DISA_DD254.pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

b. LEVEL OF SAFEGUARDING REQUIRED

2. THIS SPECIFICATION IS FOR: (X and complete as applicable)

a. PRIME CONTRACT NUMBER

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable)

a. ORIGINAL (Complete date in all cases)

REVISION NO.

c. FINAL (Complete Item 5 in all cases)

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specs)

DATE (YYYYMMDD)

DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

10. CONTRACTOR WILL REQUIRE ACCESS TO: 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL:YES NO YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

d. FORMERLY RESTRICTED DATA

e. INTELLIGENCE INFORMATION

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

f. SPECIAL ACCESS INFORMATION

g. NATO INFORMATION

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

j. FOR OFFICIAL USE ONLY INFORMATION

k. OTHER (Specify)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE TEMPEST REQUIREMENTS

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

l. OTHER (Specify)

DD FORM 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE.

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release

a. TYPED NAME OF CERTIFYING OFFICIAL

Direct Through (Specify)

d. ADDRESS (Include Zip Code)

Yes No to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classifiection guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract.

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office.

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

b. TITLE c. TELEPHONE (Include Area Code)

e. SIGNATURE

17. REQUIRED DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD FORM 254 (BACK), DEC 1999

DD FORM 254, SECURITY SIGNATURE PAGE

PRIME CONTRACT NUMBER:

SUBCONTRACT NUMBER: _

CERTIFICATION AND SIGNATURES: “Security requirement stated herein are completed and adequate for safeguarding the classified information to be release or generated under this classified effort. All questions shall be referred to the official named below.”

Security Office Approval

Name:

Title:

Security Office Approval

DISA Congressional Affairs (CA) office. Public release is not authorized.

a. Reference Block 8a. Location. Contract Performance is restricted to the Joint Interoperability Test Command (JITC), 2001 Brainard Rd, Fort Huachuca, AZ; JITC, Fort Meade, MD. Additional locations including overseas sites to be added upon individual task awards. The using contractor or Government activity will provide security classification guidance for the performance of this contract.

b. Reference Block 10e(1) Sensitive Compartmented Information (SCI). This contract requires access to SCI.

(1) The number of personnel required to access SCI is determined by the COR and the DISA SSO.

(2) The Director, Defense Intelligence Agency (DIA) and Director, Defense Information Systems Agency (DISA), as the executive agent for DIA, have exclusive security responsibility for SCI released to the contractor or developed under this contract.

(3) Contractor generated or Government furnished material may not be provided to the Defense Technical Information Center (DTIC). Contract generated technical reports will bear the statement ‘Not Releasable to the DTIC per DoD Instruction 5230.24.

(4) All contractor personnel requiring access to SCI information must: be U.S. citizens, have been granted a final ICD 704 security clearance by the U.S. Government, and have been indoctrinated for the applicable compartments of SCI access prior to being given any access to such information released or generated under this contract. A counterintelligence polygraph is required for access to certain SCI information systems.

(BLOCK-13., CONTINUED ON PAGE 3/6)

(BLOCK-14., CONTINUED ON PAGE 5/6)

P.O. Box 12798, Fort Huachuca, AZ 85670-2987

(7) Due to access requirements of this contract the following training is required by contractor employees prior to accessing classified information. The contractor is responsible for completing DoD, DISA, JITC, and local installation mandated training requirements in the performance of the contract. The JITC training office provides access to all training sources and contractors are encouraged to attend training opportunities provided. The contractor Training Coordinator, Facility Security Officer, or designated representative is responsible to ensure employees meet training requirements.

(a) Annual Standard Operating Procedure (SOP) review.

(b) Derivative Classification (Defense Security Service Course IF103.16) - Prerequisite for access to classified information/systems, and classified open storage areas.

(c) Marking Classified Documents (Defense Security Service Course IF105.16) - Prerequisite for access to classified information/systems, and classified open storage areas.

(d) Antiterrorism Level-I

f. Reference Block 11a.

(1) Contract performance is restricted to locations list in Block-8. The using contractor or government activity will provide security classification guidance for the performance of this contract.

(2) The COR must be notified and approve the receipt and/or generation of classified information under this contract.

(3) All classified information received or generated under this contract is the property of the U.S. Government regardless of proprietary claims. Upon completion/termination of this contract, the COR will be contacted for destruction/disposition guidance.

g. Reference Block 11f: Contractors when performing or traveling outside the United States under this contract will:

a) All personnel will obtain an AOR specific foreign travel brief within 90 days of travel and will provide proof of training to the COR/TM.

b) All personnel will receive the Antiterrorism Level I Awareness training within one year prior to travel.

h. Reference Block 11g. Contractor is authorized to use the services of the DTIC or other secondary distribution center.

(1) Technical information on file at the Defense Technical Information Center will be made available to the contractor if the contractor requires such information.

(2) Contractor prepares/submits a DD Form 1540 to the COR for authorization BEFORE the services may be requested.

(3) Use of DTIC is not authorized for Special Access Program (SAP) performance.

i. Reference Block 11l.

(1) Information Technology (IT) Level-I and Level-II access required. IT Level-I requires at least a T5/T5R (formerly SSBI/SBPR) investigation. IT Level-II requires at least a T3/T3R (formerly NACLC/ANACI) investigation. Reference OPM Federal Investigations Notice No. 162, October 6, 2015.

