Attachment 18 - DESS DD254 20120427 0730.doc

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

Top Secret

b. LEVEL OF SAFEGUARDING REQUIRED

None

FORMCHECKBOX

a. PRIME CONTRACT NUMBER

FORMCHECKBOX

20120322

FORMCHECKBOX

b. SUBCONTRACT NUMBER

FORMCHECKBOX

b. REVISED (Supersedes all previous specs) Revision No.

DATE (YYYYMMDD)

FORMCHECKBOX

c. SOLICITATION OR OTHER NUMBER

HC1047-12-R-4013

DUE DATE (YYYYMMDD)

FORMCHECKBOX

4. IS THIS A FOLLOW-ON CONTRACT?

FORMCHECKBOX

YES

b FORMCHECKBOX

NO.

If yes, complete the following:

Classified material received or generated under HC1047-09-D-0001 (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254?

FORMCHECKBOX

YES

FORMCHECKBOX

NO.

If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR

8. ACTUAL PERFORMANCE

Defense Information Systems Agency, Headquarters (DISA, HQS) P. O. Box 549

Fort George Meade, Maryland 20755-0549

P.O. Box 549

Fort George Meade, Maryland 20781

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Defense Information Systems Agency’s, Information Technology (IT) Enterprise Support Services (DESS) Operational Support

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

X

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

X

d. FORMERLY RESTRICTED DATA

X

e. INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI) X

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

X

(2) Non-SCI x

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFOR-MATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

X

f. SPECIAL ACCESS INFORMATION

X

i. HAVE TEMPEST REQUIREMENTS

X

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

j. FOR OFFICIAL USE ONLYINFORMATION

X

l. OTHER (Specify)

IT Level I/II Access

IAT Level II/III Certification

k. OTHER (Specify)

X x

DD Form 254, DEC 1999 (EF)

PREVIOUS EDITIONS ARE OBSOLETE

12. PUBLIC RELEASE. Any Information (Classified Or Unclassified) Pertaining To This Contract Shall Not Be Released For Public Dissemination Except As Provided By The Industrial Security Manual Or Unless It Has Been Approved For Public Release By Appropriate U.S. Government Authority. Proposed Public Releases Shall Be Submitted For Approval Prior To Release

FORMCHECKBOX

Direct x FORMCHECKBOX

Through (Specify):

Public release of SCI/SAP materials in not authorized.

DISA Public Affairs Office: PO Box 549, Ft. George Meade, MD 207055-0549

DISA- Contracts Office, PLD62, Christopher Gray (CS)/Edward Shannon Frank (KO), P.O. Box 549, Ft. George Meade, MD 20755-0549 Program Office, CI71 (CIO), , Christian Williams (COR), P.O. 549, Ft, George Meade, MD 20755-0549 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs) * for review.

* In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

Reference Item 10e(1): This Contract requires access to SCI.

a. The number of personnel required to have access to SCI is determined by the COR/TM and the DISA SSO.

b. The Director, Defense Intelligence Agency (DIA) and Director, DISA, as the executive agents for DIA, have exclusive security responsibility for SCI released to the contractor or developed under this contract

c. Contractor generated or Government furnished material may not be provided to the Defense Technical Information Center (DTIC). Contract generated technical reports will bear the statement ‘Not Releasable to the Defense Technical Information Center per DoD Instruction 5230.24.’

d. All contractor personnel requiring access to SCI information must: be U.S. citizens, have been granted a final Top Secret security clearance by the U.S. Government, have been approved as meeting ICD 704 criteria by a Government Cognizant Security Agency, and have been indoctrinated for the applicable compartments of SCI access prior to being given any access to such information released or generated under this contract. Immigrant aliens, personnel cleared on an interim basis, or personnel holding contractor granted CONFIDENTIAL clearances, are not eligible for access to classified information released or generated under this contract without the expressed permission of the Director, DISA (through the DISA Security Division SSO (MPS62)) and the Director, DIA.

e. Classified material released or generated under this contract is not releasable to foreign nationals without the expressed written permission of the Director, DISA (SSO) and Director, DIA.

f. Recipients of SCI under this contract may not be released to subcontractors without permission of the DISA SSO.

g. The Program Manager and COR will revalidate all SCI billets under this contract with the DISA Security Operations Division (MPS6) annually or when a revised DD254 is issued, whichever is sooner.

h. Contractor SCI work will be at the DISA, HQS facility (SCIF) or a designated Government approved SCI Facility (SCIF).

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use item 13 if additional space is needed.)

The contractor will be provided and abide by Directive of Central Intelligence Directive 6/3, “Protecting Sensitive Compartmented Information within Information Systems “, 5 June 1999 and by Directive of Central Intelligence Directive ICD 705 26 May 2010, “ Physically Security Standards for Sensitive Compartmented Information Facilities (SCIF)” 29 July 1999. Provided under separate cover.

DoD Regulation 5400.7, DoD Freedom of Information Act Program

FORMCHECKBOX

YES

FORMCHECKBOX

NO

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use item 13 if additional space is needed.)

