J3_DD254_FRFP_120215.pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

TOP SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYMMDD)

2011/11/28

b. SUBCONTRACT NUMBER b. REVISED (Supersedes all previous specs) Revision No. Date (YYMMDD)

1 2012/02/02

c. SOLICITATION OR OTHER NUMBER Due Date (YYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYMMDD)

H95001-10-R-0001

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

See Block 13, Reference Item 8.a.

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

MISSILE DEFENSE AGENCY (MDA) INFORMATION TECHNOLOGY AND COLLABORATION SERVICES (MICS)

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify)

k. OTHER Specify) Restrict access to Contractor’s Unclassified Automated Information System (AIS).

DD Form 254, DEC 1999 Previous editions are obsolete

Section J, Attachment 3 - DD254 H95001-10-R-0001

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct Through (Specify):

Missile Defense Agency/Public Affairs 5700 18th Street Fort Belvoir, Virginia 22060-5573 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.

Forward a copy of any Defense Security Service letter that informs of any serious deficiency to MDA Industrial Security Office, Bldg 5222, Martin Road, Redstone Arsenal, AL 35898, within 48 hours of receipt. Any incident of possible compromise will be reported to MDA Industrial Security Office, Bldg 5222, Martin Road, Redstone Arsenal, AL 35898, within 24 hours.

Direct questions pertaining to the DD 254 to MDA Industrial Security at 256-955-1676.

See Continuation Page

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

See Items 10.e(1), 10.f, 10.j, 11.j, 11.l, and 14.

Yes No

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

James M. Sullivan

b. TITLE

Director, Research, Development & Acquisition Security

c. TELEPHONE (Include Area Code)

571-231-8457

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

Missile Defense Agency a. CONTRACTOR

5700 18th Street b. SUBCONTRACTOR

Fort Belvoir, Virginia 22060-5573 c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY MDA Industrial Security DD Form 254 Reverse, DEC 1999

SULLIVAN.JAMES.M.10857

83455

Digitally signed by SULLIVAN.JAMES.M.1085783455 DN: c=US, o=U.S. Government, ou=DoD, ou=PKI, ou=MDA, cn=SULLIVAN.JAMES.M.1085783455 Date: 2012.02.03 15:37:04 -05'00'

Section J, Attachment 3 - DD254

SECURITY GUIDANCE (BLOCK 13) CONTINUATION:

Reference Item 8.a. (continued) Performance Locations may include one or more of the following MDA Facilities: (The Cognizant Security Office in all cases is MDA/Research, Development, and Acquisition Security)

-Missile Defense Agency, 5700 18th Street, Fort Belvoir, Virginia 22060-5573 -Missile Defense Agency, VB-III Bldg 5224, Martin Road, Redstone Arsenal, Alabama 35898 -Missile Defense Integration and Operations Center (MDIOC), 730 Irwin Ave, Schriever AFB, Colorado Springs, Colorado 80912 -Airborne Laser Program Office, Kirtland AFB, Albuquerque, New Mexico 87117 -Missile Defense Agency, Aegis Ballistic Missile Defense, Naval Surface Warfare Center, Dahlgren, Virginia 22448 -Missile Defense Agency, Ground Based Mid-Course Defense, Fort Greely, Alaska 99731

Reference Item 10.a: Contractor shall comply with the requirements of DoD 5220.22-M and National Security Agency/Central Security Service (NSA/CSS) Policy Manual Number (No.) 3- 16, Control of COMSEC Material, dated 5 August 2005.

Reference Items 10.d: NISPOM, Chapter 9, Sections 1 & 2, requirements apply. Personnel may require access to the Joint DOD/DOE Security Classification Guide CG-W-5. Processing or transmitting CNWDI is not authorized on an Automated Information System (AIS) without the system being accredited for CNWDI by the Defense Security Service. Flow this requirement to subcontractors when applicable.

Reference Item 10.e(1): This contract requires access to SCI material. The contractor is not required to have an accredited SCIF but requires access to SCI at other locations. Additionally, the FSO will ensure that when a contractor with access to SCI is due for a Periodic Reinvestigation (PR), the Periodic Reinvestigation request is identified to be conducted to meet SCI standards. Written U.S. Government approval by MDA Special Security is required prior to imposing this requirement on a subcontractor. See attached SCI Supplement.

Reference Item 10.e(2): NISPOM requirements apply.

Reference Item 10.f: See attached SAP Supplement.

Reference Item 10.g: NISPOM requirements apply.

Reference Item 10.h: NISPOM requirements apply.

Reference Item 10.j: See For Official Use Only/Controlled Unclassified Information Supplement below. This requirement will be imposed on all subcontracts.

Section J, Attachment 3 - DD254

Reference Item 11.a: Classified contract performance is restricted to MDA facilities and/or other contractor company facilities. The host contractor/government activity will provide required security classification guidance for the performance of this contract, consistent with work performed at that location. The prime contractor, as listed in Item 6.a, shall be required to follow all security policies and procedures and use Security Classification Guides of the host activity. This requirement shall be imposed on all subcontracts.

