Attachment 05 LISC OMS Contract Security Classification Specification

ATTACHMENT 5: Contract Security Classification Specification (DD254)

FA8811-13-R-0001

Launch and Test Range System (LTRS)

Integrated Support Contract (LISC)

Operations, Maintenance, and Sustainment (OMS)

Attachment 5: Contract Security Classification Specification

(DD254)

20 March 2013

THIS PAGE INTENTIONALLY LEFT BLANK

ATTACHMENT 5: Contract Security Classification Specification (DD254)

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

TOP SECRET

b. LEVEL OF SAFEGUARDING REQUIRED

TOP SECRET

2. THIS SPECIFICATION IS FOR: (x and complete as applicable) 3. THIS SPECIFICATION IS: (x and complete as applicable)

a. PRIME CONTRACT NUMBER

RFP FA8811-13-R-0001

a. ORIGINAL (Complete date in all cases)

DATE (YYMMDD)

20130221

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs)

Revision No. DATE (YYMMDD)

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYMMDD)

c. FINAL (Complete Item 5 in all cases)

DATE (YYMMDD)

4. THIS IS A FOLLOW-ON CONTRACT? YES NO. If Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes, complete the following:

In response to the contractor’s request dated , retention of the identified classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

Contract Has Not Been Awarded

b. CAGE CODE

N/A

c. .COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE

Contract Has Not Been Awarded

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip code)

8. ACTUAL PERFORMANCE

a. LOCATION

1) 45SW and related ELTR sites

2) 30SW and related WLTR sites

3) Ascension Island, UK

4) Antigua Island, Antigua & Barbados

c. COGNIZANT SECURITY OFFICE(Name, Address, and Zip Code)

1) 1029 Atlas Avenue Patrick AFB, FL 32925-3402

2) 108 Colorado Street Bldg 13730, Vandenberg AFB

CA, 93437

3) No Security Office at Downrange locations

4) No Security Office at Downrange locations

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Launch and Test Range Systems (LTRS) Integrated Support Contract (LISC) – Space and Missile System Center (SMC) Spacelift Range and Network Systems (SMC/RN). The contract shall provided sustainment, integration and development activities required to ensure the fielded LTRS fulfills current and future operational missions.

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR’S

FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE TEMPEST REQUIREMENTS

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify) Refer to Block 13

k. OTHER (Specify) Reference Item 13, Attachments

F04701-01-C-0001

DD FORM 254 Front

ATTACHMENT 5: Contract Security Classification Specification (DD254)

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the iNISPOM or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release

Direct Through (Specify):

SMC/RN SMC/PA Public Affairs 483 North Aviation Blvd, LAAFB and 483 North Aviation Blvd, LAAFB El Segundo, CA 90245-2808 El Segundo, CA 90245

Release of SCI, SAP or SAR information is Not Authorized.

to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

The following document with subsequent revision or changes will be used for specific security guidance on this contract: National Industrial Security Program Operating Manual (NISPOM) (DoD 5220.22M). For security classification guidance, the NISPOM, USAFINTEL 201-1, 201-4, and 201-9, will be applied and all other Systems Program Offices Security Clearance Guides (SCG) will be provided as required. Supersession of these documents by more current guidance will be forwarded to the contractor with the same level of compliance required from the date of implementation.

While the Spacelift Range and Network Systems (SMC/RN) Program Protection Plan (PPP) may not be approved by the time of contract award, the contractor shall protect critical program information, technologies, systems (CPI) in accordance with this DD-254 as identified and supplied by the program office’s Critical Component List (CCL) (located in the “Compliance Document” tab of the LISC Bidders Library, located at https://www.liscbidderslibrary.com/).

The prime contractor shall develop a Program Protection Implementation Plan (PPIP) from the SMC/RN PPP, when available. The PPIP will need to i be approved by the Spacelift Range and Network Systems Program Office. The prime contractor will flow-down applicable CPI and/or CCL to all subcontractor with protection requirements as identified in its PPIP. Additionally, classified national security inform special access and unclassified controlled information as prescribed in applicable security classification guides will be protected as outlined in the NISPOM.