FORMCHECKBOX

YES

FORMCHECKBOX

NO

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

Defense Information Systems Agency (DISA), HQS P.O. Box 549

Ft. George Meade, MD 20755-0549

b. SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

DD Form 254 (BACK), DEC 1999

Continuation Sheet –DESS IT Ops DD254

Reference Items 10g:

Access up to and including NATO SECRET material will be required for reference only at the Government facility. This means information or documents belonging to and circulated by the North Atlantic Treaty Organization (NATO). Access to NATO requires a final U.S. Government clearance at the appropriate level. A representative of the Government will brief the Facility Security Officer (FSO), who in turn will brief other contractor personnel requiring access under the contract.

Reference Item 10j:

Contractor will be provided with and will abide by DoD Regulation 5400.7, DoD Freedom of Information Program and DoD Regulation 5200.1-R Information Security Program Appendix 3. Guidance provided in Section 12 of the Defense Information Systems Agency’s Information Technology (IT) Enterprise Support Services (DESS) Operational Support.

Reference Item 10k:

Some contractor personnel performing under this contract may be required to courier classified information up to the TOP SECRET within the National Capital Region (NCR). The Program Manager will identify to the COR the individual that will require to have courier cards and the COR will identify these individuals by name up to MPS6 through the COR’s Security Manager (MPS6).

DoD 5200.2-R, DoD Personnel Security Program, requires DoD military and civilian personnel, as well as DoD consultant and contractor personnel, who perform work on sensitive automated information systems (ISs), to be assigned to positions which are designated at one of two sensitivity levels (ADP I or ADPII). These designations equate to Critical Sensitive, Non-critical Sensitive. The contractor will assure that individuals assigned to the following sensitive positions, as determined by the Government, have completed the appropriate forms.

The required investigation will be completed prior to the assignment of individuals to sensitive duties associated with the position. The contractor will forward their employee clearance information (completed SF 85P, Questionnaire for Positions of Public Trust, and two DD Forms 258 (Fingerprint cards) to: DISA Security Division (MPS6); ATTN: Personnel Security (MPS62); PO Box 549, Ft. George Meade, MD 20755-0549 DISA retains the right to request removal of contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interests of the Government. The reason for removal will be fully documented in writing by the Contracting Officer. When and if such removal occurs, the contractor will within [specify number of days] working days assign qualified personnel to any vacancy (ies) thus created.

Reference Item 11a:

Classified performance is restricted to those locations identified in Section 7 of the Defense Information Systems Agency’s, Information Technology (IT) Enterprise Support Services (DESS) Operational Support requirement. All applicable provisions of DoD 5220.22M, National Industrial Security Program Operating Manual (NISPOM). Security classification guidelines will be provided to assigned individual contractors by the cognizant security office at the site locations as identified in Section 8, pervious page. The using contractor or Government activity will provide security classification guidance for the performance of this contract.

Specifically designated contractor personnel assigned to this contract must possess DoD-granted personnel security clearance commensurate with the level of access required. Contractors requesting a non-secure network account must have successfully completed a security investigation IAW the NISPOM, January 1995. Individual exceptions will be handled between the government facility and contractor.

Contractor performance is restricted at the DISA, Headquarters location, P.O. Box 549, Ft. George Meade, MD 207055, unless otherwise specified in the task order.

Need-to-know certification for visit requests to their DoD and U.S. Federal Government Facilities, or for obtaining documentation or information, will be processed by the processed by the cognizant security office, as identified in item 8c. previous page. All visit authorization letters will be submitted to the cognizant security office, as identified in item 8c previous page.

Reference Item 11I:

IT-I Access Required/ IT-II Access Required

DoD 5200-2.R, DoD Personnel Security Program, requires DoD military and civilian personnel, as we as DoD consultant and contractor personnel who perform work on sensitive automated information systems (ISs), to be assigned to positions which are designated at one of two sensitivity levels (IT-I, IT-II). These designations equate to Critical Sensitive, Non-Critical Sensitive as determined by the Government have completed the appropriated forms.

The required investigation (SSBI or PTSBI for IT-I and NACLC, NACI, ANACI, or NAC for IT-II) will be completed prior to the assignment of individuals to sensitive duties associated with the position. The contractor will follow their employee clearance information (completed SF85P, Questionnaire for Positions of Public Trust, and two DD Forms 258 (Fingerprint cards) to: DISA Security Division (MPS6); ATTN: Personnel Security (MPS62); PO Box 549, Ft. George Meade, MD 20755-0549 Reference Item 11e:

The purpose of this acquisition effort is to provide contractor support to implement and maintain that portion of the DISA Information System Infrastructure over which the DISA Information Systems Center (DISC) has operational responsibility, to be known as the Defense Information Systems Agency’s, Information Technology (IT) Enterprise Support Services (DESS) Operational Support Classified material is not generated or maintained by the contractor. Security clearance is required due to access to DISA facilities and network information systems.