Reference Item 11.f:

1. Contractor is not authorized to establish a contractor facility Outside the United States, Puerto Rico, US Possessions and Trust Territories as part of this contract.

2. Travel to such areas needing access to classified information requires that the contractor’s security clearance information be included as part of the Country Clearance.

Reference Item 11.g: Contractor is authorized to use the services of DTIC or other secondary distribution center. The contractor and/or subcontractor will prepare the DD Form 1540 and DD Form 2345, if required, and submit to the contracting office.

Reference Item 11.j:

1. This contract requires the application of OPSEC in Compliance with MDA O-5205.02-INS (MDA OPSEC Instruction) to either specific instruction of the Contracting Officer/Contract Technical Monitor, "H" Clause, or Department of Defense (DD) Form 1423, Contract Data Requirements List, DD Form 1664, Data Item Description.

2. The contractor supporting event-oriented activities will develop OPSEC Plans/Annexes when directed by the supported program, or comply with the program's OPSEC Plan/Annex.

3. Contractor personnel assigned will receive OPSEC Awareness Education and Duty-Related Training as deemed necessary by the Government or program supported. OPSEC Awareness Education and Training will be provided by or coordinated through government channels (for example, MDA, Interagency OPSEC Support Staff (IOSS), etc.) and OPSEC protective measures (countermeasures) will be applied as directed by government or program sponsors.

Reference Item 11.l:

1. Contractor’s Unclassified AIS:

a. The contractor shall submit, and obtain approval of the Program supported for its procedures for protecting FOUO/CUI from unauthorized access from both internal and external sources prior to placing FOUO/CUI on the contractor’s unclassified AIS. Use Office of Management and Budget (OMB) Circular A-130, Revised, Management of Federal Information Resources, November 30, 2000 and DoD Directive 8100.2, "Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information

Section J, Attachment 3 - DD254

Grid (GIG)," April 14, 2004 as guidance documents.

b. AIS access to Controlled Unclassified Information, which includes FOUO/CUI (access qualifies as an Automated Data Processing/Information Technology (ADP/IT)-III Position requirement), must be limited to U.S. Persons (precludes access by individuals claiming dual citizenship without MDA/Special Security permission) that have a minimum interim SECRET level clearance; or have been the subject of a favorably completed National Agency Check (NAC) or a more stringent personnel security investigation (access pending completion of NAC and final clearance determination is subject to approval by MDA/Special Security); or contractor equivalent.

(1) Contractor Equivalent: Contractor equivalent includes various background checks such as those performed by employers during hiring process. Minimum checks shall include Citizenship, Personal Identification (Social Security Number), Criminal, and Credit. This option is subject to MDA/Special Security approval.

(2) ADP/IT-III Requirement: ADP/IT-III positions are located at the contractor's facility.

Only electronic SF-85Ps can now be submitted. The contractor shall contact MDA/Special Security and provide the information requested. MDA/Special Security will electronically notify the individual when they may enter e-QIP through the OPM portal. The individual shall then enter information to complete the SF 85P, Questionnaire for positions of Public Trust, electronically. It will be necessary to mail 2 DD Forms 258 (Fingerprint Cards), through the Contracting Officer's Representative, to: MDA/Special Security, 5700 18th Street, Fort Belvoir, Virginia 22060-5573.

c. See the “For Official Use Only/Controlled Unclassified Information Supplement” below for additional guidance on handling that information.

d. MDA/Research, Development, and Acquisition Security reserves the right to conduct compliance inspections for the protection of For Official Use Only/Controlled Unclassified Information.

2. Publicly Accessible Internet Websites: Contractors and subcontractor must receive written official public release approval for MDA/BMDS information from MDA Public Affairs before that information is uploaded onto any respective computer system that provides public access via an Internet website.

Reference Item 12:

1. Proposed public disclosure of unclassified information relating to work under this contract shall be coordinated through the Organizational OPSEC Coordinator, to the MDA COR/TM/CLIN COTR for submission to MDA Public Affairs for public release processing.

ONLY information that has been favorably reviewed and authorized by MDA/Public Affairs may be disclosed. Information developed after initial approval for public release must be submitted for re-review and processing.

Section J, Attachment 3 - DD254

2. Contemplated visits by public media representatives in reference to this contract shall receive prior approval from the MDA COR/TM/CLIN COTR and from MDA/Public Affairs.

3. Critical technology subject to the provisions of DoD Directives 5230.24, “Distribution Statements on Technical Documents,” and 5230.25, “Withholding of Unclassified Technical Data from Public Disclosure,” shall be reviewed in accordance with established directives.

4. A request from a foreign government, or representative thereof, including foreign contractors, for classified and/or unclassified information in reference to this contract shall be forwarded to MDA International Security for review and appropriate action.

