Atch J-3 DD Form 254 26 Jan 2012.doc

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

SECRET

b. LEVEL OF SAFEGUARDING REQUIRED

FORMCHECKBOX

a. PRIME CONTRACT NUMBER ----to be assigned

20120126

FORMCHECKBOX

b. SUBCONTRACT NUMBER

FORMCHECKBOX

b. REVISED (Supersedes all previous specs) Revision No.

DATE (YYYYMMDD)

FORMCHECKBOX

c. SOLICITATION OR OTHER NUMBER

HC1028-12-R-0003

DUE DATE (YYYYMMDD)

20120319

FORMCHECKBOX

4. IS THIS A FOLLOW-ON CONTRACT?

X

YES

FORMCHECKBOX

NO.

If yes, complete the following:

Classified material received or generated under Dynamic Systems, Inc. #DCA200-02-A-5011/0111, Networking Technologies and Support, Inc. # HC1028-08-D-2029 and Global Technical Systems # HC1028-10-C-2001 is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254?

FORMCHECKBOX

YES

X

NO.

If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

Completed at Award

7. SUBCONTRACTOR

8. ACTUAL PERFORMANCE

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Contract is to provide for preventive, predictive, and remedial hardware and software maintenance support for DISA Computing Services activities for Maintenance on SupportCentric Level I equipment.

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

X

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

X

d. FORMERLY RESTRICTED DATA

X

e. INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

X

(2) Non-SCI

X

f. SPECIAL ACCESS INFORMATION

X

g. NATO INFORMATION

X

h. FOREIGN GOVERNMENT INFORMATION

X

i. LIMITED DISSEMINATION INFORMATION

X

l. OTHER (Specify)

k. OTHER (Specify) (Classified AIS Processing IT Level) X

DD Form 254, DEC 1999 (EF)

PREVIOUS EDITIONS ARE OBSOLETE

12. PUBLIC RELEASE. Any Information (Classified Or Unclassified) Pertaining To This Contract Shall Not Be Released For Public Dissemination Except As Provided By The Industrial Security Manual Or Unless It Has Been Approved For Public Release By Appropriate U.S. Government Authority. Proposed Public Releases Shall Be Submitted For Approval Prior To Release

FORMCHECKBOX

Direct

X Through (Specify):

DISA Corporate Communcations

Arlington, VA 22204

(703) 607-6900, DSN: 327-6900

e-mail: corporatecommunications@disa.mil to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs) * for review.

* In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

Additional security requirements may be contained within the DD Form 254 upon award of contract.

Public release of classified and/or controlled unclassified information is not authorized.

See attached for additional security guidance.

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use item 13 if additional space is needed.)

X

YES

FORMCHECKBOX

NO

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use item 13 if additional space is needed.)

FORMCHECKBOX

YES

X

NO

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

2300 E Drive Scott AFB, Ill 62225

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

DD Form 254 (BACK), DEC 1999 ITEM 13 Continuation (Page 3) Reference 10j - For Official Use Only (FOUO) Information.

(1) Contractors may disseminate “For Official Use Only” information to their employees and subcontractors who have a need for the information in connection with this contract.

(2) Removal of the “For Official Use Only” (FOUO) marking or release of FOUO material to the public can only be accomplished by the Government Cognizant Authority (GCA).

(3) “For Official Use Only” information shall be stored in locked receptacles such as file cabinets, desks, or bookcases. When such internal security control is not exercised, locked buildings or rooms will provide adequate after-hours protection. During working hours, the information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information.

(4) “For Official Use Only” information may be sent via first-class mail or parcel post. Facsimile communications marked FOUO may be transmitted by nonsecure terminals with the FOUO marking intact between U.S. Department of Defense, and other U.S. Government agencies, and U.S. Government support contractors for official purposes.

(5) When no longer needed, FOUO information may be disposed of by shredding each copy into pieces to preclude reconstructing, and placing it in a regular trash container.

(6) Unauthorized disclosure of “For Official Use Only” information does not constitute a security violation, but the GCA shall be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions. Specific guidance may be found in DOD Regulation 5400.7, DOD Freedom of Information Act Program.

Reference 10k – Automated Information Systems (IS) access will be at the IT-I (privileged level). DISA Personnel Security specifically approves AIS access upon receipt of a VAR from the Contractor, which is forwarded via the DISA Computing Services Security Manager.

