Final LIDAS W31P4Q-24-R-0024 DD 254 Signed.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, "DoD Contract Security Classification Specification" Hide Attachment Bar

5750 E MC Kellips Rd, Bldg 100 Mesa, AZ 85215-2740

10851 N. Black Canyon Hwy, STE 860 Phoenix, AZ 85059-4755 Enter cognizant security office(s) (Name, Address, ZIP Code, Telephone required; Email Address optional).: Defense CounterIntelligence & Security Agency (DCSA) 10851 N. Black Canyon Hwy, STE 860 Phoenix, AZ 85059-4755

5750 E MC Kellips Rd, Bldg 100 Mesa, AZ 85215-2740 Enter location(s).: CCDC Aviation and Missile Command – S3I 6263 Hackberry Rd.

Redstone Arsenal, Alabama 35898 Enter location(s).: Material Test Directorate Security White Sands Missile Range

NM, 88002

Enter location(s).: Strategic & Operational Rockets & Missiles 112 Hankins Drive Redstone Arsenal, AL 35898 Enter general unclassified description of this procurement.: The LIDAS engineering services support shall include the following contractor tasks: investigations, inspections, and analyses to improve the maintainability, training, reliability, quality, operations, or logistics support of the fielded LIDAS; technical support at live firings and during tests in which the LIDAS is used both in Continental United States (CONUS) and Outside Continental United States (OCONUS) locations; improvement and modification of the LIDAS in response to changes in the MLRS Launcher or munitions supported by the launcher; interoperability support for Foreign Military Sales (FMS)/co-production countries; and other support needed to meet the instrumentation requirements of the STORM Project Office including: M270Al Launcher, M270A2 Launcher, High Mobility Artillery Rocket System (HIMARS), Extended Range MLRS (ER-MLRS), Guided MLRS (GMLRS), Army Tactical Missile System and Common Fire Control System.

Controlled by: STORM PO Categories: Procurement and Acquisition Dissemination: FEDCON POC: Shannon Kelsoe, 256-842-7177

*The STORM Technical POC is Mr. Jose Barreto, SFAE-MSL-STV, jose.a.barreto.civ@mail.mil, 256-842-2742.

*The STORM COR is Ms. Macy Gibbs, SFAE-MSL-STB, macy.l.gibbs.civ@mail.mil, 256-313-1157.

*All classified visits will be coordinated through the Project Office Technical POC in sufficient time for certification of Need-To-Know prior to the visit.

*Contractor shall comply with Federal Acquisition Regulation (FAR) 52.204‐2, Security Requirements. Access to information classified “Confidential” or “Secret” requires contractors to comply with – (1) Department of Defense Security Agreement (DD Form 441), including the NISPOM (32 CFR Part 117); (2) any revisions to 32 CFR Part 117, NISPOM;, notice of which has been furnished to the contractor.

Item 10.a. and 11.h. Communications Security (COMSEC). NSA/CSS Policy Manual 3-16 Control of Communications Security (COMSEC) Material, 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM) and AR 380-40 Safeguarding and Controlling Communications Security Material, apply to this contract.

GCA approval is required prior to granting COMSEC access to a subcontractor.

10g. NATO Information. Contractors/Subcontractors must comply with the following guidance for access to NATO material:

-32 CFR Part 117, NISPOM; Chapter 10, Section 7 -Memorandum, Secretary of Defense, OSD, Apr 5, 2007, subject: U.S.

Implementation Instruction for Protecting NATO Classified Information

10h. Foreign Government Information. Classified Foreign Government Information (FGI) is not releasable to contractor employees who have not received a clearance at the appropriate security level.

Written concurrence of the KO is required prior to subcontracting.

Item 10.j. CONTROLLED UNCLASSIFIED INFORMATION (CUI). Contractor shall comply with the requirements of DoDI 5200.48, Controlled Unclassified Information. . Apply FOUO to legacy information only. For current or future information, apply CUI guidance.

a. Controlled Unclassified Information shall follow the guidance outlined in DODI 5200.48, the NIST SP 800-171 identifies the baseline CUI system security requirements for industry established by Part 2002 of Title 32, CFR. Additionally, Section 252.204-7012 of the DFARS specifies a waiver process for defense contractors in accordance with NIST SP 800-171 for contractor IT or networks.

b. CUI with the potential to impact national security (e.g., information related to critical programs and technology information) may require enhanced protection. These enhanced measures would address both physical and logical procedures. Enhanced protection methods for systems hosting CUI include:

(1) Access control (e.g., restricting both physical and logical access to the systems).

(2) Audit and accountability (e.g., review and monitor system usage).

(3) Configuration management (e.g., restrict system connection to only approved resources).

(4) Identification and authentication (e.g., control issuance of end-user certificates).

(5) Incident response (e.g., ensure corrective measures are implemented in a timely manner and validate effectiveness).