Reference Item 14:

Critical Program information (CPI) and Critical Technologies (CT), will be identified by MDA, and protected by the contractor to the standards articulated in DoD INST 5200.39, Incorporating Change 1, December 28, 2010 and the DTM 09-016, Incorporating Change 2, August 31, 2011 and implemented by a Program Protection Plan. If a Program Protection Implementation Plan is required, it shall be submitted by the contractor to MDA/Research, Development, and Acquisition Security for review and approval.

Section J, Attachment 3 - DD254

MDA SCI Supplement (Item 10.e (1)) for DD Form 254

This supplement applies to Prime Contract Number: H95001-10-R-0001

Delivery/Task Order Number: ________. Expiration date: ______. (Do not include option years until option is exercised.)

A. The following controls will apply to SCI provided under this contract:

1. DoD 5105.21-M-1, “Sensitive Compartmented Information Administrative Manual;” ICD 503, “Intelligence Community Information Technology Systems Security Rick Management, Certification and Accreditation;” ICD 704, ICPG 704-1 – 704-5, “Personnel Security Standards and Procedures Governing Eligibility for access to SCI;” ICD 705, ICS 705-1 – 705-2, “Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities;” DoD Regulation 5200.1-R, “Information Security Program Regulation;”

and MDA SCI Handbook provide the necessary guidance for physical, personnel, and information security measures, to include proper marking requirements, and is part of the SCI security specifications for the contract. NOTE: CSSO/FSO are required to process all SCI administration requirements for all MDA SCI contract efforts per the MDA SCI Handbook. The Handbook can be obtained by contacting MDA/Special Security.

2. Inquiries pertaining to classification guidance will be directed to the responsible MDA Contracting Officer’s Representative (COR)/Task Monitor (TM)/ CLIN Contracting Officer’s Technical Representative (COTR). The name/phone number for the MDA COR/TM/CLIN COTR is: ______________________________

(Additionally, identify the Company Security POC (FSO/CSSO) & phone number and email address at the contractor’s/subcontractor’s location): _________________________________

3. All SCI furnished to the contractor in support of this contract/delivery/task order remains the property of the Department of Defense, or the agency or command that releases it. Upon completion of the contract, SCI furnished to the prime contractor will be returned to MDA or destroyed as directed by the MDA COR/TM/CLIN COTR. NOTE: Prime contractor and subcontractor company security officers who destroy derivative or MDA generated SCI material will be required to provide a copy of the destruction certificate to the MDA COR/TM/CLIN

COTR.

4. The contract/delivery/task order requires the following SCI access(es): (COR/TM/CLIN COTR is required to mark with an "X" the SCI accesses needed to effectively fulfill the SCI contractual obligation) SI ____, TK ____, G ____, HCS ____. Access will be granted by the government agency. Upon completion or cancellation of the contract the MDA COR/TM/CLIN COTR will provide a by name list of all contractors required to be debriefed from SCI to the MDA SSCO before contract close-out. All debriefed contractors will be removed from MDA SCI billets immediately by the SSCO once they have been debriefed. This contract requires ____SCI billets.

Section J, Attachment 3 - DD254

5. Contractor personnel requiring access to SCI and justification for MDA SCI billets will be initiated by the company’s security officer with validation by the COR/TM/CLIN COTR per the guidelines in the MDA SCI Administration Handbook enclosure found below. Company security officers are required to obtain a copy of the MDA SCI Handbook by contacting the MDA/Special Security. NOTE: CSSO/FSO should only submit contractors employees who have a completed in scope (within the last 5 years) Single Scope Background Investigation (SSBI) for SCI access. Company Security Officers should submit a SCI Nomination Package (Nom Memo, updated SF86 questionnaire and copy of DD Form 254 (Prime & Sub, as required) to the MDA Special Security Office for processing. Submit only personnel that have a real day-to-day need-to-know requirement.

6. The CSSO/FSO shall advise the MDA SSCO, through the contracting officer's representative, upon reassignment of personnel to other duties not associated with this contract. NOTE:

Individual contractors who no longer support a MDA SCI contract will be subject to a debrief from SCI access immediately. Company security officers are required to coordinate with the MDA SSCO to get their individual contractors debriefed.

7. The CSSO must coordinate with the MDA COR/TM/CLIN COTR prior to subcontracting any portion of the SCI efforts involved in their MDA SCI prime contract. A separate DD Form 254, utilizing this SCI Supplement, for the subcontractor will be processed and a copy provided to MDA SSCO. NOTE: The SSCO will not provide any SCI administration support to prime contractors or subcontractors who do not have a signed active DD 254 for an MDA SCI contract.

8. The contractor shall not use references to SCI accesses, even by unclassified acronyms, in advertising, promotional efforts, or recruitment of employees.

9. All SCI work will be performed in a DIA accredited MDA SCIF unless otherwise authorized.

Is there a SCIF required for this contract? ______ Yes or __ X_ No (COR/TM/CLIN COTR required to mark and “X” in the appropriate space).

10. AIS SCI Processing. Electronic processing of SCI requires accreditation of the equipment in accordance with ICD 503 and DIAM 50-4.