The contractor will be required to follow the DoD Information Assurance Certification and Accreditation Process (DIACAP) for security certification and accreditation (C&A). All Information systems which processes government information (classified and unclassified) for transmission over the internet must be adequately protected to comply with Air Force computer security policies in order to receive the appropriate government DAA interim and final accreditation. Contractor employees and subcontractors who have access to AF networks must submit to a National Agency Check and/or security clearance.

The subcontractor may require unescorted entry to User Agency resources where special controls have been established to protect classified information or sensitive operations. Unescorted entry to these resources may require the contractor’s employees be granted at least a SECRET security clearance. Requests for security clearances will be submitted IAW NISPOM directives.

Additional specific security requirements as identified in blocks 10 and 11 are located in attachments.

Vernal R. Bitton, GS-12, DAF Ronnie Cozier Acquisition Systems Protection Manager Industrial Security Officer SMC/RNO, Los Angeles AFB , CA SMC/ENP, Los Angeles AFB, CA

Project Officer: Lt Col Charles E. Lominac II, USAF Estimated Completion of Contract: 30 March 2023

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to NISPOM requirements, are established for this contract. (If Yes, identify the Yes No pertinent contractual clauses in the contract document itself, or provide any appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

For additional requirements see attachments.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific Yes No areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

For additional requirements see attachments.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

Vernal R. Bitton

d. TITLE

ACQUISITION SYSTEMS PROTECTION MGR

e. TELEPHONE (Include Area Code)

(310) 653-2765

f. ADDRESS (Include Zip Code)

HQ SMC/RNK

483 North Aviation Blvd, LAAFB El Segundo, CA 90245-2808

17. REQUIRED DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINSTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY: SMC/RN, SMC/RNL, SMC/RNO, SMC/ENP

e. SIGNATURE

DD Form 254 Reverse

ATTACHMENT 5: Contract Security Classification Specification (DD254)

Reference Block 8a: Actual Performance Locations

GOVERNMENT SITES – Eastern Range COGNIZANT SECURITY OFFICE Cape Canaveral AFS – Multiple sites: 45 SFS/SFRC Morrell Operations Center (MOC) Central Command Remoting System (CCRS) Central Command Management System (CCMS) AN/FPS-16 radar Cape 1A and 1B Command Sites Weather Assets Cinetheodolite optical telescopes (4) Advanced Transportable Optical Tracking System (ATOTS) Skid Strip flightline

Patrick AFB – Multiple Sites:

Florida Annexes Jonathan Dickinson Missile Tracking Annex Malabar Tracking Annex Missile Instrumentation Station - PAFB Intermediate Microwave Relay Sites – Multiple sites:

Wabasso, Ft. Pierce, and Stuart, Florida

Weather Sensor Sites – Multiple sites:

Brevard, Orange, Osceola, Seminole, & Volusia counties, Florida

Antigua Air Station Ascension Auxiliary Air Field Kennedy Space Center Transportable Vehicle Checkout Facility (TVCF)

GOVERNMENT SITES – Western Range 30 SFS/SFAD

Vandenberg Air Force Base, CA – Multiple sites:

North Vandenberg AFB (NVAFB) – Multiple sites:

Building 7000 Complex Western Range Control Center (WRCC), building 7000 Western Range Operations Control Center (WROCC), building 7025 Instrumentation control facility, building 7011 Data Center 80 (DC-80), building 7050 Telemetry Analog Equipment Room (TAER) Telemetry Integrated Processing System (TIPS) Quick Look Display Area (QLDA) Range Safety Telemetry System (RSTS) Frequency Control and Analysis Center (FCAC) Radio Frequency Measurements Center (RFMC) Western Range Network Segment Center (WRNSC) High Accuracy Instrumentation Radar (HAIR) Ocean Surveillance System (OSS) radar (2) High Frequency Radio Receivers (HFRX) Command Transmitter #1 (CT-1) Mobile Telemetry Receiving Station (MTRS) 2 Automated Meteorological Profiling System (AMPS) Base Weather Station (BWS)

