Atch_4_DD_254.docx

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

TOP SECRET

b. LEVEL OF SAFEGUARDING REQUIRED

SECRET

2013-02-21

all previous specs) Revision No.

DATE (YYYYMMDD)

TBD

DUE DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? |X| YES |_| NO. If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on to HC102810C2015

5. IS THIS A FINAL DD FORM 254? |_| YES |X| NO. If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR

8. ACTUAL PERFORMANCE

Defense Information Systems Agency 6914 Cooper Avenue Fort Meade, MD 20755

7556 Teague Road Ste 580 Hanover MD 21076

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

The objective of this procurement is to develop an IA Audit Management operational pilot focused on web application logs.

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

X

b. RESTRICTED DATA

X

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

d. FORMERLY RESTRICTED DATA

e. INTELLIGENCE INFORMATION:

e. PERFORM SERVICES ONLY

X

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFOR-MATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

X

f. SPECIAL ACCESS INFORMATION

g. NATO INFORMATION

X

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

X

l. OTHER (Specify)

k. OTHER (Specify)

IT-I and IT-II access required.

Stand alone and SIPRNet AIS and Connection Required

DD Form 254, DEC 1999 (EF) PREVIOUS EDITIONS ARE OBSOLETE

12. PUBLIC RELEASE. Any Information (Classified Or Unclassified) Pertaining To This Contract Shall Not Be Released For Public Dissemination Except As Provided By The Industrial Security Manual Or Unless It Has Been Approved For Public Release By Appropriate U.S. Government Authority. Proposed Public Releases Shall Be Submitted For Approval Prior To Release |_| Direct |X| Through (Specify): Through the Contracting Officer, and the Defense Information Systems Agency (DISA) Public Affairs Office (PAO); and, for Congressional correspondence, the DISA Congressional Affairs (CA) office.

- PUBLIC RELEASE OF SCI IS NOT AUTHORIZED -

to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs) * for review.

* In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

Reference Block 10a: Contractor is authorized to receive Government furnished cryptographic equipment. Access to classified COMSEC information requires a final U.S. Government clearance at the appropriate level. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires prior approval of the government contracting activity. Non-accountable COMSEC information, though not tracked in the COMSEC material control system, may still require a level or control within a document control system. Refer to NSA/CSS Manual 3-16, Control of Communications Security Material, page E-4 for guidance.

Reference Item 10e(1): This contract requires access to SCI.

a. The number of personnel required to have access to SCI is determined by the COR/TM and the DISA SSO.

b. The Director, Defense Intelligence Agency (DIA) and Director, Defense Information Systems Agency (DISA), as the executive agent for DIA, have exclusive security responsibility for SCI released to the contractor or developed under this contract.

c. Contractor generated or Government furnished material may not be provided to the Defense Technical Information Center. Contract generated technical reports will bear the statement ‘Not Releasable to the Defense Technical Information Center per DoD Instruction 5230.24.’

d. All contractor personnel requiring access to SCI information must: be U.S. citizens, have been granted a final DCID 6/4 security clearance by the U.S. Government, and have been indoctrinated for the applicable compartments of SCI access prior to being given any access to such information released or generated under this contract.

f. SCI received under this contract may not be released to subcontractors without permission of the DISA SSO.

--------------- See Continuation Sheet --------------------------------

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use item 13 if additional space is needed.)

|X| YES |_| NO

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use item 13 if additional space is needed.)

The DISA Security Office (MPS6) is responsible for inspection of SCI under this contract.

|_| YES |X| NO

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

Defense Information Systems Agency

ATTN: PEO-MA IA3

6914 Cooper Avenue Fort Meade, MD 20755

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD Form 254 (BACK), DEC 1999