(6) System and communication protection (e.g., application of encryption for data at rest and restriction of connections to uncertified, unsecured, non-organizational systems). DoD Components may implement stricter CUI encryption requirements based on a law, regulation, or government-wide policy (DHA PI 8140, requires workforce encrypt emailed PHI).

(7) System and information integrity (e.g., provide network detection tools throughout the system to identify attempted intrusions).

c. Non-DoD IS processing, storing, or transmitting CUI will be safeguarded in accordance with contractual requirements identified for the particular CUI contained in the contract, DoDI 8582.01 and Section 252.204-7012 of the DFARS or their subsequent revisions.

d. When established by contract, contractors, sub-contractors, and consultants must comply with safeguarding requirements identified in the contract for all types of CUI.

e. contractors shall monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

Item 10.k. Other. Classified information processing at contractor facilities will be conducted in accordance withwith NISPOM 32 CFR Part 117.18.

Contractors requiring access to government Information Systems at government or contractor facilities will comply with AR 25-2 guidance.

Contractor access to SIPRNET via government accounts is restricted to only sites directly related to meeting the requirements of this contract as validated by the COR and/or the Statement of Work (SOW). The contractor will not access INTELLINK-S while on the SIPRNET without formal access authorization of the COR and AMSAM-ISI. SIPRNET access via government accounts may not be subcontracted without prior written authorization of the Contracting Officer, COR and AMSAM-IS in accordance 32 CFR Part 117, , National Industrial Security Program Operating Manual (NISPOM), Paragraph 9-304.

The contractor shall not release to anyone outside the contractor's organization any unclassified information, regardless of medium (e.g.film, tape, document), pertaining to any part of this contract or any program related to the contract, unless-

*Approval for Release of Information has been obtained through the official PEO Missiles and Space Public Release Process, and Contracting Officer has given prior written approval; or *The information is provided to an approved subcontractor pursuant of assigned contractual requirements.; or

*The information has previously been approved for public release through the official PEO Missiles and Space Public Release Process.

Requests for approval shall identify the specific information to be released, the medium to be used, and the purpose of the release. The contractor shall submit its request to the Contracting Officer at least 45 days before the proposed date for release.

Item 11.c. The following Security Classification Guides (SCG) apply to this contract when receiving or generating classified information:

*Strategic and Operational Rockets & Missiles (STORM) Field Artillery Launchers (FAL) SCG, dated 15 Feb 2022 *MLRS Family of Munitions (MFOM) SCG, dated 21 July 2021 *Fires Cells Systems SCG (AFATDS, JADOCS, and FEDS), dated 18 Aug 2022;

*Global Positioning System (GPS) Annex J SCG, dated 20 September 2020 *Chemical, Biological Radiological, and Nuclear Survivability SCG, dated 17 February 2017;

*Fuze, Next Generation Proximity Sensors (NGPS), dated 30 November 2012;

*Administrative Change to SCG Fuze, Next Generation Proximity Sensors (NGPS), dated 22 April 2014; and *Anti-Tamper (AT) Security Classification Guide, dated 30 July 2020.

*E-2C-D Hawkeye SCG, dated 4 September 2008 *JAGM SCG, dated 1 September 2015

Any classified information generated in the performance of this contract shall be classified according to the marking shown on the source material. Security classification guidance and/ or security procedures will be provided under separate cover.

Item 11.d. Fabricate, Modify, or Store Classified Hardware. During the performance of this contract it may be necessary for your company to store classified material. Due to the nature, size, or unique characteristics, it may not fit in an approved security container.

Your company may have to establish approved restricted or closed area(s) IAW the latest publication of 32 CFR Part 117, National Security Program Operating Manual (NISPOM). The point at which proposed hardware becomes classified shall be provided by the contract monitor.

Item 11.i. Per AR 380-27, Paragraph 2-6, A TEMPEST Countermeasures Review (TCR) will be conducted by an Army Certified TEMPEST Technical Authority (CTTA). TCR will be requested by the GCA via secure e-mail address 902d310thTEMPEST@mi.army.smil.mil) upon award of the contract. The TCR will be conducted at the contractor’s facility where classified information or material is to be received, generated or stored electronically. Results of the TCR will be provided to the contractor who will ensure that all applicable AR 380-27requirements are implemented. Prime contractors cannot impose TEMPEST countermeasures upon subcontractors without GCA or CSA approval.

IItem 11.j. Contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, for the responsible Government OPSEC officer to review and approve. This plan shall include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1. GCA approval is required prior to imposing OPSEC requirements on a subcontractor.

12.continued. Public Release of non-SCI information is prohibited.

A Program Protection Plan (PPP) and supporting annexes will be provided as GFI, per DoDI 5200.39. The contractor will follow guidance in the PPP and annexes to ensure protection of identified CPI. Requests for clarification will be made to the STORM SM not later than 30 days from receipt of the PPP, its annexes or updates. Any modifications or deviation to the PPP will be made in writing by the Program Manager. The contractor will, as requested by the government, provide input to the updates of the PPP and associated annexes to include participation in the CPI identification.