11 a and e

(1) All classified information received under this contract must be properly protected in accordance with the NISPOM and all other applicable DOD guidelines and is the property of the U.S. Government.

(2) At the termination or expiration of this contract, the contractor shall request disposition instructions for all classified and unclassified project material. The contractor may be directed to properly destroy the material or return it. If classified or unclassified project material is to be retained by the contractor, every effort should be taken to transfer it to a follow-on contract or similar effort, if applicable. This must be done, however, with Contracting Officer (CO) approval. Unless written authorization by the CO to retain specific material for a specific period of time is received, the material shall be returned or destroyed as instructed.

11 l – Other.

(1) The contractor is not authorized to release information, orally, visually, or documentary to anyone not associated with this contract.

(2) All questions regarding security requirements indicated herein will be referred to the Contract Technical Monitor, if one is designated, or the Contracting Officer.

ITEM 13 Continuation (Page 4)

(3) Personnel Security Requirements

(a) Contractor must have a current Facility Security

Clearance (FCL) with the Defense Industrial Security

Office (DISCO).

(b) Personnel performing duties under this contract must undergo a Single Scope Background Investigation (SSBI) or Special Background Investigation (SBPR) to be eligible for ADP-I sensitivity level duties on systems. All personnel performing on this contract will be U.S. citizens.

(c) Contractor employees working under this contract will be required to have a minimum Secret security clearance adjudicated by (DISCO) before reporting for work.

(d) Derogatory information or failure to meet or comply with security requirements discovered during the period of employment under this contract may at the discretion of the Government be grounds for termination of an individual contractor employee’s employment.

(4) A copy of the final DD 254 will be provided to the DISA Computing

Services Security Manager.

Security.

Security Requirements: This section shall be considered a supplement to block 13 of the Government provided DD 254, Contract Classification Specification.

References:

a. DOD 5200.2-R, DOD Personnel Security Program.

b. DISAI 240-110-36, Personnel Security.

c. DOD 5220.22-M, National Industrial Security Program Operating Manual.

d. DOD 5220.22-R, Industrial Security Regulation.

e. DISA Computing Services Directorate (CSD) Security Handbook.

Facility Security Clearance. The work to be performed under this contract is up to and including the Secret level and positions are IT-I for systems access. Therefore the company must have a final or interim Secret Facility Clearance (FCL) from the Defense Industrial Security Clearance Office (DISCO).

Security Clearance and Information Technology (IT) Level. All personnel performing on this contract will be U.S. citizens. Contract employees require a minimum of interim Secret security clearance and interim IT-I eligibility when performance starts.

Investigation Requirements. Personnel performing duties under this contract must undergo a favorably adjudicated Single Scope Background Investigation (SSBI) as a minimum investigation. The SSBI will be maintained current within 5-years and requests for Special Background Periodic Review (SBPR)/Phased Periodic Reinvestigation (PPR) will be initiated by DISA 6-months prior to the 5-year anniversary date of the previous SSBI, SBPR or PPR.

ITEM 13 Continuation (Page 5) Adjudication for IT Access. Adjudication of investigations for granting of interim or final IT-I access will be accomplished through DISA Personnel Security. An exception to this is that individual contractor employees with an SSBI or SBPR (within a 5-year scope) that is already favorably adjudicated for a Top Secret or Secret security clearance by any of the Department of Defense adjudication facilities (DISCO, DIA, ACCF, AFCAF, DONCAF, WHSCAF) or other approved adjudication facilities will automatically be accepted for final IT-I access.

Interim IT Access. Pending completion of an SSBI and final adjudication for security clearance, contractor employees may be granted interim authorization to perform duties designated as IT-I. The interim authority for IT sensitive positions is the DISA Personnel Security Office. Following are the requirements, which must be met prior to granting of interim IT-I authorization:

Visit Authorization Letters/Requests. The Contractor Facility Security Officer (FSO) will forward a Visit Authorization Letter/Request (VAL/VAR) to the Contracting Officer’s Representative (COR)/Task Monitor identified in the Statement of Work (SOW)/Performance Work Statement (PWS) for all employees prior to the beginning of each contracting/task order period of performance and as new contractor employees are assigned to the contract.