11. Visit Cert. The contractor FSO/CSSO will submit the request for SCI visit certifications per guidelines of the MDA SCI Handbook through the COR/TM/CLIN COTR for approval of the visit. The certification request must arrive at MDA/Special Security at least five (5) working days prior to the visit.

12. The contractor will not reproduce any SCI related material without prior written permission of the COR/TM/CLIN COTR.

Section J, Attachment 3 - DD254

13. MDA has exclusive security oversight for all SCI released to the contractor or developed under this contract. Defense Intelligence Agency (DIA) is the cognizant security authority for inspections of MDA-sponsored contractor SCIFs to ensure compliance of SCI Directives/Regulations. MDA/Special Security will conduct self-inspections of MDA-sponsored SCIFs.

B. The Missile Defense Agency is designated as the User Agency for SCI requirements.

Print name of MDA SSCO: Dave Gmaz, Special Security

MDA SSCO Signature: ______________________________ Date: __________

Phone: (571) 231-8459

Print name of COR/TM/CLIN COTR/Directorate designation: _______________________

COR/CLIN COTR Signature: _________________________________ Date: __________

Phone: _____________

Print name of Directorate Technical Oversight Representative: ______________________

Signature: Date: __________

Phone: _____________

Section J, Attachment 3 - DD254

E-1 – SCI Access/Billet (Nomination) Request

(To be used by MDA affiliated CSSO/FSO in submitting contractors for SCI access) (Put the template below on company letterhead)

Date

MEMORANDUM FOR DEFENSE INTELLIGENCE AGENCY THRU MISSILE DEFENSE

AGENCY, ASSISTANT DIRECTOR, SPECIAL SECURITY

SUBJECT: MDA Contractor SCI Access Nomination Request

Request the below named individual be nominated for SCI access.

a. Name:

b. Aliases:

c. SSN:

d. DOB/POB:

e. Current Investigation/Type/Date:

f. Citizenship:

g. Position Title:

h. CLIN COTR’s Name, Grade, Organization, and Telephone Number:

i. MDA SCI Contract Number:

j. Contract Services Start and Expiration Date:

k. Location of Facilities Where Work is to be Performed:

l. Access required: (Fill in SCI compartments required, i.e. SI/TK/G/HCS)

m. Justification: A strong separate justification is required for SI/TK & G and a separate justification for HCS (if required). Why the job cannot be performed without access to SCI, and how the individual will use the information. The justification must indicate/certify a definite work-related Day-to-Day Need-to-Know. This is mandatory (One memo only).

Signature Block for MDA COR/CLIN COTR: ____________________________

Signature Block for CSSO/FSO: _________________________________

(Both Prime and Sub CSSO/FSO must sign if the individual supports a subcontract)

NOTE: Submit this signed letter with a copy of the candidate’s SF 86 with minimal pen and ink updates (initialed and dated), originally re-signed and re-dated within 60 days and a copy of the contract’s DD Form 254 (both sub and prime as applicable) as a part of the complete SCI Access/Billet (Nomination) Request package to MDA/Special Security. EPSQ Form SF86 questionnaire will not be accepted.

Section J, Attachment 3 - DD254

SAP Supplement to Contract No: H95001-10-R-0001 Ver. 1.0, 15 Sep 2010

1. Item 10f:

a. Access to MDA SAP information or material is authorized only at facilities and locations specifically approved by MDA/Special Programs. Access to SAP information requires a final U.S. Government Secret (or Top Secret) clearance with a favorable NACLC or PRS (or SSBI/PPR) investigation completed within the last five years, an approved SAP nomination, and a signed special access non-disclosure agreement prior to access. The Government Program Security Officer (PSO) will contact the contractor Facility Security Officer (FSO) to obtain security information on facilities and personnel required to perform on this contract.

b. All SAP work, regardless if in a prime or subcontractor’s location, will be performed in an MDA-approved SAP facility (SAPF). If there is a requirement to discuss, store, or process SAP information in an existing SCIF, SAPF, or Closed Area, a Memorandum of Understanding (MOU) for co-utilization must be executed between the MDA cognizant SAP security representative and the other government or contractor customer cognizant security representative.

A Co-Utilization Agreement (CUA) is required between MDA/Special Programs and the SCI Cognizant Security Authority (CSA) prior to introduction of MDA-sponsored SAP data into a Sensitive Compartmented Information Facility (SCIF). A Standard Operating Procedure (SOP) will be written for each SAPF and coordinated with MDA/Special Programs.

2. Item 11h: Consult with MDA/Special Programs prior to ordering encryption devices or COMSEC keying material (other than STEs) to support SAP transmissions.

3. Item 11i: TEMPEST requirements may be necessary in the performance of this contract in accordance with program requirements, JAFAN 6/3, and where appropriate, JAFAN 6/0.

4. Item 11j: OPSEC requirements may be necessary in the performance of this contract in accordance with individual program requirements and JAFAN 6/0. Specific guidance will be provided by MDA/Special Programs.