Anti-Terrorism (AT) Level 1 Training. All contractor employees and associated sub-contractor employees requiring access to Army installations, facilities, and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the Contracting

Officer’s Representative (COR) or to the Contracting Officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT Level I, awareness training is available at the following website: http://jko.jten.mil.

AT Awareness Training for Contractor Personnel Traveling Overseas. The contractor employees and associated sub-contractor employees shall make available and shall receive government provided Area of Responsibility (AOR) specific AT awareness training as directed by AR 525-13. The combatant commander, with the unit Anti-Terrorism Officer (ATO) being the local point of contact, directs the specific AOR training content.

iWATCH Training. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). The contractor and all associated subcontractors shall use this local developed training to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. The contractor and all associated sub-contractors shall complete this training within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 45 calendar days after contract award. The iWATCH training is available at the following link: https://www.mepcom.army.mil/Home/Contractors/

Access and General Protection/Security Policy and Procedures. The contractor employees and all associated sub-contractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor employees and all sub-contractor employees shall comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

Contractors Requiring a Common Access Card (CAC). The contractor employees and all associated sub-contractor employees shall comply with adjudication standards and procedures in accordance with Army Directive 2014-05 that requires employees to have, at a minimum, a favorably adjudicated National Agency Check with Inquires (NACI) or an equivalent or higher investigation. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

Contractors not Eligible for a CAC, but Requires Access to a DoD Facility or Installation. The contractor and all associated sub-contractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

Handling or Having Access to Classified Information. The contractor and all associated sub-contractors shall comply with FAR 52.204-2, Security Requirements. Contractors having access to information classified “Confidential,” “Secret,” or “Top Secret” shall comply with - (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 32 CFR Part 117); (2) any revisions to DoD 32 CFR Part 117, notice of which has been furnished to the contractor.

Army Training Certification Tracking System (ATCTS) Registration for Contractors with a Government Information Systems Access Requirement. The contractor employees and all associated sub-contractor employees with access to a government info system shall register in the Army Training Certification Tracking System (ATCTS) at commencement of services and shall successfully complete the DoD Information Assurance Awareness prior to access to the Information System (IS) and then annually thereafter.

Information Assurance (IA)/Information Technology (IT) Training. All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8140.01, DoD 8570.01M and AR 25-2 within six months of appointment to IA/IT functions.

Information Assurance (IA)/Information Technology (IT) Certification. Per DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

Item 11.m. Other IAW AR 381-12, Threat Awareness and Reporting Program (TARP), 1 Jun 16, For all contractors with security clearances, contractor employees shall receive and complete annual TARP training per AR 381-12, Threat Awareness and Reporting Program (TARP) by a Counter Intelligence (CI) agent or other trainer as specified in 2-4b. Contractors shall report threat-related incidents, behavioral indicators and other matters of Counter Intelligence (CI) interest specified in Chapter 3, to the Facility Security Officer (FSO), the nearest military CI office, the FBI, or the DCSA. Contractor employees working as an integral part of the Army organization ARE REQUIRED TO COMPLETE ANNUAL Threat Awareness training. Contractor FSOs will ensure that all applicable AR 381-12 requirements are implemented for personnel who work at contractor facilities. If CI agent is not available a waiver request for the using computer based training (CBT) may be presented to the STORM Project Manager for consideration.

Concurrence of the Contracting Officer and STORM Security Manager, will be obtained prior to issue of a Limited Access Authorization to a non-U.S. citizen in compliance with the NISPOM. Controlled Unclassified information as defined in DoDI 5200.48, may be disclosed to U.S. persons who are employed by the prime contractor or subcontractors or to such employees who are foreign persons when requirements of export control and other laws are met. The contractor is responsible for compliance with all applicable laws and regulations governing access to Classified Information or Controlled Unclassified Information.

The contractor is not authorized to release any data to foreign nationals or foreign representatives without an approved export license.

If foreign subcontractors are currently performing on this contract with access to U.S. classified military information or controlled unclassified information, the U.S. contractor will provide the Contracting Officer and STORM Security Manager with a listing of the foreign subcontractors. The list will also include the country of origin, work being performed, export license number and by name and citizenship of any third party national citizen performing on the subcontract.

*See Item 13 for OPSEC Requirements.

*See Item 13 for TARP Requirements.

*See Attached Intelligence Addendum (non-SCI contract).

*Program Protection Plans will be provided as government furnished information if CPI is identified.

Rm 300-2 Redstone Arsenal, AL 38598 Enter address (include zip code).: Strategic and Operational Rockets and Missiles-SFAE-MSL-STS 100 Secured Gateway Huntsville, AL 35808