Attachment 4 - Form DD254.pdf

DD Form 254, DEC 1999 (EF) PREVIOUS EDITIONS ARE OBSOLETE

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

Secret

b. LEVEL OF SAFEGUARDING REQUIRED

Secret

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER

a. ORIGINAL (Complete date in all cases)

DATE (YYYYMMDD)

20120423

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs)

Revision No.

c. SOLICITATION OR OTHER NUMBER

HC1047-12-R-4031

DUE DATE (YYYYMMDD)

c. FINAL (Complete item 5 in all cases)

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES NO. If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and ZIP Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and ZIP Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and ZIP Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Contractor Engineering and Software Support

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION X

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

X

b. RESTRICTED DATA X b. RECEIVE CLASSIFIED DOCUMENTS ONLY X

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION X c. RECEIVE AND GENERATE CLASSIFIED MATERIAL X

d. FORMERLY RESTRICTED DATA X d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE X

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY X

(1) Sensitive Compartmented Information (SCI) X

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

X

(2) Non-SCI X

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFOR-

MATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

X

f. SPECIAL ACCESS INFORMATION X h. REQUIRE A COMSEC ACCOUNT X

g. NATO INFORMATION X i. HAVE TEMPEST REQUIREMENTS X

h. FOREIGN GOVERNMENT INFORMATION X j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS X

i. LIMITED DISSEMINATION INFORMATION X k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE X

j. FOR OFFICIAL USE ONLYINFORMATION X l. OTHER (Specify)

k. OTHER (Specify)

IT ACCESS

X DFARS 204.404-70 “Disclosure of Information”

12. PUBLIC RELEASE. Any Information (Classified Or Unclassified) Pertaining To This Contract Shall Not Be Released For Public Dissemination Except As Provided By The Industrial Security Manual Or Unless It Has Been Approved For Public Release By Appropriate U.S. Government Authority. Proposed Public Releases Shall Be Submitted For Approval Prior To Release

Direct Through (Specify): Director, Spectrum Enterprise Services, 2004 Turbot Landing, Annapolis, MD 21402-5064, to DISA

CIO

to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs) * for review.

* In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

A. Referenced Documents: See Appendix A.

B. Acronyms: See Appendix B.

C. Program Manager: _________________________________________ Robert L. Schneider Director, Spectrum Enterprise Services DSN 281-4958 or (410) 293-4958

D. Contract Expiration Date: Basic Period of Contract ends _____________________.

E. Pre-award access is not required, however, the awarded contractor is required to have access to perform duties by the completion of the transition period. This DD Form 254 reflects the security requirements for the contract when awarded.

F. Specific security guides will be used for specific security classification guidance.

G. All classified visit requests by the contractor shall be forwarded to the DSO Security Manager for approval and need-to-know certification before being sent to the facility to be visited.

H. The Contracting Officer’s Representative (COR) must be notified and approve the receipt and/or generation of classified information under this contract.

I. All classified information received and or generated under this contract is the property of the U.S. Government regardless of proprietary claims. Upon completion or termination of this contract, the U.S. Government will be contacted for destruction or disposition instructions.

Item 13 is continued on additional pages.

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements.

Provide a copy of the requirements to the cognizant security office. Use item 13 if additional space is needed.)

See additional pages

YES NO

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use item 13 if additional space is needed.)

YES NO

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL b. TITLE c. TELEPHONE (Include Area Code)

Enter name of Certifying Official

d. ADDRESS (Include Zip Code) 17. REQUIRED DISTRIBUTION

Spectrum Enterprise Services 2004 Turbot Landing Annapolis, MD 21402-5064

X a. CONTRACTOR

b. SUBCONTRACTOR

X c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

X e. ADMINISTRATIVE CONTRACTING OFFICER

X f. OTHERS AS NECESSARY

DD Form 254 (BACK), DEC 1999

ITEM 13, SECURITY GUIDANCE (CONTINUED)

Reference ITEM 10b:

Access to RESTRICTED DATA requires a final U.S. Government clearance at the appropriate level.

Reference ITEM 10d:

Access to FORMERLY RESTRICTED DATA requires a final U.S. Government Clearance at the appropriate level.

Reference ITEM 10h:

Foreign Government Information will have to be protected according to appropriate Government instructions.