(2) Provide Visit Authorization Requests. All classified visit authorization request (VAR) by contractors shall be submitted to the JITC COR for approval and need-to-know certification before being sent to the JITC facility to be visited. VAR content: Company Name, Address, Cage Code, Contract Number, Facility Security Officer (FSO)’s Name/Phone/Signature, Task Number the employee will work, employee identification data (SSN, Name, DoB, PoB [city/state], citizenship), clearance data (clearance level, clearance date, granting agency, investigation type, investigation date, investigation agency). VAR content contains PII/FOUO information and must be submitted via encrypted email or U.S. Postal Service. VARs for access to JITC activities will be addressed to Commander, Joint Interoperability Test Command, JT2D, P.O. Box 12798, Fort Huachuca, AZ 85670

(CONTINUED ON PAGE 5/6

13_cont1: (CONTINUED FROM PAGE 2/6)

b. Reference Block 10e(1) SCI. This contract requires access to SCI.

(5) Classified material released or generated under this contract is not releasable to foreign nationals without the expressed written permission of the Director, DISA (through the DISA SSO) and Director, DIA.

(6) SCI received under this contract may not be released to subcontractors without permission of the DISA SSO.

(7) The contractor and COR will re-validate all SCI billets under this contract with the DISA SSO annually or when a revised DD254 issued.

(8) All SCI visit requests by contractors shall be forwarded to the COR for approval and need-to-know certification before being sent through the DISA SSO to the facility to be visited.

c. Reference Block 10g. Access up to and including NATO Secret material is required at JITC sites (Reference Block 8a.)

d. Reference Block 10j. Contractor will abide by DoD 5400.7, DoD Freedom of Information Act Program and DoDM 5200.01, Vol-1 to IV, DoD Information Security Program.

e. Reference Block 10k. OTHER.

(1) Access to SIPRNet and JWICS is required at the Government Facility.

(2) Access to DISA-JITC Controlled Access Areas (CAA) is required in accordance with DISA Instruction 240-110-33, Physical Security. JITC Facilities and all buildings designated as JITC space are classified as CAAs. Employees designated to work in JITC spaces shall obtain and maintain eligibility for access to a minimum of SECRET information.

(3) Contractor employees must have at least an interim secret security clearance to perform on DISA-JITC contracts. Per DoD USD-I Policy Memo, Subject: Minimum Requirements for Interim Eligibility to Access to Secret or Confidential Classified Information, dated 27Jan2014, the minimum requirements for interim Secret eligibility are:

(a) Acceptable proof of citizenship. Industry employees under DoD Security cognizance will provide proof of citizenship as specified in DoD 52220.22-M, National Industrial Security Program Operating Manual (NISPOM).

(b) Favorable review of a completed Standard Form 86, Questionnaire for National Security Programs.

(c) Favorable review of local personnel, base, military police, medical, and security records as applicable.

(d) An appropriate investigation opened by the Investigative Service Provider.

(e) Favorable review of FBI Criminal History Report (fingerprint results).

(4) Contractor employees who do not have a security clearance due to revocation, denial or withdrawal will not be eligible to work on this DISA contract whether as a prime or sub contractor. The KO will issue notice to the contractor of any security eligibility violations and denial of an employee's ability to work under the contract.

(5) All contractor employees must obtain and maintain eligibility for IT access. The minimum IT level access required for contractors will be IT-II.

(6) All classified information processed under this contract is the property of the U.S. Government.

(a) Detailed Security Classification Guides will be provided under separate cover.

(b) The COR must be notified and approve the receipt and/or generation of classified information under this contract.

(c) The contractor will be required to prepare an Automated Information System Standard Practice Procedure (AIS/SPP) for their classified AIS operations and the system will require approval of the CSO/CSA IAW NISPOM, Chapter 8.

(d) Upon contract termination/expiration, the U.S. Government will be contacted for disposition.

(CONTINUED ON PAGE 4/6)

(3) VAR may not exceed 1-year or the length of the contract whichever is shorter.

(4) If a non-U.S. citizen requires access to classified information they may be submitted for a Limited Access Authorization (LAA) no higher than the Secret Level. LAAs are utilized for contractor employee with unusual expertise that cannot be performed by another employee with U.S. citizenship in sufficient time to fulfill contractual requirements.

j. Reference Block 13 Security Guidance.

(1) The National Industrial Security Program Security Manual, DoD 5220.22-M, applies to this contract.

(2) Reference Blocks 10f. This contract will be performed in a facility approved through the DISA Security Office (MPS6) and/or the SAP Management Office in accordance with applicable SAP security requirements. The Defense Security Service is relieved of security cognizance by the SAP Management Office, which will have responsibility for all SAP material and/or information released under this contract.

k. Reference Block 14 Additional Security Requirements.

(1) When SCI or SAP task are sub-contracted, the sub-contractor DD254 must be sent to the DISA Industrial Security PM and be processed through the DISA SSO and or Program Security Officer for approval.

(2) Contractor will abide by DCID 6/6 (formerly 1/7), Security Controls on Dissemination of Intelligence Information. Provided under separate cover.

///// END OF DD254, JITC TEC-SVS (DRAFT), 11Jan16. PAGE 6/6 contains DISA Security Signatures. /////

Provide Visit Authorization Requests.