South Vandenberg AFB (SVAFB) Pillar Point AFS Santa Ynez Peak NAWC Point Mugu, CA Other WR Remote Locations Communications connections – Multiple sites:

ATTACHMENT 5: Contract Security Classification Specification (DD254)

Rainbow Ridge, Mill Valley Los Angeles Center San Clemente Island. These sites house communication link UHF radios and modems. The WR also utilizes the OSS radars located at San Luis Light Station (16 miles north of VAFB) and Point Conception (located 10 miles south of VAFB).Eastern Vehicle

Reference Block 10a: Communications Security (COMSEC) Information

Contractor shall comply with the requirement of DoD 5200.22-M, National Industrial Security Program Operating Manual (NISPOM), AFI 33-201, Volume 1, Communication Security (COMSEC) and CNSS No. 12, National Information Assurance Policy for U.S.

Space Systems used to support nation security missions. Access to COMSEC material or information is restricted to U.S. personnel holding final U.S. Government clearances and is not releasable to personnel holding only a reciprocal clearance. All contractor employees who require access to classified COMSEC information in the performance of their contractual duties shall be briefed prior to being granted access. The Program Manager shall designate the number of personnel requiring cryptographic access. The number will be limited to the minimum necessary and will be on a strict need-to-know basis. The contractor shall maintain a record of all COMSEC briefings.

NACSIM/NACSEM documents are not considered COMSEC controlled material.

Prior approval from the GCA is required in order for a Prime Contractor to grant COMSEC access to a subcontractor. The Prime Contractor should also notify the National Security Agency (NSA) Central Office of Record (COR) before negotiating or awarding subcontracts.

Reference Block 10e: Intelligence Information

(2): Non-SCI

The contractor shall handle non-SCI or “collateral” intelligence information IAW Chapter 9, Section 3 of DoD 5220.22-M, the National Industrial Security Program Operating Manual, (NISPOM). Particular emphasis is placed on the contractor(s) correctly understanding and heeding intelligence portion markings. As classified material, the contractor shall afford collateral intelligence information the same protections, safeguards, and precautions required by any classified material required by DoDM 5200.01 Vol1 – Vol 4, Information Security Program and AFI 31-401, Information Security Program Management, unless special intelligence related handling instructions are specifically imposed, usually in the TO&P. The contractor shall neither disclose nor release intelligence derived information, whether its status is collateral or SCI, without the prior consent of SMC/IN.

Reference Block 10h: Foreign Government Information

The contractor is permitted access to foreign government information (FGI). The government contracting officer will validate contractor requests for FGI on a case-by-case basis. Information supplied by or provided to a foreign government(s) shall be handled in accordance with chapter 10 section 3 of the NISPOM (DoD 5220.22-M and DoDM 5200.01 Vol1 – Vol 4).

All releases to foreign governments will go through the Satellite Control and Network Systems Program Office, who will forward the request to the SMP/ENP Foreign Disclosure Officer (FDO) for review and approval.

Reference Block 10j: For Official Use Only (FOUO) information will be handled as follows:

1. Description: “For Official Use Only (FOUO)” is a designation that is applied to unclassified information that may be exempt from mandatory release to the public under the Freedom of Information Act (FOIA). The FOIA specifies nine exemptions that may qualify certain information to be withheld from release to the public, if, by its disclosure, a foreseeable harm would occur. They are:

a. Information that is currently and properly classified.

b. Information that pertains solely to the internal rules and practices of the Agency. (This exemption has two profiles, "high" and "low." The "high" profile permits withholding of a document that, if released, would allow circumvention of an Agency rule, policy, or statute, thereby impeding the agency in the conduct of its mission. The "low" profile permits withholding if there is no public interest in the document, and it would be an administrative burden to process the request.)

c. Information specifically exempted by a statute establishing particular criteria for withholding. The language of the statute must clearly state that the information will not be disclosed.