Reference ITEM 10j:

For Official Use Only (FOUO) Information provided under this contract shall be safeguarded as specified in DoDD

5400.7 and DISA Instruction 240-110-8.

Reference ITEM 10k:

DoD 5200.2-R, DoD Personnel Security Program, requires DoD military and civilian personnel, as well as DoD consultant and contractor personnel, who perform work on sensitive automated information systems (ISs), to be assigned to positions which are designated at one of two sensitivity levels (IT-I, IT-II). These designations equate to Critical Sensitive, Non-critical Sensitive. The contractor will assure that individuals assigned to the following sensitive positions, as determined by the Government, have completed the appropriate forms.

The required investigation will be completed prior to the assignment of individuals to sensitive duties associated with the position. The contractor will forward their employee clearance information (completed SF 85P, Questionnaire for Positions of Public Trust, and two DD Forms 258 (Fingerprint cards) to: DISA Security Division (MPS62); P.O. Box 549; Fort George G. Meade, MD 20755-0549.

DISA retains the right to request removal of contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interests of the Government. The reason for removal will be fully documented in writing by the Contracting Officer. When and if such removal occurs, the contractor will, within three (3) working days, assign qualified personnel to any vacancy(ies) thus created.

Reference ITEM 11c:

Any classified information generated in performance of this contract shall be classified according to the markings on the source material. All classified information received or generated is the property of the U.S. Government. The U.S. Government will be contacted at the expiration or termination of this contract for proper disposition instructions.

The Contractor will be required to prepare an AIS/SSP for their AIS operations and the system will require approval of the CSO/CSA in accordance with DoD 5220.22-M.

Reference ITEM 11d:

The Contractor will properly safeguard and will provide adequate and appropriate storage space for all Classified Hardware.

Reference ITEM 11g:

a. The contractor must prepare and forward DD Forms 1540 and 1541 to the COR for authorization BEFORE the services may be requested.

b. Technical information on file at the DTIC will be made available to the contractor if the contractor requires such information. The CO will certify the field of interest relating to the contract.

Reference ITEM 11j:

The contractor must adhere to and enforce US Government polices and procedures concerning Operation Security (OPSEC) requirements. OPSEC requirements will not be imposed until the DoD User Agency has finalized an OPSEC plan. Final review of the DoD User Agency OPSEC plan must be sent to, and approved by, the DISA OPSEC office.

ITEM 14, ADDITIONAL SECURITY REQUIREMENTS (CONTINUED)

A. Receive and Generate Classified material (11.c.): Any special provisions received from JSC project sponsors, DoD 5220.22-M, DoD 5200.1-R, and JSC Instruction 240-110-4 are applicable.

B. Fabricate, Modify, or Store Classified Hardware (11.d.): Typically limited to unclassified IT equipment into which classified data is placed. Occasional need to store classified hardware is conceivable. Contractor will require adequate storage facilities.

C. Have OPSEC Requirements (11.j.): OPSEC requirements are contained in the contract task orders. DFARS 252.204-7000 is applicable.

ITEM 17, REQUIRED DISTRIBUTION (CONTINUED)

17. Required Distribution (17.f.):

__X_ DISA, Industrial Security

APPENDIX A TO DD FORM 254

REFERENCED DOCUMENTS

Department of Defense Directives:

DoD 5200.1-R Information Security Program, 1 Jan 1997 DoD 5200.2-R DoD Personnel Security Program, 23 Feb 1996 DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM), 23 Feb 2006 DoDD 5230.24 Distribution Statements on Technical Documents, 18 Mar 1987 DoDD 5400.07 DoD Freedom of Information Act Program, 2 Jan 2008 DoD 5220.22-M Supp 1 National Industrial Security Program Operating Manual Supplement, Feb 1005

Defense Information Systems Agency Instructions:

DISA Instruction 240-110-8 Information Security Program, 25 Jun 2005

Joint Spectrum Center Instructions:

JSC Instruction 240-110-4 Security, 25 Aug 2000

APPENDIX B TO DD FORM 254

LIST OF ACRONYMS

AIS Automated Information System CO Contracting Officer COR Contracting Officer’s Representative CSA Cognizant Security Agency CSO Chief Security Officer DCS Defense Courier Service DISA Defense Information System Agency DTIC Defense Technical Information Center FOUO For Official Use Only IS Information Security NISPOM National Industrial Security Operating Manual OPSEC Operation Security SSP Standard Security Procedures