Attachment_5_DD254_DRAFT_v2.pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

b. LEVEL OF SAFEGUARDING REQUIRED

2. THIS SPECIFICATION IS FOR: (X and complete as applicable)

a. PRIME CONTRACT NUMBER

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable)

a. ORIGINAL (Complete date in all cases)

REVISION NO.

c. FINAL (Complete Item 5 in all cases)

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specs)

DATE (YYYYMMDD)

DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

10. CONTRACTOR WILL REQUIRE ACCESS TO: 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL:YES NO YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

d. FORMERLY RESTRICTED DATA

e. INTELLIGENCE INFORMATION

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

f. SPECIAL ACCESS INFORMATION

g. NATO INFORMATION

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

j. FOR OFFICIAL USE ONLY INFORMATION

k. OTHER (Specify)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE TEMPEST REQUIREMENTS

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

l. OTHER (Specify)

DD FORM 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE.

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release

a. TYPED NAME OF CERTIFYING OFFICIAL

Direct Through (Specify)

d. ADDRESS (Include Zip Code)

Yes No to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classifiection guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract.

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office.

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

b. TITLE c. TELEPHONE (Include Area Code)

e. SIGNATURE

17. REQUIRED DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD FORM 254 (BACK), DEC 1999

DD FORM 254, Contract TBD CONTINUED

ITEM 8, ACTUAL PERFORMANCE (CONTINUED)

a. LOCATION b. CAGE CODE

Reference ITEM 10a:

Contractor is authorized to receive Government furnished cryptographic equipment. Access to classified COMSEC information requires a final U.S. Government clearance at the appropriate level. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires prior approval of the contracting activity.

Reference ITEM 10e(1): This contract requires access to (70) SCI billets.

a. The Director, Defense Intelligence Agency (DIA) and Director, DISA, as the executive agent for DIA, have exclusive security responsibility for SCI released to the contractor or developed under this contract.

b. Contractor generated or Government furnished material may not be provided to the Defense Technical Information

Center (DTIC). Contract generated technical reports will bear the statement “Not Releasable to the Defense Technical Information Center per DoD Instruction 5230.24.”

c. All contractor personnel requiring access to SCI information must: be U.S. citizens, have been granted a final Top

Secret security clearance by the U.S. Government, have been approved as meeting DCID 6/4 criteria by a Government Cognizant Security Agency, and have been indoctrinated for the applicable compartments of SCI access prior to being given any access to such information released or generated under this contract. Immigrant aliens, personnel cleared on an interim basis, or personnel holding contractor granted CONFIDENTIAL clearances, are not eligible for access to classified information released or generated under this contract without the expressed permission of the Director, DISA (through the DISA Security Division SSO (MPS62)) and the Director, DIA.

d. Classified material released or generated under this contract is not releasable to foreign nationals without the expressed written permission of the Director, DISA (SSO) and Director, DIA.

e. Recipients of SCI under this contract may not release SCI to subcontractors without permission of the DISA SSO.

f. STE terminals installed at the contractor’s facilities shall be supported by a COMSEC account (of the contractor of

DISA).

g. The subcontractor and COR will revalidate all SCI billets under this contract with the DISA Security Operations Division (MPS6) annually or when a revised DD Form 254 is issued, whichever is sooner.

h. All contractor SCI work and access will be at a designated Government approved SCIF.

Reference ITEM 10e(1) and/or 10f:

Upon expiration of this contract, the contractor shall request disposition instructions for all classified and unclassified project material. The contractor may be directed to properly destroy the material or return it. If classified or unclassified project material is to be retained by the contractor, every effort should be taken to transfer it to a follow-on contract or similar effort, if applicable. This must be done, however, with CO approval. Unless written authorization by the CO to retain specific material for a specific period of time is received, the material shall be returned or destroyed as instructed.

Any exception to security policy shall be referred to the CSO/DISA Security Division (MPS6) for coordination with the appropriate agencies and the contracting officer.

