LSA_OTA_Draft_RFP_Annex_C_-_Attachment_3_DD254.pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

b. LEVEL OF SAFEGUARDING REQUIRED

2. THIS SPECIFICATION IS FOR: (X and complete as applicable)

a. PRIME CONTRACT NUMBER

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable)

a. ORIGINAL (Complete date in all cases)

REVISION NO.

c. FINAL (Complete Item 5 in all cases)

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specs)

DATE (YYYYMMDD)

DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

10. CONTRACTOR WILL REQUIRE ACCESS TO: 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL:YES NO YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

d. FORMERLY RESTRICTED DATA

e. INTELLIGENCE INFORMATION

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

f. SPECIAL ACCESS INFORMATION

g. NATO INFORMATION

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

j. FOR OFFICIAL USE ONLY INFORMATION

k. OTHER (Specify)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE TEMPEST REQUIREMENTS

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

l. OTHER (Specify)

DD FORM 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE.

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release

a. TYPED NAME OF CERTIFYING OFFICIAL

Direct Through (Specify)

d. ADDRESS (Include Zip Code)

Yes No to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classifiection guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract.

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office.

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

b. TITLE c. TELEPHONE (Include Area Code)

e. SIGNATURE

17. REQUIRED DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD FORM 254 (BACK), DEC 1999

13. SECURITY GUIDANCE. (CON’T.)

Solicitation or Contract Page # 3

DD FORM 254 (13 CON’T.), MAY 2010

(8) Actual Performance

(10j) Controlled Unclassified Information / For Official Use Only (FOUO) Controlled Unclassified Information (CUI) is now the term which collectively refers to FOUO and Unclassified Controlled Nuclear Information (UCNI). Guidance for CUI identification and protection is contained in DODM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI).

(11c) Receive and Generate Classified Material The contractor shall be required to receive, generate, and store classified information up to and including SECRET. Classified information shall be handled, marked, protected, reproduced, destroyed, and transmitted in accordance with the requirements stipulated in the NISPOM and applicable Air Force Instructions/Regulations required for on-base operations. Flow-down requirements to subcontractor facilities are at the SECRET level.

(11j) Operation Security (OPSEC) The contractor shall comply with and implement the policy and processes outlined in the EELV OPSEC plan. The contractor shall protect sensitive unclassified information and activities, which could compromise classified information or operations or degrade the planning and execution of military operations performed by the contractor in support of the EELV mission. Disposition of Critical Information, FOUO, and Privacy Act (PA)/PII obtained or produced pursuant to this contract shall be shredded/degaussed to prevent reconstruction. Email transmission of Critical Information, FOUO, and PA/PII obtained or produced pursuant to this contract shall be encrypted or password protected. In addition, email containing FOUO and PA/PII shall be marked in the subject line (FOUO) or (PA). FOUO shall also be included at the beginning of the email with a non-disclosure statement.

(11l) Other Security of Unclassified DoD Information on Non-DoD Information Systems

The Contractor shall immediately (within 24 hours) notify the EELV Program Security Manager (SMC/ LEE) of any instance of a network security breach involving the unauthorized access of DoD Information.

Solicitation or Contract Page # 4

Definitions:

Non-Sensitive Information -- Information available in the public domain or DoD Information that has been approved for public release

Sensitive Information -- Information, the loss, misuse, or unauthorized access to or modification of, could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of title 5, United States Code, "The Privacy Act" but which has not been specifically authorized under criteria established by Executive order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. (Section 278g-3 of title 15, United States Code, “The Computer Security Act of 1987").

Cybersecurity requirements:

The terms Cybersecurity, Information Systems, and Information Technology, as used in this clause, are defined in Committee on National Security Systems Instruction No. 4009. Cybersecurity is explained in DODI 8500.01, Cybersecurity and is incorporated herein by reference.

Information systems (IS) shall be engineered and managed to protect and defend information and information systems from security risks, including the risks to timely authorization in accordance with current DoD policies, procedures, and statutes, to include:

The National Security Act The Clinger-Cohen Act Committee on National Security Systems Policy No. 11 National Institute on Standards and Technology Special Publications Federal Information Processing Standards DoD Instruction 8500.01, Cybersecurity

Cybersecurity requirements shall be established and maintained throughout the acquisition lifecycle in accordance with DODI 8580.1. All DoD information systems shall meet security requirements in accordance with DoDI 8500.01, and be authorized by the Authorization Official (AO) prior and during operation.

Prior to classified processing, the contractor will ensure the IS complies with the NISPOM, Chapter 8 and meets the confidentiality, integrity, authentication, non-repudiation and availability requirements as identified in the Defense Security Service (DSS) Industrial Security Field Operations (ISFO) Process Manual for Certification and Accreditation of Classified Systems under the NISPOM.

Security Incident Reporting:

In addition to the reporting requirements directed by the NISPOM, the contractor will provide a concurrent report of loss or compromise of classified information to the cognizant Government Contracting Activity (GCA) Information System Security Manager (ISSM) and Authorization Official (AO).

Solicitation or Contract Page # 5

DD FORM 254 (13 CON’T.), MAY 2010

Have Export Control Requirements

Technology Transfer and Information Control and Arms Export Control: By law, the U.S.

Government and contractors must comply with the provisions of the International Traffic in Arms Regulations (ITAR) and the Arms Control Act before exporting defense articles, technical data, or defense services controlled by the ITAR. All such information intended for public release, or disclosure to any foreign person or U.S. person residing in a foreign country shall be submitted to SMC/ENP Foreign Disclosure Office (FDO), through the appropriate Foreign Disclosure Focal Point (FDFP), for potential technology transfer and suitability for the release of technical information. Visits by a Foreign Person and/or U.S. Person acting as a Representative of a Foreign Interest to facilities shall comply with applicable visit notifications, information access and escorting requirements. The exchange of classified Foreign Government Information is not permitted by this contract, ref. 10.h. of this specification.

(14) Additional Security Requirements Personnel Security All contractor personnel performing on this contract and permanently assigned to EELV launch site must be a U.S. Person, as defined by the International Traffic In Arms Regulations, and must be in process for or possess a favorable National Agency Check Inquiry (NAC-I), an equivalent determination approval as indicated in the Air Force Space Command Supplement to Air Force Instruction (AFI) 31-101, paragraph 7.2.1.1, or higher government security clearance, in accordance with AFI 31-501: Personnel Security Program Management or the NISPOM. This is also applicable to Subcontractor and Contractor personnel who are visiting or on a temporary duty assignment at the launch site. This requirement is for personnel who have or may need access to launch site restricted or controlled areas containing EELV Space Launch Systems and/or Information Systems which directly affect a launch system.

Los Angeles Air Force Base El Segundo CA 90245

483 North Aviation Blvd El Segundo, CA 90245-2808 security: The Contractor and associated subcontractor’s shall protect Critical Program Information (CPI) and Critical Components (CC) as identified in the applicable EELV Program Protection Plan (PPP) and EELV Security Classification Guide (SCG).

The POC for collateral classified information is SMC/LEE.

Approved: ___________________________________ Approved: _______________________________ Acquisition Systems Protection Mgr Industrial Security Program Manager

installations. The Directorate retains security cognizance over this contract.