF AFLCMC/HBU 781-225-6737, thirty (30) days prior to access to classified material. In all cases, consultants shall have a valid PCL issued in accordance with the requirements of the NISPOM. Consultants are not eligible for access to classified information outside the United States, United States Trust Territories and possessions unless Official travel status of not more than 90 days in a 12 month period.

ii. Inspections

tractors conducting work at Hanscom AFB (HAFB), MA will participate in the Installation OPSEC Program. Contractors will receive periodic training along with military and Government counterparts.

3 Eglin Street Hanscom AFB, MA 01731-2102

(1) The National Industrial Security Program Operating Manual (NISPOM), February 2006 and its supplements apply to all classified contract performance to include all provisions of E.O. 13526 (Classified National Security Information), dated December 29, 2009, regarding classification and marking guidance.

Paragraph 3.1 of the FPS3 SOW addresses projected scope of future FPS3 delivery order security requirements

(2) Expiration Date of Contract: TBD

(3) Program Manager: Capt Justin Beltz, USAF AFLCMC/HBU, Justin.Beltz@hanscom.af.mil

(4) Administrative Contracting Office: TBD

(5) Security Manager: 1Lt Austin Whelan, USAF AFLCMC/HBU, Austin.Whelan@hanscom.af.mil

(6) 66 ABG/IP: Ms. Kellie O'Brien, USAF 66 ABG, Kellie.O'Brien@hanscom.af.mil.