5. Item 12:

a. Public release of SAP information is PROHIBITED. Documents or other materials pertaining to this effort will not be released to the Defense Technical Information Center (DTIC) or any other such information service under any circumstances. A pre-publication and/or presentation(s) review is required prior to the use of any classified or unclassified information which is either tangentially or directly related to any SAP. In each case, approval must be obtained from the MDA SAP Central Office (SAPCO). The request must be submitted by the person who desires to make the publication or presentation, via the Contractor Program Security Officer (CPSO) to the MDA SAPCO Security Director.

b. The contractor shall not use references to SAP accesses (Nicknames, Code Words, etc.) or

Section J, Attachment 3 - DD254 information, even by unclassified acronyms, in advertising, promotional efforts or recruitment of employees.

6. Item 13: The Government PSO will provide additional Security Classification Guides specific to the SAPs under this contract. Contractors will classify SAP material IAW these SCGs and applicable publications listed in Item 14.

a. Contractor Information Systems (IS) and/or networks that are involved in support of the MDA/SAPCO mission shall operate in accordance with controlling laws, regulations, DoD and MDA SAPCO policy as referenced in Item 14.

b. Prior to processing, storing, transmitting, transferring, or communicating MDA SAP information on any information system or network, the Contractor shall comply with certification & accreditation controlling laws, regulations, DoD and MDA SAPCO policy as referenced in Item 14 and be required to obtain the requisite accreditation to test or operate from the MDA SAPCO Designated Approving Authority (DAA).

c. The Contractor shall employ physical security safeguards for IS(s) and/or network(s) involved in processing or storage of Government information/data to prevent the unauthorized access, disclosure, modification, destruction, use, and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the Contractor will support a physical and information technology security audit performed by the Government of the Contractor's internal information management infrastructure.

7. Item 14: MDA adopted the JAFAN series publications as an implementer to the National Industrial Security Program Operating Manual (NISPOM) Supplement. Contractors performing under this contract will use the below listed security publications unless exempted by MDA/Special Programs.

a. JAFAN 6/0, Rev 1, Special Access Program Security Manual

b. JAFAN 6/3, Protecting SAP Information Within Information Systems

c. JAFAN 6/3 Implementation Guide

d. JAFAN 6/4, Rev 1, Special Access Program Tier Review Process

e. JAFAN 6/9, Physical Security Standards for SAP Facilities

f. DoD 5220.22M Sup 1, National Industrial Security Program Operating Manual Supplement; DoD Overprint to the NISPOMSUP;

g. Applicable Facility Specific Standard Operating Procedures, Treaty Plans, and OPSEC Guides

h. DoD Directive 5205.07, Special Access Program Policy

i. DoDI 0-5205.11, Management, Administration, and Oversight of DoD Special Access Programs

j. MDA SAPCO Policy, Certification and Accreditation Program.

k. National Security Agency/Central Security Service NSA/CSS Policy Manual 9-12

MDA/Special Programs will provide the contractor named in Item 6a these publications if

Section J, Attachment 3 - DD254 they do not have a copy.

8. Item 15: MDA/Special Programs will conduct program/security reviews of all SAP facilities, material and operations related to this contract. DSS oversight over SAP portions of this contract is carved-out.

9. CONTRACT NUMBER. The complete contract number is H95001-10-R-0001. The contractor may be required to establish non-attributable internal procedures and charge numbers that will be documented in their Business Financial Management procedures as necessary for cost accumulation by uncleared personnel.

10. SUBCONTRACTING. Subcontracting must have prior approval of MDA/Special Programs. Any classified program activity that requires the use of a subcontractor facility must meet JAFAN 6/9 criteria and be approved by MDA/Special Programs.

11. COMMUNICATIONS AND TRANSMISSIONS.

a. Any communications of SAP information with outside activities not involved with the specific supported SAP are PROHIBITED, unless otherwise authorized by MDA/Special Programs.

b. All programmatic material relating to this contract and its administration shall be classified in accordance with the requirements outlined in MDA and SAP-specific classification guides and this DD254 or as directed by MDA/Special Programs.

c. Program related telephonic communications will be conducted on secure telephone units.

d. All documentation concerning SAP portions of this contract will be transmitted in accordance with JAFAN 6/0. If U.S. Postal mailing is used, MDA/Special Programs will provide guidance, as required.

12. VOUCHERS. All invoices/vouchers submitted under this contract shall be UNCLASSIFIED and devoid of any information that would require them to be classified. The invoice/voucher may reveal the contractor's name, customer name or UIC of the contract number.

All classified or sensitive invoices/vouchers shall be transmitted via means identified in paragraph 11, above, or as directed by MDA/Special Programs.

13. LEGAL COUNSEL. Should the contractor require private counsel to represent corporate interests in matters related to or associated with SAP sponsored activities, the Procurement Contracting Officer, and MDA/Special Programs shall be notified in writing. The private counsel shall be treated as a subcontractor. In those incidents where the issues are not program specific, it is the responsibility of the appropriate indoctrinated contractor personnel to prevent inadvertent dissemination of SAP related information/data, operational procedures and/or administrative details to the private counsel.

