HC1028-15-R-0025_ATTCH_J-5_DD254.doc

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

None required

b. LEVEL OF SAFEGUARDING REQUIRED

None required

FORMCHECKBOX

a. PRIME CONTRACT NUMBER

FORMCHECKBOX

2014/06/23

FORMCHECKBOX

b. SUBCONTRACT NUMBER

FORMCHECKBOX

b. REVISED (Supersedes all previous specs) Revision No.

DATE (YYYYMMDD)

FORMCHECKBOX

c. SOLICITATION OR OTHER NUMBER

HC1028-15-R-0025

DUE DATE (YYYYMMDD)

FORMCHECKBOX

4. IS THIS A FOLLOW-ON CONTRACT?

FORMCHECKBOX

YES

FORMCHECKBOX

NO.

If yes, complete the following:

Classified material received or generated under HC1013-06-D-2005 (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254?

FORMCHECKBOX

YES

FORMCHECKBOX

NO.

If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR

8. ACTUAL PERFORMANCE

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

The Defense Commissary Agency’s (DeCA) requirements for replacement commercial off-the-shelf (COTS) point-of-sale (POS) hardware. The Commissary Advanced Resale Transaction System Replacement/Modernization (CARTS R/M) program will replace DeCA’s current POS hardware.

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

X

b. RESTRICTED DATA

X

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

X

d. FORMERLY RESTRICTED DATA

X

e. INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

X

(2) Non-SCI

X

f. SPECIAL ACCESS INFORMATION

X

g. NATO INFORMATION

X

h. FOREIGN GOVERNMENT INFORMATION

X

i. LIMITED DISSEMINATION INFORMATION

X

j. FOR OFFICIAL USE ONLYINFORMATION

k. OTHER (Specify)

DD Form 254, DEC 1999 (EF)

PREVIOUS EDITIONS ARE OBSOLETE

12. PUBLIC RELEASE. Any Information (Classified Or Unclassified) Pertaining To This Contract Shall Not Be Released For Public Dissemination Except As Provided By The Industrial Security Manual Or Unless It Has Been Approved For Public Release By Appropriate U.S. Government Authority. Proposed Public Releases Shall Be Submitted For Approval Prior To Release

FORMCHECKBOX

Direct

FORMCHECKBOX

Through (Specify):

to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs) * for review.

* In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

All contractor personnel with access to government computer systems will meet the requirements of DoD 5200.2R as implemented by DeCA. Each support position that the contractor staffs will be classified as to its sensitivity. Personnel must receive a favorable investigation commensurate with their level of access based on position sensitivity. A copy of DoD 5200.2R can be found on the DoD website at www.dtic.mil/whs/directives/corres/pub1.html. Access to classified information is not required. Examples of positions requiring access and appropriate IT level are:

· Systems Administrators: include, but are not limited to, personnel with access to root passwords, system security, information security officers, file access controls, system problem solving, or other key functions. These are critical sensitive positions that require IT Level I certification.

· Programmers – include programmers, system analysts, or other designers involved in the development, maintenance, or upkeep of software where there is a relatively high potential for causing grave damage to government computer systems. These are critical sensitive positions that require IT Level I certification. Required only for custom programming to meet any DeCA-specific requirements (not development and maintenance of the existing commercial off-the-shelf point-of-sale system).

· Operators – include console operators, maintenance personnel, supervised personnel with duties involving diagnosing and correcting systems problems, program library maintenance personnel, and others with similar duties that do not have access to root passwords and other critical data. These are non-critical sensitive positions that require IT Level II certification.

Investigations required for the above positions are:

· IT-I Single Scope Background Investigation (SSBI)

· IT-II National Agency Check with Law and Credit Checks (NACLAC)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use item 13 if additional space is needed.)

FORMCHECKBOX

YES

FORMCHECKBOX

NO

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use item 13 if additional space is needed.)

FORMCHECKBOX

YES

FORMCHECKBOX

NO

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

b. SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

DD Form 254 (BACK), DEC 1999