The VAL/VAR should be sent via one of two methods. The preferred method is to e-mail the VAL/VAR to the COR. Because it contains sensitive information covered by the Privacy Act, the VAL/VAR should be sent using in a locked “Zip” file in one e-mail and then followed-up by another e-mail with the password to unlock the Zipped file. The alternative method to transmit the VAL/VAR is via facsimile (Fax) to the COR. Prior coordination with the COR should be made via phone to ensure the method of transmission is agreed upon and properly secure.

The VAL/VAR shall be on company letterhead or pre-fabricated form and contain the following information:

Contract number with start and end dates (period of performance)

Government Task Monitor name and telephone number

Complete legal name of employee(s)

Social Security Number (Full SSN required)

Citizenship of the individual

Date and place of birth (state)

Individual’s security clearance level, date granted, adjudication facility name, e.g. DISCO

Type of personnel security investigation (PSI) pending or completed e.g. ANACI, SSBI Date PSI closed/completed

Individual’s e-mail address

FCL and Commercial and Government Entity (CAGE) Code

Name, title, phone, e-mail address and signature of cognizant official who certifies the authenticity of the individual/facility clearance data found on the VAR/VAL. The certifying official may NOT be anyone listed on the VAR/VAL.

The COR will forward the VAR/VAL to DISA Mechanicsburg (Mech) Security for review and verification. Once verified, DISA Mech Security submits a request for investigative service to DISA Security Personnel.

-The request for SSBI, thru e-QIP, must be submitted by DISA Personnel Security to the Office of Personnel Management (OPM). The contracting company WILL NOT submit contractors for Secret IT-I contracts. The e-QIP will be initiated and reviewed by DISA Personnel Security and approved for Interim access if the contractor has a previously favorable NAC and a favorably reviewed SSBI e-QIP. If the contractor DOES NOT have a previously favorable NAC the e-QIP will be reviewed, if there are issues on the case the process will stop and the contracting company will supply a new contractor to fill the position. If the case has no issues it will be submitted to OPM. Once the NAC portion closes FAVORABLY, an Interim IT-I will be granted. This ITEM 13 Continuation (Page 6) process takes approximately 2-4 weeks once submitted to OPM. If at any time there are issues on the NAC portion of the SSBI, the investigation will be cancelled and a new contractor will be supplied by the company.

For contractors that are submitting SBPR’s or SSBI’s that have a previously favorable NAC and have a new issue reflected on the e-QIP that is submitted to DISA, each case will be reviewed and approved or found ineligible by DISA Personnel Security on a case by case basis.

-All new contractor employees are not cleared to report for work until they are cleared through DISA Mech Security.

DISA Mechanicsburg Security Point of Contacts

Security Manager (SM): Brian Earnshaw, phone (717) 605-5031 (DSN 430) Alternate SM/Personnel Security Specialist: Cathy Cohen, phone (717) 605-6882 (DSN 430) Defense Information Systems Agency (DISA) DECC MECH

ATTN: CSD/CDB32, DECC MECH Security

5450 Carlisle Pike, P.O. Box 2045

Mechanicsburg, PA 17050-0975

DISA Security Personnel Point of Contacts - Can be contacted for security related questions:

For Industrial Security related issues:

Primary: Terry Scott, phone (301) 225-1229 (DSN 375) Defense Information Systems Agency

ATTN: MPS61, Industrial Security

6910 Cooper Avenue

Ft. Meade, MD 20755-7088

For Personnel Security related issues to include interim IT access requests:

Primary: Anni Otis, phone: (301) 225-1612 (DSN 375) Alternate: Vernon Rhodes, phone: (301) 225-1532 (DSN 375)

Regular

UPS/Fedex

DISA

HQS Complex

DISA HQS Complex

Attn: MPS62, Personnel Security, Anni Otis

Attn: MPS62, Personnel Security, Anni Otis

P.O. Box 549

6910 Cooper Avenue

Fort Meade, MD 20755-0549

Ft Meade, MD 20755-7088 Physical, Information and other Miscellaneous Security Requirements. Contractor personnel must comply with local security requirements for entry and exit control for personnel and property at the government facility.

Contractor employees will be required to comply with all Government security regulations and requirements. Initial and periodic security training and briefings will be provided by Government security personnel. Failure to comply with security requirements can be cause for termination of employment.

The Contractor shall not divulge any information about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government. The reason for removal will be fully documented in writing by the Contracting Officer (CO). When and if such removal occurs, the contractor shall, within 15 working days, assign qualified personnel to the vacancy(ies) thus created.