ATTACHMENT 5: Contract Security Classification Specification (DD254)

d. Information such as trade secrets and commercial or financial information obtained from a company on a privileged or confidential basis that, if released, would result in competitive harm to the company, impair the Government's ability to obtain like information in the future, or protect the Government's interest in compliance with program effectiveness.

e. Inter-Agency memoranda that are deliberative in nature; this exemption is appropriate for internal documents that are part of the decision making process and contain subjective evaluations, opinions and recommendations.

f. Information, the release of which could reasonably be expected to constitute a clearly unwarranted invasion of the personal privacy of individuals.

g. Records or information compiled for law enforcement purposes that:

(1) Could reasonably be expected to interfere with law enforcement proceedings;

(2) Would deprive a person of a right to a fair trial or impartial adjudication;

(3) Could reasonably be expected to constitute an unwarranted invasion of the personal privacy of others;

(4) Disclose the identity of a confidential source;

(5) Disclose investigative techniques and procedures; or

(6) Could reasonably be expected to endanger the life or physical safety of any individual.

h. Certain records of agencies responsible for supervision of financial institutions.

i. Geological and geophysical information concerning wells.

2. General:

a. Information that is currently and properly classified shall be withheld from mandatory release under the first exemption of the Freedom of Information Act FOIA. “FOR OFFICIAL USE ONLY” (FOUO) is applied to information that may be exempt under one or more of the other eight exemptions. So, by definition, information shall be unclassified in order to be designated FOUO. If an item of classified information is declassified, it may be designated FOUO if it qualifies under one of the other exemptions of the FOIA. This means that:

(1) Information cannot be classified and FOUO at the same time. Therefore, classified documents containing FOUO information cannot bear an overall document marking of FOUO. However, portions or pages of a classified document, that contain only FOUO information will be marked as FOUO.

(2) Information that is declassified may be designated FOUO, only if it is believed to fit into one or more of the last eight exemptions (exemptions 2 through 9).

b. The FOIA provides that, for information to be exempt from mandatory release it must fit into one of the qualifying categories and there must be a legitimate Government purpose served by withholding it. Simply because information is marked FOUO does not mean it automatically qualifies for exemption. If a request for a record is received, the information must be reviewed to see if it meets this dual test. On the other hand, the absence of the FOUO marking does not automatically meant the information must be released. Some types of records (for example, personnel records) are not normally marked FOUO, but may still qualify for withholding under FOIA.

3. Marking:

a. Marking information FOUO does not automatically qualify it for exemption. If a request for a record is received, the information shall be reviewed to determine if it actually qualifies for exemption. Similarly, the absence of the FOUO marking does not automatically mean the information shall be released. Some types of records (for example, personnel records) are not normally marked FOUO, but may still be withheld under the FOIA. All DoD unclassified information must be reviewed before it is released to the public or to foreign governments and international organizations.

b. Information that has been determined to qualify for FOUO status should be indicated by markings when included in documents and similar material. Markings should be applied at the time documents are drafted, whenever possible, to promote proper protection of the information.

(1) Unclassified documents and material containing FOUO information shall be marked as follows:

(a) Documents will be marked "FOR OFFICIAL USE ONLY" at the bottom of the front cover (if there is one), the title page (if there is one), the first page, and the outside of the back cover (if there is one).

(b) Pages of the document that contain FOUO information shall be marked "FOR OFFICIAL USE ONLY" at the bottom.

(c) Portion Marking FOUO Information. Subjects, titles and each section, part, paragraph, and similar portion of an FOUO document shall be marked to show that they contain information requiring protection. Use the parenthetical notation “(FOUO)” to identify information as For Official Use Only for this purpose. Place this notation immediately before the text.