Section J, Attachment 3 - DD254

14. RETENTION OF PROGRAM RELATED DOCUMENTATION, SOFTWARE, AND

HARDWARE. Upon completion of this contract and acceptance by the Government of final deliverables, the contractor shall:

a. Conduct an inventory/audit of all SAP material received and/or generated under this contract and forward it to MDA/Special Programs.

b. In accordance with MDA/Special Programs direction, the contractor shall destroy administrative security records and related documents utilizing approved destruction procedure/methods and maintain certificates of destruction for final close-out review. Retention of SAP information at the contractor facility is not generally authorized beyond contract close-out unless a follow on contract/task is anticipated. A written request for authorization for document retention must be forwarded to the Procurement Contracting Officer and the MDA Program Security Officer for approval.

15. ISSUES/CONFLICT REPORTING.

a. Any questions regarding classification, access, or any other security related issue in regard to the SAP portion of this contract must be referred to MDA/Special Programs.

b. Any conflict between instructions contained in the NISPOM, the Overprint to the NISPOMSUP, JAFAN 6/0 and this DD Form 254 must be reported to MDA/Special Programs by the most expedient and secure means.

XXXXXXXXXX Special Access Program Representative COR/TM/CLIN COTR Signature Block Missile Defense Agency

Section J, Attachment 3 - DD254

FOR OFFICIAL USE ONLY/CONTROLLED UNCLASSIFIED

INFORMATION SUPPLEMENT

1. Definitions.

a. Automated Information System (AIS). An assembly of computer hardware, software, and firmware configured to automate functions of calculating, computing, sequencing, storing, retrieving, displaying, communicating, or otherwise manipulating data, information, or textual material.

b. Controlled Unclassified Information (CUI). Unclassified information which requires access and distribution limitations prior to appropriate coordination and an official determination by cognizant authority approving clearance of the information for release to one or more foreign governments or international organizations, or for official public release. Per DoD 5200.1-R it includes the following types of information: "For Official Use Only" (FOUO) in accordance with DoD 5400.7-R; “Sensitive But Unclassified” (State Department information); “DEA Sensitive Information” (Drug Enforcement Agency information); “DoD Unclassified Controlled Nuclear Information”; “Sensitive Information” as defined in the Computer Security Act of 1987; and information contained in technical documents (i.e., Technical Data) as discussed in DoD 5230.24, 5230.25, International Traffic in Arms Regulation (ITAR), and the Export Administration Regulations (EAR).

c. Dual Citizenship. A dual citizen is a citizen of two nations. For the purposes of this document, an individual must have taken an action to obtain or retain dual citizenship.

Citizenship gained as a result of birth to non-U.S. parents or by birth in a foreign country to U.S.

parents thus entitling the individual to become a citizen of another nation does not meet the criteria of this document unless the individual has taken action to claim and to retain such citizenship.

d. For Official Use Only (FOUO). FOUO is information that may be withheld from public disclosure under one or more of the 9 exemptions of the Freedom of Information Act (FOIA) (See DOD 5400.7-R). FOUO is not a form of classification to protect U.S. national security interests.

e. National of the United States.Title 8, U.S.C. Section 1101(a)(22), defines a National of the U.S. as:

(1) A citizen of the United States, or,

(2) A person who, but not a citizen of the U.S., owes permanent allegiance to the U.S.

NOTE: 8 U.S.C. Section 1401, paragraphs (a) through (g), lists categories of persons born in and outside the U.S. or its possessions that may qualify as Nationals and Citizens of the U.S. This subsection should be consulted when doubt exists as to whether or not a person can qualify as a National of the U.S.

Section J, Attachment 3 - DD254

f. Personal Information. Information about an individual that is intimate or private to the individual, as distinguished from information related to the individual's official functions or public life.

g. U.S. Person. Any form of business enterprise or entity organized, chartered, or incorporated under the laws of the United States or its possessions and trust territories and any person who is a citizen or national (see National of the United States) of the United States, or permanent resident of the United States under the Immigration and Nationality Act.

h. Privacy Act. The Privacy Act of 1974, as amended, 5 U.S.C. Section 552a.

2. General.

a. The FOIA requires U.S. Government offices to disclose to any requestor information resident in U.S. Government files unless the information falls under one of 9 exemption categories. FOUO/CUI and other information may fall in this category. Mark such information as “For Official Use Only.”

b. FOUO/CUI in the hands of contractors may not be released to the public by the contractor unless (a) the COR/TM/CLIN COTR concurs and (b) written approval has been provided by MDA/Public Affairs. Note: MDA/Public Affairs coordinates public release requests with MDA Research, Development, and Acquisition Security.

c. Access:

(1) Access to FOUO/CUI must be limited to U.S. Persons (precludes access by individuals claiming dual citizenship without MDA/Special Security permission) or, in the case of technical data as defined by the ITAR, the access is covered by a Technical Assistance Agreement or other form of duly licensed export. This requirement does not apply to use of commercial off the shelf (COTS) equipment and services that do not have export limitations.