Reference ITEM 10f:

To execute this contract, additional security requirements in DoD 5220.22-M Sup 1 will be required. Additional security requirements may be established by the SAP program manager. The contractor shall comply with the security provisions of these programs. Marking and/or classification guidance for material originated or generated under this contract will be provided through the DISA Security Operations Division (MPS6) under separate cover. Any material generated by the contractor (including correspondence, drawings, models, mockups, photographs, schematics, progress, special and inspection reports, engineering notes, computations and training aids) shall be classified according to content. Guidance for classification shall be derived from the applicable Security Classification Guides, Government furnished equipment or data, or special instructions. Such material shall not contain contractor logos or similar identifiers that identify the specific contractor or team members.

The Contractor Special Security Officers (CSSOs) shall coordinate with the DISA Security Division (MPS6) prior to subcontracting any portion of this contract.

a. All personnel requiring access to SAP information must be: U.S. citizens, have been granted a final Top Secret U.S.

Government security clearance, have been approved as meeting DCID 1/14 criteria by a Government cognizant authority, and been indoctrinated for the applicable SAP prior to being given access to such information generated or received under this contract. Immigrant aliens, interim cleared personnel or personnel holding a contractor granted CONFIDENTIAL clearance are not eligible for access to classified information released or generated under this contract without the expressed written permission of the DISA Security Division (MPS6), SSO.

b. Contractor generated or Government furnished material may not be provided to the DTIC. Contractor generated reports will bear the statement: “Not Releasable to the Defense Technical Information Center per DoD Instruction 5230.24”.

Reference ITEM 10f and 11c:

This contract will be performed in a facility approved through the DISA Security Division (MPS6) in accordance with applicable SAP security requirements. The CSO (DSS) may be relieved of security cognizance for the SAP by the DISA Security Division (MPS6) and/or the SAP PMO which will have responsibility for all SAP material or information released to the contractor under this contract.

Reference ITEM 10g:

Access up to and including NATO SECRET material will be required. The contractor will hold NATO reference material at the ITT Bowie facility to support JSC activities. When access to the materials is required, the requested materials will be couriered to the JSC facility and accessed at the JSC.

Reference ITEM 10h:

Foreign Government Information will have to be protected according to appropriate Government instructions.

Reference ITEM 10k:

DoD 5200.2-R, DoD Personnel Security Program, requires DoD military and civilian personnel, as well as DoD consultant and contractor personnel, who perform work on sensitive automated information systems (ISs), to be assigned to positions which are designated at one of two sensitivity levels (IT-I, IT-II). These designations equate to Critical Sensitive, Non-critical Sensitive. The contractor will assure that individuals assigned to sensitive positions, as determined by the Government, have completed the appropriate forms.

The required investigation will be completed prior to the assignment of individuals to sensitive duties associated with the position. The contractor will forward their employee clearance information (completed SF 85P, Questionnaire for Positions of Public Trust, and two DD Forms 258 (Fingerprint cards) to: DISA Security Division (MPS62); P.O. Box 549;

Fort George G. Meade, MD 20755-0549.

DISA retains the right to request removal of contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interests of the Government. The reason for removal will be fully documented in writing by the Contracting Officer. When and if such removal occurs, the contractor will, within three (3) working days, assign qualified personnel to any vacancy(ies) thus created.

Reference ITEM 11c:

Any classified information generated in performance of this contract shall be classified according to the markings on the source material. All classified information received or generated is the property of the U.S. Government. The U.S.

Government will be contacted at the expiration or termination of this contract for proper disposition instructions.

The Contractor will be required to prepare an AIS/SSP for their AIS operations and the system will require approval of the CSO/CSA in accordance with DoD 5220.22M.

Reference ITEM 11d:

The Contractor will properly safeguard and will provide adequate and appropriate storage space for all Classified Hardware. Restricted and or Closed Areas will be required (approximately 15,000 square feet).

Reference ITEM 11f:

The Contractor and its subcontractors, when performing or traveling outside the United States under this contract shall:

a. Affiliate with the Overseas Security Advisory Council, if the Contractor or subcontractor is a U.S. entity;

b. Ensure personnel who are in-country on a non-transitory basis, register with the U.S. Embassy, and that Contractor and subcontractor personnel who are third country nationals comply with any security related requirements of the Embassy of their nationality;

c. All personnel will be provided with antiterrorism/force protection awareness information commensurate with that which the DoD provides to its military and civilian personnel, to the extent such information can be made available prior to travel outside the United States.

d. Obtain and comply with the most current antiterrorism/force protection guidance for Contractor personnel.