(d). Material other than paper documents (for example, slides, computer media, films, etc.) shall bear markings that alert the holder or viewer that the material contains FOUO information.

ATTACHMENT 5: Contract Security Classification Specification (DD254)

(e) FOUO documents and material transmitted outside the Department of Defense must bear an expanded marking on the face of the document so that non-DoD holders understand the status of the information. A statement similar to this one should be used:

"This document contains information exempt from mandatory disclosure under the F0IA. Exemption(s) ______ apply."

(2) Classified documents and material containing FOUO information shall be marked as required by Chapter 4 of the NISPOM (or DoDM 5200.01 Vol1 – Vol 4, as applicable), with FOUO information identified as follows:

(a) Overall markings on the document shall follow the rules in NSPOM Chapter 4 (or DoDM 5200.01 Vol 4). No special markings are required on the face of the document because it contains FOUO information.

(b) Portions of the document shall be marked with their classification as required by NISPOM Chapter 4 (or DoDM 5200.01 Vol 4). If there are unclassified portions that contain FOUO information, they shall be marked with "FOUO" in parentheses at the beginning of the portion. Since FOUO information is, by definition, unclassified, the "FOUO" is an acceptable substitute for the normal "U."

(c) Pages of the document that contain classified information shall be marked as required by NISPOM Chapter 4 (or DoDM 5200.01 Vol 4). Pages that contain FOUO information but no classified information will be marked "FOR OFFICIAL USE ONLY" at the top and bottom.

(3) Transmittal documents that have no classified material attached, but do have FOUO attachments shall be marked with a statement similar to this one:

"FOR OFFICIAL USE ONLY ATTACHMENT."

(4) Each part of electrically transmitted messages containing FOUO information shall be marked appropriately.

Unclassified messages containing FOUO information shall contain the abbreviation "FOUO" before the beginning of the text.

4. Access to FOUO Information.

a. No person may have access to information designated as FOUO unless that person has been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose.

b. The final responsibility for determining whether an individual has a valid need for access to information designated as FOUO rests with the individual who has authorized possession, knowledge or control of the information and not on the prospective recipient.

c. Information designated as FOUO may be disseminated within the DoD Components and between officials of DoD Components and DoD contractors, consultants, and grantees to conduct official business for the Department of Defense, provided that dissemination is not further controlled by a Distribution Statement.

d. DoD holders of information designated as FOUO are authorized to convey such information to officials in other Departments and Agencies of the Executive and Judicial Branches to fulfill a government function. If the information is covered by the Privacy Act, disclosure is only authorized if the requirements of DoD 5400.11-R are satisfied.

e. Release of FOUO information to Congress is governed by DoD Directive 5400.4. If the information is covered by the Privacy Act, disclosure is authorized if the requirements of DoD 5400.11-R are also satisfied.

f. DoD Directive 7650.1 governs release of FOUO information to the General Accounting Office (GAO). If the information is covered by the Privacy Act, disclosure is authorized if the requirements of DoD 5400.11-R are also satisfied.

5. Protection of FOUO Information

a. During working hours, reasonable steps shall be taken to minimize risk of access by unauthorized personnel. After working hours, store FOUO information in unlocked containers, desks or cabinets if Government or Government-contract building security is provided. If such building security is not provided, store the information in locked desks, file cabinets, bookcases, locked rooms, etc.

b. FOUO information and material may be transmitted via first class mail, parcel post or, for bulk shipments, via fourth class mail. Electronic transmission of FOUO information, e.g., voice, data or facsimile, e-mail, shall be by approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure (PKI), whenever practical.

c. FOUO information may only be posted to DoD Web sites consistent with security and access requirements specified in Deputy Secretary of Defense Memorandum dated December 1998, Subject: “Web Site Administration”.

d. Record copies of FOUO documents shall be disposed of according to the Federal Records Act and the DoD Component records management directives. Non-record FOUO documents may be destroyed by any of the means approved for the destruction of classified information, or by any other means that would make it difficult to recognize or reconstruct the information.