(2) Non-Sensitive Positions (ADP/IT-III positions). Non-sensitive positions associated with FOUO/CUI are found at contractor facilities processing such information on their (contractor's) unclassified computer systems. Personnel nominated to occupy ADP/IT-III designated positions (applies to any individual that may have access to FOUO/CUI on the contractor's computer system) must have at least a National Agency Check (NAC) or contractor equivalent (company hiring practices reviewed and approved by MDA/Special Security). When "contractor equivalent" option is NOT authorized and there is no record of a valid investigation, the contractor shall contact MDA/Special Security at (571) 231-8459, and provide the requested information. MDA/Special Security will electronically notify the individual when they may enter e-QIP through the OPM portal. The individual will then enter information to complete the SF 85P, Questionnaire for Positions of Public Trust, electronically. It will be necessary to mail 2 DD Forms 258 (Fingerprint Cards), through the Contracting Officer's Representative, to:

MDA/Special Security, 5700 18th Street, Fort Belvoir, Virginia 22060-5573.

Section J, Attachment 3 - DD254

3. Identification Markings.

Within the Department of Defense CUI shall be marked as FOR OFFICIAL USE ONLY or with a DISTRIBUTION STATEMENT, to include the appropriate WARNING for ITAR or the EAR.

a. An unclassified document that qualifies for FOUO marking, when marked, shall be marked "For Official Use Only" at the bottom of the page on the outside of the front cover (if any), on the first page, on each page containing FOUO information, on the back page and on the outside of the back cover (if any), centered at the bottom of the page. For convenience, all pages, even those that do not contain FOUO information, may be marked "For Official Use Only" in documents generated by an automated system.

b. Individual pages within a classified document that contain both FOUO and classified information shall be marked at the top and bottom with the highest security classification of information appearing on the page. Individual pages containing FOUO information but no classified information shall be marked "For Official Use Only" at the top and bottom of the page (unless all pages are being marked with the highest overall security classification level).

c. All declassified MDA information is “unclassified official government information” and requires official MDA Security and Policy Review prior to official public release.

d. E-mails and other electronic files shall be marked in the same fashion as described for documents above, to the maximum extent possible.

4. Handling.

a. During any temporary sojourn of U.S. Government Unclassified information outside of the contractor controlled work space (residence, telework facility, hotel), the material must be stored in a locked room, drawer, filing cabinet, briefcase, or other storage device, so that access to the material by unauthorized individuals (i.e., family members, hotel staff, etc.) is prevented whenever untended by the contract employee.

(1) Long term task driven deadlines (in excess of five days) or the need to be able to perform official work while in an extended travel status on contract-driven business, require extended access to MDA Unclassified information outside of “official” work spaces. When that happens, employees may request written approval from their supervisors to possess, work on, and store MDA Unclassified information in non-contractor facilities for a period of not more than thirty calendar days.

(2) Requests for extended possession, use, and storage of U.S. Government Unclassified information outside of “official” work spaces (periods in excess of 30 days) shall take the form of a Memorandum For Record (MFR) prepared by the employee, specifying the body of information to be removed by listing the: title or subject matter; Program, Project, or Task being supported; general volume and format of the information concerned; and projected date of return.

Additionally, the MFR shall contain a signature block for the supervisor to sign and date when approval is granted.

Section J, Attachment 3 - DD254

(3) The availability of supervisory copies of MFRs as described in this section may be an inspection item during Security Program Reviews conducted by the MDA/Research, Development, and Acquisition Security staff.

(4) The affected employee shall keep the originally signed MFR in validation of authorization granted for the agreed term of use. The supervisor shall maintain a copy of the MFR with employee records for the same term.

(5) Requested extensions of supervisory authorization for employee possession, use, and storage of MDA Unclassified information outside of “official” work spaces may be granted in incremental blocks of 30 days each so long as the work-related requirement continues.

(6) All affected employees authorized to possess, use, and store U.S. Government Unclassified information outside of “official” work spaces must return all U.S. Government Unclassified information to contractor control upon “task” completion. When such a return has been completed, the supervisor shall annotate the date that all items were returned. The supervisor's copy shall be retained for a period of time, not to exceed one year.

b. The above excludes unclassified information of an administrative nature including necessary personnel recall rosters and official telephone lists which are needed by supervisors and employees to assure the physical security, safety, health, and general psychological well-being of the contractor work force.