List of Overseas Locations: Various US military installations worldwide. (Multiple Sites Globally)

Reference ITEM 11g:

a. The contractor must prepare and forward DD Forms 1540 and 1541 to the COR for authorization BEFORE the services may be requested.

b. Technical information on file at the DTIC will be made available to the contractor if the contractor requires such information. The CO will certify the field of interest relating to the contract.

Reference ITEM 11h:

Contractor is authorized to receive Government furnished cryptographic equipment. Access to classified COMSEC information requires a final U.S. Government clearance at the appropriate level. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires prior approval of the contracting activity.

Reference ITEM 11i:

The contractor shall not process classified information by electrical means prior to a DISA TEMPEST evaluation of the equipment/systems and facility, and written DISA certification that the facility meets DISA TEMPEST criteria. In order to expedite the DISA TEMPEST evaluation, the contractor shall provide a list of equipment, to include model number, which is associated with the processing of classified information. In addition, the estimated percentage of classified information processed, cable/conduit runs, a floor plan layout that depicts placement of equipment in relation to other rooms, equipment distances from walls or uncontrolled areas, and physical security being afforded the equipment both during processing and after hours. The above TEMPEST evaluation and DISA approval will not be required if previous DISA approval can be furnished and is no more than 2 years old. The existing approval must be for processing information at the same or higher level and at the same facility and items of equipment.

Reference ITEM 11j:

The contractor must adhere to and enforce US Government polices and procedures concerning Operation Security (OPSEC) requirements. OPSEC requirements will not be imposed until the DoD User Agency has finalized an OPSEC plan. Final review of the DoD User Agency OPSEC plan must be sent to, and approved by, the DISA OPSEC office.

Reference ITEM 11k:

This item authorizes the contractor to use the services of DCS. If this item is marked "Yes," the COR requests services from the Commander, DCS, ATTN: Operations Division, Fort George G. Meade, MD 20755-5370. Only certain classified information qualifies for shipment by DCS. It is the responsibility of the contracting activity to comply with DCS policy and procedures.

Reference ITEM 11k:

IT-I access required. NOTE: IT-I requires at least a Single Scope Background Investigation or Public Trust Special Background Investigation.

IT-II access required. NOTE: IT-II requires at least a National Agency Check with Local Agency and Credit, National Agency Check with Inquiries, Access National Agency Check with Inquiries, or National Agency Check investigation.

ITEM 13, SECURITY GUIDANCE (CONTINUED)

L. The prime contractor and the prime contractor’s subcontractors under this contract are authorized to courier information classified at the SECRET level or below between their respective locations in furtherance of efforts under this contract without passing the information through the Joint Spectrum Center. All individuals couriering classified must be briefed in accordance with the National Industrial Security Program Operating Manual (NISPOM) Section 5-410 Use of Couriers, Handcarriers, and Escorts with regard to their responsibilities as a courier and approved by their respective FSO prior to acting as a courier.

ITEM 14, ADDITIONAL SECURITY REQUIREMENTS (CONTINUED)

A. Intelligence Information (10.e.):

(1) SCI (10.e.(1)): Instruction for access to SCI are as follows:

(a) The User Agency SSR is:

Marty E. Robinson

DSO/OS2

2004 Turbot Landing Annapolis, MD 21402-5064 DSN 281-2329 or Comm. (410) 293-2329

(b) The User Agency Alternate SSR is:

John W. Gagnon

JSC/OS43

2004 Turbot Landing

DSN 281-2609 or Comm. (410) 293-2609

(c) The CM for SCI is:

Steven J. Averett, Captain USN, Commander

JSC/OS3

2004 Turbot Landing

DSN 281-2456 or Comm. (410) 293-2456

(d) SCI data furnished to or generated by the contractor will require special security handling and controls beyond those in DoD 5220.22-M. These supplemental instructions will be furnished and/or made available to the contractor by the JSC SSR or CM, and CSSOs will comply with all requirements outlined in the SSR’s handbook. The CSSO will complete an annual self-inspection of all SCI related contract activity using the self-inspection checklist located in DoDM 5105.21, Volume 1. SCI security officials shall conduct self-inspections of their SCIFs annually and will use the self-inspection checklist provided on the DIA/DAC Joint Worldwide Intelligence Communication System (JWICS) webpage at http://www.dia.ic.gov/homepage/da/security/field/scifforms.html. The purpose of the self-inspection is to ensure compliance with DIA policies and procedures. The self-inspection should take place in January of each year, and a report of the self-inspection and all discrepancies noted will be forwarded to the JSC SSR before the end of that month.