6. Unauthorized Disclosure. The unauthorized disclosure of FOUO does not constitute an unauthorized disclosure of DoD information classified for security purposes. However, appropriate administrative action shall be taken to fix responsibility for unauthorized disclosure of FOUO whenever feasible, and appropriate disciplinary action shall be taken against those responsible.

ATTACHMENT 5: Contract Security Classification Specification (DD254)

Unauthorized disclosure of FOUO information that is protected by the Privacy Act may also result in civil and criminal sanctions against responsible persons. The Military Department or other DoD Component that originated the FOUO information shall be informed of its unauthorized disclosure.

Reference Block 10k: SIPRNet Access Required:

SIPRNet use is authorized when correspondence is required for the transmission of classified material. SIPRNet access and use will be in compliance with local host governing directives but at a minimum will meet the standards as established in AFMAN 33- 152, User Responsibilities and Guidance for Information Systems, 01 June 2012, and AFSSI 8520, Identification and Authentication, 18 June 2009. Chapters 2 and 5 respectively are particularly germane.

Reference Block 11c: Receive and Generate Classified Material

Classified material will be handled in accordance with guidance in the NISPOM and E.O. 13526.

Reference Block 11d: Fabricate, Modify, or Store Classified Hardware

The Contractor is required to provide adequate storage for classified hardware up to and including the level of SECRET. When such a size and/or quantity cannot be safeguarded in an approved storage container, a permanent structure in accordance with Chapter 5, Section 3 of the NISPOM applies.

Reference Block 11f: Access To Classified Information Outside The U.S., Puerto Rico, U.S.

Possessions and Trust Territories

Contractor requires access to U.S. Classified Information outside the U.S. Possession and Trust Territories.

The User Agency (Spacelift Range and Network Systems) will furnish complete classification guidance for the service to be performed. The highest level of classification for the contract is SECRET.

All other foreign disclosure is covered by AFI 16-201, and Delegated Disclosures Letters provided by SMP/ENP. A training program must be developed to insure personnel are aware of foreign disclosure guidelines.

Reference Block 11g: Be Authorized To Use The Services of Defense Technical Information Center (DTIC) Or Other Secondary Distribution Center

The contractor may access information provided by DTIC by complying with all established safeguards and following the registration procedures as set forth in Chapter 11 Section 2 of the NISPOM (DoD 5220.22M).

Reference Block 11h: Require A COMSEC Account

The Contractor will be required to establish and maintain a COMSEC user account following the procedures and requirements contained in AFI 33-201, Vol 2, Communication Security (COMSEC) User Requirement and installation COMSEC account procedures.

Reference Block 11i: TEMPEST Requirements

TEMPEST security measures must be considered if electronic processing of classified is involved. The Contractor shall comply with EMSEC requirements before processing classified data in accordance with AFI 33-200, Information Assurance Management, and AFSSI 7700, Emission Security. Document the IA countermeasures and the EMSEC assessments on AF Form 4170, Emission Security Assessments/Emission Security Countermeasures Review, according to AFSSI 7702.

EMISSIONS SECURITY ASSESSMENT REQUEST (ESAR) FOR ALL CLASSIFIED SYSTEMS

1. The Contractor shall ensure that emission security (EMSEC) conditions related to this contract are minimized.

ATTACHMENT 5: Contract Security Classification Specification (DD254)

2. The Contractor shall provide countermeasure assessment data to the Contracting Officer as an ESAR. The ESAR shall provide only specific responses to the data required in paragraph 3 below. The Contractor's standard security plan is unacceptable as a "standalone" ESAR response. The contractor shall NOT submit a detailed facility analysis or assessment. The ESAR information will be used to complete an EMSEC Countermeasures Assessment Review of the Contractor's facility to be performed by the government EMSEC authority using current Air Force EMSEC directives.