5. Transmission/Dissemination/Reproduction.

a. Subject to compliance with official distribution statements, FOUO markings (e.g., Export Control, Proprietary Data) and/or Non-Disclosure Agreements which may apply to individual items in question; authorized contractors, consultants and grantees may transmit/disseminate FOUO/CUI information to each other, other DoD contractors and DoD officials who have a legitimate need to know in connection with any DoD authorized contract, solicitation, program or activity. The government Procuring Contracting Officer (PCO) will confirm with the Contracting Officer's Representative or Task Order Monitor "legitimate need to know" when required. The MDA/Chief Information Officer has determined that encryption of external data transmissions of FOUO/CUI are now practical. The MDA/Chief Information Officer has stated that Public Key Infrastructure (PKI) and Public Key (PK) enabling technologies are available and cost effective.

The following general guidelines apply:

(1) In accordance with DoD 5200.1-R, Appendix III, external electronic data transmissions of CUI/FOUO shall be only over secure communications means approved for transmission of such information whenever practical. Encryption of e-mail to satisfy this requirement shall be in accordance with MDA Directive 8190.01, Electronic Collaboration with Commercial, Educational, and Industrial Partners, May 12, 2009, being accomplished by use of DoD approved Public Key Infrastructure Certification available from:

http://iase.disa.mil/pki/eca/certificate.html or by the company’s participation in the “Federal

Section J, Attachment 3 - DD254

Bridge. The MDA/Chief Information Officer, PKI Common Access Card (CAC) point of Contact is, Ms. Ingrid Weecks (719-721-7040).

(2) In accordance with DoD 5200.1-R, Appendix III, external electronic transmissions of FOUO/CUI via voice, facsimile, or video teleconference shall be only over secure communications means approved for transmission of information wherever practical.

Transmitting FOUO/CUI via these means, without encryption requires prior written authorization by MDA/Chief Information Officer.

b. Failure of the contractor to encrypt FOUO/CUI introduces significant risks to the BMDS mission. It is essential for the contractor to understand the risks and mitigation options that are available. The contractor must understand that failure to encrypt FOUO/CUI carries with it certain risks to the mission. These risks can be mitigated with the thoughtful application of processes, procedures, and technology.

(1) Risks Include:

� Undermining our OPSEC efforts at a time that we begin to focus on implementing missile defense plans in Europe.

� The aggregation of FOUO/CUI can communicate events and plans that may be classified (i.e., "classification by compilation").

� Not properly encrypting contributes to a lax security environment.

(2) Some of the available mitigation tools include:

� Approved DOD PKI/CAC hardware token certificates or DOD trusted software certificates for encrypting data in transport � Industry best practice of Virtual Private Network (VPN) Internet Protocol Security

(IPSEC) for intra-organization transport � Industry best practice of Secure Sockets Layer Portal Web Services for document sharing and storage � Approved DOD standard solutions for encrypting data at rest � Approved DOD E-Collaboration services via MDA Portal or Defense Information

Systems Agency (DISA) Network Centric Enterprise Services (NCES) � Any FIPS 140-2 validated encryption [e.g., IPSEC, Secure Socket Layer/Transport

Layer Security (SSL/TLS), Secure/Multipurpose Internet Mail Extensions

(S/MIME)]

� Procure and employ Secure Telephone Equipment (STE) � Procure and employ secure facsimile (FAX) capability � Utilize secure VTC capabilities � Hand-carry FOUO/CUI � Utilize mailing through U.S. Postal Service � Utilize overnight express mail services.

Section J, Attachment 3 - DD254

c. The MDA CIO has taken the position that encryption technologies are readily available, easy to obtain, inexpensive, and practical to implement. Therefore, if the contractor believes there are performance locations identified that cannot encrypt FOUO/CUI, the contractor will provide within 120 days of contract signing, a list of those locations along with explanation as to why encryption is not practical. This list will be provided to the PCO and COR/TM/CLIN COTR for transmission to MDA/Chief Information Officer and MDA/Research, Development, and Acquisition Security. The MDA/Chief Information Officer will determine the acceptability of contractor submissions and will notify the PCO of any decisions regarding encryption.

d. FOUO/CUI shall be processed and stored internally on Automated Information Systems (AIS) or networks 1) when distribution is to an authorized recipient and 2) if the receiving system is protected by either physical isolation or a password protection system. Holders shall not use general, broadcast, or universal e-mail addresses to distribute FOUO/CUI. Discretionary access control measures may be used to preclude access to FOUO/CUI files by users who are authorized system users, but who are not authorized access to FOUO/CUI. External transmission of FOUO/CUI shall be secured using NIST-validated encryption.

e. The World Wide Web shall be equated with "Public Access." Information must be reviewed by MDA/Public Affairs and officially approved for public release before it is placed on publicly-accessible Web pages or electronic bulletin boards. Contractor personnel who maintain and post information on websites or web logs (BLOGS), and who provide OPSEC reviews of such, should receive OPSEC Awareness information that specifically addresses DoD guidance associated with these activities.

f. Do not mark shipping containers as containing CUI or FOUO.

g. Reproduction of FOUO/CUI may be accomplished on unclassified copiers within designated government or contractor reproduction areas.

6. Storage. During working hours, FOUO/CUI shall be stored in a manner that limits access by persons who do not have an official need for the information.