(e) Seventy (70) contractor SCI billets are required to perform this contract. The contract expiration date is 21 September 2009 for the Basic Period. There are seven one-year options.

(f) Names of contractor personnel requiring access to SCI shall be submitted to the JSC Security Manager for approval. Upon written approval by the JSC Security Manager, forms requesting SSBI shall be prepared in accordance with DoD 5220.22-M and submitted to the JSC SSR.

(g) The contractor shall establish and maintain an access list of those employees working on this contract. A copy of this list shall be furnished to the JSC Security Manager.

(h) The contractor shall advise the JSC SSR and the JSC Security Manager immediately upon reassignment of SCI cleared personnel to other duties not associated with this contract.

(i) Release of Information: SCI shall not be released to contractor employees without specific release approval of the JSC SSR or the originator of the material when applicable. SCI with restrictive caveats (ORCON, PROPIN, etc.) will be released to contractors only when originator approval has been obtained. This approval shall be obtained through the JSC SSR based on approval and certification of “need-to-know” by the CM. SCI documentation or other material concerning this contract, shall not be discussed with or released to any individual, subcontractor, agency (including Federal government agencies and employees) and contractor employees not working on the contract without prior written approval from the CM.

(j) Any SCI data released to or generated by the contractor in support of this contract remains the property of the DoD Department, agency, or command that released it. Upon completion/ cancellation of the contract, the contractor must return all such materials to the JSC SSR. A copy of this record shall be sent to the SCI CM quarterly and JSC SSR annually for their review. This applies to all data and materials, including working papers and notes. SCI inventories will be conducted in accordance with DoDM 5105.21, Volume 1.

(k) The contractor shall not reproduce any SCI related to this contract without the written permission from the CM. When such permission has been granted, the contractor shall control and account for such reproductions in the same manner as pertains to originals. Reproduction of hard copy SCI documents in entirety is not permitted.

(l) A government SCIF has been established. The SCIF has been built in accordance with DCID 6/9 standards and an SCI accreditation message is on file within the SCIF. Routine SCIF administrative operations are conducted by the contractor and monitored by the JSC SSR. SCI material associated with this contract shall be separately stored and maintained only in such properly accredited facilities and in approved safes at the contractor location. The supporting SSO is DISA/MPS6.

(m) This contract requires the use of DCS. The JSC SSR will validate DCS Forms 10.

(n) This contract requires electronic processing of SCI. The security provisions of DCID 6/3, DIAM 50-4, and Joint DODIIS/Cryptologic SCI Information System Security Standards apply and are part of this contract. No electronic processing will take place in the SCIF until Automatic Data Processing (ADP) accreditation messages from the JSC SSR are on file within the facility. The contractor’s equipment and ADP are currently accredited for SCI operations.

(o) The CSSO must coordinate with the CM prior to subcontracting any portion of the SCI efforts involved in the contract. A separate DD Form 254 for the subcontractor shall be processed and approved and separate subcontractor SCI billets obtained before any work can be performed.

Subcontractors cannot use the prime contractor’s SCI billets.

(p) The contractor will not use references to SCI accesses, even by unclassified acronyms, in advertising, promotional efforts, or recruitment of employees.

(q) The following activity is designated as the User Agency SSO for DCI requirement in accordance with DoDM 5105.21, Volume 1:

MPS6 Security Operations Branch P.O. Box 549 Fort George G. Meade, 20755-0549 DSN (312) 226-1406 or (301) 225-1406

(2) Non-SCI Intelligence Requirements (10.e.(2)):

(a) Intelligence, to include non-SCI intelligence materials, refers to the following:

1 Foreign intelligence and counterintelligence as defined in Executive Order #12333.

2 Intelligence describing U.S. foreign intelligence and counterintelligence activities, sources, and equipment used in acquiring, processing, or exploiting such intelligence; as well as the exploiting of military hardware, photography, or records resulting from such efforts.