3. When any of the information required in subparagraphs below changes (such as location or classification level), the contractor shall notify the contracting officer of the changes, so a new EMSEC Countermeasures Assessment Review is accomplished. The Contractor shall submit to the Program Management Office a new ESAR. The new ESAR will identify the new configuration, a minimum of 30 days before beginning the change(s). The Contractor shall not commence classified processing in the new configuration until receiving approval to do so from the contracting officer.

a. SYSTEM DESCRIPTION:

(1) SYSTEM/FACILITY: Provide full name and address of company submitting request, RFP/contract number, and duration. Also, provide a brief title identifying the overall system or facility (e.g., XYZ Missile word processing system, ABC aircraft interactive graphics system, etc.).

(2) LOCATION: Identify the system or facility's location and address (including city, state, zip code, facility, building, and room number). Further, identify any other contractor, company, or agency located within 200 meters of the facility (building, room, or office where classified processing is taking place). Also, identify the Inspect able Space (IS), see below.

(3) Additional information may be needed for TOP SECRET or SECRET level with Special Access Required (SAR), Special Category (SPECAT) information or other non-collateral caveats processing and accessed to classified information out-side the continental United States (OCONUS) (Block 11c and 11f checked): Identify the Controlled Access Area (CAA), see below:

The three-dimensional space surrounding equipment that processes classified or sensitive information within which EMSEC is not considered practical or where legal authority to identify or remove a potential EMSEC exploitation exists. The complete building or facility area under direct physical control that can include one or more limited exclusion areas, controlled BLACK equipment areas, or in any combination.

b. RESPONSIBLE PERSONNEL:

(1) SECURITY OFFICER/MANAGER: Provide name, title, office symbol, and telephone number. Include the same for the company appointed EMSEC authority, if applicable.

(2) SYSTEM CUSTODIAN: If different from above, provide name, title, office symbol, and telephone number.

c. OPERATIONAL RISK:

(1) This risk is identified by the highest level of classified processing.

(2) Additional information may be needed for TOP SECRET or SECRET level with SAR, SPECAT information or other non-collateral caveats processing and access to classified information OCONUS (Block 11c and 11f checked). Further, identify classified processing levels by estimated hours per day/month for each level and a percentage of total material processed (e.g., 10% Top Secret, 55% Secret, etc.) for each level.

d. EQUIPMENT:

(1) List the manufacturer and exact model number, nomenclature (terminal, disk drive, video system, etc.), and quantity of each equipment involved in classified processing. Do not provide a complete inventory of all the company's processing equipment.

(2) List any encryption equipment (i.e., STU-II, KG-84, KG-194, etc.) that might be used for processing and transmission of classified information.

4. Add the following statement, as appropriate, for all classified contracts or RFPs:

a. Submit EASR to the Unit Security Manager (USM) for processing by the 61 CS EMSEC Managers for Information Systems.

b. Submit EASR to the Unit Security Manager (USM) for processing by the 61 CS EMSEC Managers for Space Mission

Systems.

5. Use of UHF/HF radios, cellular telephones, pagers, or other types of resting frequency transmitters is not allowed in a classified processing facility or areas unless approved by the EMSEC Manager.

ATTACHMENT 5: Contract Security Classification Specification (DD254)

Reference Block 11j: OPSEC Requirements

Contractor will comply with all Program Protection Plans/Security Classification/ Declassification Guide specified in the applicable Delivery Order Statement of Work and/or this DD Form 254. The contractor will accomplish the following minimum requirements in support of the User Agency Operations Security (OPSEC) Program and protect OPSEC Critical Information. Items of Critical Information are those facts which individually or in the aggregate reveal sensitive details about SMC programs and contractor operations, and thus require protection from adversarial collection or exploitation.

Protect Critical Information and activities which could compromise classified information or operations, or degrade the planning and execution of military operations performed by the contractor in support of the mission. Such information may be marked FOR OFFICIAL USE ONLY, Privacy Act of 1974, COMPANY PROPRIETARY, Export Controlled, or otherwise designated as sensitive by the SMC/RN Program Office or SMP/ENP (OPSEC Manager).

Review items on the critical information list (CIL) as contained within the SMC OPSEC Plan and determine applicable to contractor operations. Include OPSEC as a part of the contracts ongoing security awareness program conducted in accordance with Chapter 3, Section 1, of the NISPOM or Chapter 3 of AFI 10-701, as applicable. Be responsive to the SMC/RN and SMC OPSEC Program Managers on a non-interference basis.

Reference Block 11k: Authorized Use of the Defense Courier Service

Use of Defense Courier Service for the required COMSEC account is authorized. The Facility Security Officer (FSO) will prepare and submit DCS Form 10 in original triplicate to the program Security Manager for validation prior to their submittal to the appropriate DCS station.

Reference Block 11l: Other:

The contractor shall comply with the general security provisions of the following documents, including changes or revisions:

1. DoD 5400.7-R/AF Sup, 24 June 2002, DoD Freedom Of Information Act Program

2. DoD 5220.22-M, Revision 1, 1 April 2004, Department of Defense Overprint to the National Industrial Security Program Operating Manual Supplement

3. DoD 5220.22-M, Feb 2006, National Industrial Security Program Operating Manual (NISPOM) and subsequent changes or revisions

4. DoD 5105.21-M-1, 3 Aug 98, Sensitive Compartmented Information Administrative Security Manual

5. DoDD 5200.39, 10 Sept 97, Security, Intelligence, and Counterintelligence Support to Acquisition Program Protection.

6. AFI 14-302, 18 Jan 94, Control, Protection, and Dissemination of Sensitive Compartmented Information.

7. AFI 14-303, 1 Apr 99, Release of Intelligence to U.S. Contractors.

8. SMC OPSEC Plan July 2004.

Reference Block 14: Additional Security Requirements

1. Access to Intelligence Information. The contractor will require access to other (collateral) classified intelligence information. The following requirements apply:

a. The Contractor is authorized access to classified intelligence information. The most restrictive control marking on the intelligence will ordinarily be: with the approval of the Air Force Assistant Chief of Staff, Intelligence (ACS/I), may include intelligence marked: "DISSEMINATION AND EXTRACTION OF INFORMATION CONTROLLED BY ORIGINATOR (ORCON), AND CAUTION PROPRIETARY INFORMATION INVOLVED (PROPIN).

b. The Contractor will comply with the special handling and dissemination requirements specified in the NISPOM and the Director of Central Intelligence Directive (DCID)1/7.

ATTACHMENT 5: Contract Security Classification Specification (DD254)

c. The Contractor is hereby granted permission to reproduce, extract, and distribute (limited to specified Air Force agencies and approved contractor), and destroy or retain the intelligence as required in support of this contract.

d. Intelligence material that, in the judgment of the Space and Missile System Center Senior Intelligence Officer, should not be handled in this manner and will be so identified in writing at the time of release of the material to the Contractor and procedures for handling and dissemination of that intelligence shall be addressed on an ad hoc basis.

2. Contractor employees and subcontractors who have access to Air Force networks must submit to a National Agency Check and/or have a security clearance. Contractor personnel providing direct support to an Air Force installation will abide by the provisions set forth in the Visitor Group Security Agreement (VGSA) and cooperate under the local security authority’s oversight.

Reference Block 15: Inspections

The Defense Security Service (DSS) is relieved of Industrial Security oversight and inspection responsibilities on government installations. Contractor personnel providing direct support to SMC/RN who are permanently assigned to an Air Force Installation will abide by the provisions set forth in the Visitor Group Security Agreement (VGSA) and cooperate under the local security authority’s oversight. Additionally, DSS is relieved of security inspection responsibility for all SAR, SCI material, and information released to the contractor under this contract. SMC/IN SSO hold cognizance over all SCI Inspection Activities.