3 Intelligence produced by authorized activities within the national intelligence community and identifiable as such by the various control markings listed in DCID 1/7.

(b) In addition to the requirements and controls for classified materials stated in DoD 5220.22-M, the

DCI has prescribed separate requirements and controls for intelligence materials in the possession of contractors; namely they must:

1 Maintain accountability for all intelligence information – including that marked CONFIDENTIAL

– released into their custody.

2 Obtain the releasing Agency’s written permission before reproducing intelligence information.

For purposes of this contract, the JSC SSR is the releasing agency unless otherwise noted in ORCON materials or those controlled by special directive (e.g. SAR). The contractor must control each copy reproduced in the same manner as the original.

3 Obtain the releasing agency’s approval before destroying intelligence information.

4 Restrict access to only those individuals who possess the required security clearance, have accomplished the required INTEL indoctrination briefing, and are actually providing services under the contract.

5 Further dissemination to other contractors, subcontractors, other government agencies, and private individuals or organizations is prohibited unless authorized in writing by the releasing agency.

6 Obtain written permission from the originator before releasing intelligence materials to foreign nationals or immigrant aliens. This applies even if the foreign nationals or immigrant aliens are consultants, U.S. contractors, or employees of the contractor; and it applies regardless of the level of their security clearance.

7 Ensure that each employee who has access to intelligence materials is fully aware of the material’s special handling requirements and maintains retrievable record of individuals who have had access to the materials in their custody.

(c) When implementing the foregoing DCI requirements, the following applies:

1 Requests for non–SCI intelligence must be submitted to the JSC SSR for approval. Each request must contain the following information or certification of need-to-know.

a Name and address of subcontractor requiring intelligence.

b Letter certifying subcontractor’s facility clearance and safeguarding capabilities; also identify DoD Industrial Security Office having inspection jurisdiction.

c Contract number and expiration date.

d Complete description of the intelligence material requested; include titles, control numbers, producer name/address, publication date, security classification, and any release restriction/markings or statement.

e Description of the subcontractor’s task for which the intelligence is required. Attach Statement of Work and DD254. Sufficient detail must be included to enable releasing agency staff to validate materials requested and/or identify other materials relevant to the task.

2 Request to access an intelligence library or facility for purposes of research must be submitted for JSC SSR validation of requirement and visit approval. In addition to the requirements of paragraph (c) 1 above, the subcontractor must also identify:

a Name, position/title, SSAN and security clearance and level of access (minimally, INTEL) for each individual requiring access.

b Purpose of the visit.

c Name and address of intelligence facility to be visited.

d Time frame of visit; for long-term, intermittent visit requirements, identify period of time up to one year, after which renewal is required.

3 DCID 1/7 identifies control markings authorized for special handling of intelligence materials;

the JSC SSR will provide this separately to those subcontractors with requirement to generate intelligence-based ground classified materials. Additionally, the subcontractor will treat as intelligence any materials that fall within the scope of definitions provided in paragraph 1 above and/or contain the following control statements:

“CONTAINS INTELLIGENCE INFORMATION. This Document is released on a specific need-to-know basis per Contract # FILL IN . After the document has served its intended purpose, it must be returned to the JSC SSR or destroyed in accordance with Program Contract Officer (PCO)-provided guidance. This document will not be retained in the subcontractor library after the contract completion unless the Government has authorized recontrol to a new contract.”

(d) All documents, briefings, or materials prepared under this contract that contain intelligence information must be submitted to the JSC SSR for approval prior to government acceptance and final dissemination.

(e) Unless provided destruction or retention authority, the contractor must return all intelligence materials to the JSC SSR upon completing task/contract or terminating classified contract.

Requests for destruction/retention authority shall also be directed to the JSC SSR for approval.

B. Special Access Information (10.f.): The JSC/SSR is designated as the focal point for all security matters concerning

SAP. All SAP security matters will be conducted with JSC/SSR.

C. For Official Use Only Information (10.j.): FOUO Information provided under this contract shall be safeguarded as specified in DoDR 5400.7 and DISA Instruction 240-110-8.

D. Receive and Generate Classified material (11.c.): Any special provisions received from JSC project sponsors, DoD

5220.22-M, DoD 5200.1-R, and JSC Instruction 240-110-4 are applicable.

E. Fabricate, Modify, or Store Classified Hardware (11.d.): Typically limited to unclassified IT equipment into which classified data is placed. Occasional need to store classified hardware is conceivable. Contractor will require adequate storage facilities.

F. Have Access to U.S. Classified Information Outside of the U.S., Puerto Rico, U.S. Possessions and Trust Territories

(11.f.): List of Overseas Locations: Various US military installations worldwide.

G. Communications Security (COMSEC) Information (11.h.): The Contractor is governed by DoD 5220.22-M. Access to COMSEC material / information is restricted to U.S. citizens holding final US government clearances and is not releasable to personnel holding only a reciprocal clearance. Personnel requiring access shall be briefed in accordance with DoD 5220.22-S. NOTE: The COMSEC/crypto briefing applies only to the use and control of crypto equipment and specialized COMSEC publications. NACSIM documents are not considered COMSEC, controlled material. Additionally, cryptographic information/equipment shall be retained in a contractor facility COMSEC account in accordance with DoD 5220.22S. The JSC CM shall designate the number of personnel requiring cryptographic access. The number will be limited to the minimum necessary and will be on a strict need-to-know basis.

H. Have OPSEC Requirements (11.j.): OPSEC requirements are contained in the contract task orders. DFARS

252.204-7000 is applicable. M. The contractor is responsible for maintaining both a classified closed testing system and a classified system connected to the DoD Information Network.

I. The contractor shall:

(1) Obtain and sustain Authority to Operate (ATOs) from the DSS for both closed and Secret Internet Protocol Router Network (SIPRNet) connected systems (DISA Circular 300-115-3, Defense Information System Network (DISN) Secret Internet Protocol Routing Network (SIPRNet) Security Classification Guide, 1 Jun

2013 (U/FOUO)).

(2) Report any change in the ATO status of systems to the Defense Spectrum Organization Information Assurance (IA) Manager, to include the expiration or denial of an ATO.

(3) Ensure accurate reporting of vulnerability status of assets connected to SIPRNet in the Vulnerability Management System (US Cyber Command (CYBERCOM) Instruction 5200-03, Administration, Security and Management Security Classification Guide, 11 Oct 2011.

(4) Advise the DSO of configuration changes to the connected devices as well as topology changes to the system as a whole.

(5) Ensure SIPRNet connected devices are configured to allow announced and unannounced Connection Approval Office vulnerability scans.

(6) Submit to a cyber security inspection within every 12 month period.

ITEM 15, INSPECTIONS (CONTINUED)

INSPECTIONS:

A. The DIA has exclusive security responsibility for all SCI classified material released or developed under this contract and held within the JSC SCIF or a contractor’s SCIF, except for those areas and materials specifically excluded and identified in applicable SCI co-utilization agreements. DSS is relieved of security inspection responsibility for all such material.

B. DSS is primarily responsible for the inspection of all non-SCI material located within either the JSC or contractor

SCIF. The JSC SSR will also inspect such material.

ITEM 17, REQUIRED DISTRIBUTION (CONTINUED)

17. Required Distribution (17.f.):

__X_ DISA, Industrial Security __X_ DCS, Bldg 6300 Hodges St, Ft George G. Meade, MD 20755-5371

APPENDIX A TO DD FORM 254

REFERENCED DOCUMENTS

Department of Defense Directives:

DoD 5105.21-M-1 Sensitive Compartmented Information (SCI) Administrative Security Manual, Aug 1998 DoD 5200.1-R Information Security Program, Jan 1997 DoD 5220.22-A COMSEC Annex to NISPOM DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM), 1 May 2000 DoD 5220.22-S COMSEC Sup to the Industrial Security Regulation, March 1988 DoDI 5230.24 Distribution Statements on Technical Documents, 18 Mar 1987 DoDR 5400.7-R DoD Freedom of Information Act Program, Sep 1998 DoD 5220.22-M Supp 1 National Industrial Security Program Operating Manual Supplement

Defense Intelligence Agency Directives:

DIAM 50-4 Security of Compartmented Computer Operations (U), Apr 1997 DIA Joint DODIIS/Cryptologic SCI Information Systems Security Standards, 11 Apr 2003

Director of Central Intelligence Directives:

DCID 6/6 Security Controls on the Dissemination of Intelligence Information, 6 Jun 2003 DCID 6/4 Minimum Personnel Security Standards and Procedures, May 2002 DCID 6/3 Security Policy for Uniform Protection of Intelligence Processed in Automated Information Systems and Networks, 11 Dec 2003 DCID 6/1 Security Policy for SCI and Security Policy Manual (U), 4 Nov 2003 DCID 6/9 Physical Security Standards for SCI, 17 Dec 2002

US Cyber Command Instruction:

USCYBERCOM Inst 5200-03 Administration, Security and Management Security Classification Guide, 11 Oct 2011

Defense Information Systems Agency Directives:

DISA Instruction 240-110-36 Physical Security, 9 April 2013 DISA Circular 300-115-3 Defense Information System Network (DISN) Secret Internet Protocol Routing Network

(SIPRNet) Security Classification Guide, 1 Jun 2013 (U/FOUO)

Joint Spectrum Center Instructions:

JSC Instruction 240-70-1 Security, 21 October 2009

APPENDIX B TO DD FORM 254

LIST OF ACRONYMS

ADP Automatic Data Processing AIS Automated Information System ATO Authority to Operate CIK Cryptographic Ignition Key CM Contract Monitor CNWDI Critical Nuclear Weapon Design Information CO Contracting Officer COMSEC Communications Security COR Contracting Officer’s Representative CSA Cognizant Security Agency CSSO Contractor Special Security Officer CYBERCOM Cyber Command DCI Director Central Intelligence DCID Director Central Intelligence Directive DCS Defense Courier Service DIA Defense Intelligence Agency DISA Defense Information System Agency DSO Defense Spectrum Organization DSS Defense Security Service DTIC Defense Technical Information Center FSO Facility Security Officer IA Information Assurance NISPOM National Industrial Security Operating Manual ORCON Originator Controlled PROPIN Proprietary Information Involved SAP Special Access Program SAR Special Access Request SCI Sensitive Compartmented Information SCIF Sensitive Compartmented Information Facility SIPRNet Secret Internet Protocol Router Network SSAN Social Security Account Number SSO Special Security Officer SSP Standard Security Procedures SSR Special Security Representative

DFARS 204.404-70, “Disclosure of Information” IT-I & IT-II Requirements

2004 Turbot Landing Annapolis, MD 21402-5064

Public release of SCI/SAP material is not authorized.

security: A. Referenced Documents: See Appendix A.

B. Acronyms: See Appendix B.

C. Program Manager: __________________________________________ STEVEN J. AVERETT, Captain, USN Commander, Joint Spectrum Center DSN 281-2456 or (410) 293-2456 D. Expiration: Contract Base Period ends 30 June 2017. The four potential one year options terminate 30 June of successive years.

E. Pre-award access is not required, however, the awarded contractor is required to have access to perform duties by the completion of the transition period. This DD Form 254 reflects the security requirements for the contract when awarded.

F. Contract requires additional security requirements established for SCI in accordance with DoD 5105.21-M-1, which also provides guidance for physical, personnel, and information security measures and is part of the security specifications for this contract.

G. DoD 5105.21-M.1, CJCSI 3320.02a, and specific security guides will be used for specific security classification guidance.

H. Inquiries pertaining to classification guidance on SCI will be directed to the SSR or CM indicated in Item 14.A. (1) (a or b). SCI or SCI-derived material generated under this contract will be reviewed by the SSR or the CM for proper classification prior to final publication and distribution. The responsible SSO (DISA/SSO) designated in Item 14.A. (1) (p) will provide assistance as required.

I. All classified visit requests by the contractor shall be forwarded to the JSC Security Manager for approval and need-to-know certification before being sent to the facility to be visited.

J. The COR must be notified and approve the receipt and/or generation of classified information under this contract.

K. All classified information received and or generated under this contract is the property of the U.S. Government regardless of proprietary claims. Upon completion or termination of this contract, the U.S. Government will be contacted for destruction or disposition instructions.

Item 13 is continued on additional pages.