DSOAE3001_cont_PAGE_6_-_7_(2).pdf

ddform254cont1 ddform254cont2

c Contract number and expiration date.

d Complete description of the intelligence material requested; include titles, control numbers, producer name/address, publication date, security classification, and any release restriction/markings or statement.

e Description of the subcontractor’s task for which the intelligence is required. Attach Statement of Work and DD254. Sufficient detail must be included to enable releasing agency staff to validate materials requested and/or identify other materials relevant to the task.

2 Request to access an intelligence library or facility for purposes of research must be submitted for JSC SSR validation of requirement and visit approval. In addition to the requirements of paragraph (c) 1 above, the subcontractor must also identify:

a Name, position/title, SSAN and security clearance and level of access (minimally, INTEL) for each individual requiring access.

b Purpose of the visit.

c Name and address of intelligence facility to be visited.

d Time frame of visit; for long-term, intermittent visit requirements, identify period of time up to one year, after which renewal is required.

3 DCID 1/7 identifies control markings authorized for special handling of intelligence materials; the JSC SSR will provide this separately to those subcontractors with requirement to generate intelligence-based ground classified materials. Additionally, the subcontractor will treat as intelligence any materials that fall within the scope of definitions provided in paragraph 1 above and/or contain the following control statements:

“CONTAINS INTELLIGENCE INFORMATION. This Document is released on a specific need-to-know basis per Contract # FILL IN . After the document has served its intended purpose, it must be returned to the JSC SSR or destroyed in accordance with Program Contract Officer (PCO)- provided guidance. This document will not be retained in the subcontractor library after the contract completion unless the Government has authorized recontrol to a new contract.”

(d) All documents, briefings, or materials prepared under this contract that contain intelligence information must be submitted to the JSC SSR for approval prior to government acceptance and final dissemination.

(e) Unless provided destruction or retention authority, the contractor must return all intelligence materials to the JSC SSR upon completing task/contract or terminating classified contract. Requests for destruction/retention authority shall also be directed to the JSC SSR for approval.

B. Special Access Information (10.f.): The JSC/SSR is designated as the focal point for all security matters concerning SAP. All SAP security matters will be conducted with JSC/SSR.

C. For Official Use Only Information (10.j.): FOUO Information provided under this contract shall be safeguarded as specified in DoDR 5400.7 and DISA Instruction 240-110-8.

D. Receive and Generate Classified material (11.c.): Any special provisions received from JSC project sponsors, DoD 5220.22-M, DoD 5200.1-R, and JSC Instruction 240-110-4 are applicable.

E. Fabricate, Modify, or Store Classified Hardware (11.d.): Typically limited to unclassified IT equipment into which classified data is placed. Occasional need to store classified hardware is conceivable. Contractor will require adequate storage facilities.

F. Have Access to U.S. Classified Information Outside of the U.S., Puerto Rico, U.S. Possessions and Trust Territories (11.f.): List of Overseas Locations: Various US military installations worldwide.

G. Communications Security (COMSEC) Information (11.h.): The Contractor is governed by DoD 5220.22-M. Access to COMSEC material / information is restricted to U.S. citizens holding final US government clearances and is not releasable to personnel holding only a reciprocal clearance. Personnel requiring access shall be briefed in accordance with DoD 5220.22-S. NOTE: The COMSEC/crypto briefing applies only to the use and control of crypto equipment and specialized COMSEC publications. NACSIM documents are not considered COMSEC, controlled material. Additionally, cryptographic information/equipment shall be retained in a contractor facility COMSEC account in accordance with DoD 5220.22S. The JSC CM shall designate the number of personnel requiring cryptographic access. The number will be limited to the minimum necessary and will be on a strict need-to-know basis.

H. OPSEC requirements apply. Guidance provided in Block 13 as reference Block 11j. OPSEC requirements are contained in the contract task orders. DFARS252.204-7000 is applicable. M. The contractor is responsible for maintaining both a classified closed testing system and a classified system connected to the DoD Information Network.

I. The contractor shall:

(1) Obtain and sustain Authority to Operate (ATOs) from the DSS for both closed and Secret Internet Protocol Router Network (SIPRNet) connected systems (DISA Circular 300-115-3, Defense Information System Network (DISN) Secret Internet Protocol Routing Network (SIPRNet) Security Classification Guide, 1 Jun 2013 (U/FOUO)).

(2) Report any change in the ATO status of systems to the Defense Spectrum Organization Information Assurance (IA) Manager, to include the expiration or denial of an ATO.

(3) Ensure accurate reporting of vulnerability status of assets connected to SIPRNet in the Vulnerability Management System (US Cyber Command (CYBERCOM) Instruction 5200-03, Administration, Security and Management Security Classification Guide, 11 Oct 2011.

(4) Advise the DSO of configuration changes to the connected devices as well as topology changes to the system as a whole.

(5) Ensure SIPRNet connected devices are configured to allow announced and unannounced Connection Approval Office vulnerability scans.

(6) Submit to a cyber security inspection within every 12 month period.

J. The contractor will be provided and will abide by ICD 503, “Intelligence Community Information Technology Systems Security: Risk Management, Certification and Accreditation, September 15, 2008” and by ICD 705 Sensitive Compartmented Information Facilities, May 26, 2010. Provided under separate cover.

K. When SCI or SAP task are sub-contracted, the sub-contractor DD254 must be sent to the DISA Industrial Security PM and be processed through the DISA SSO and or Program Security Officer for approval.

L. The contractor will abide by DCID 6/6 (formerly 1/7), Security Controls on the Dissemination of Intelligence Information, 11 July 2001. Provided under separate cover.

ITEM 14, ADDITIONAL SECURITY REQUIREMENTS (CONTINUTED)

The contractor will be provided and will abide by ICD 503, “Intelligence Community Information Technology Systems Security: Risk Management, Certification and Accreditation, September 15, 2008” and by ICD 705 Sensitive Compartmented Information Facilities, May 26, 2010. Provided under separate cover.

When SCI or SAP task are sub-contracted, the sub-contractor DD254 must be sent to the DISA Industrial Security PM and be processed through the DISA SSO and or Program Security Officer for approval.

ITEM 15, INSPECTIONS (CONTINUED)

INSPECTIONS:

A. The DIA has exclusive security responsibility for all SCI classified material released or developed under this contract and held within the JSC SCIF or a contractor’s SCIF, except for those areas and materials specifically excluded and identified in applicable SCI co-utilization agreements. DSS is relieved of security inspection responsibility for all such material.

B. The DSS is primarily responsible for the inspection of all non-SCI material located within either the JSC or contractor SCIF. The JSC SSR will also inspect such material.

ITEM 17, REQUIRED DISTRIBUTION (CONTINUED)

17. Required Distribution (17.f.):

X_ DISA, Industrial Security X_ DCS, Bldg 6300 Hodges St, Ft George G. Meade, MD 20755-5371

13_cont2:

APPENDIX A TO DD FORM 254

REFERENCED DOCUMENTS

Department of Defense Directives:

DoD 5105.21-M-1 Sensitive Compartmented Information (SCI) Administrative Security Manual, Aug 1998 DoD 5200.1-R Information Security Program, Jan 1997 DoD 5220.22-A COMSEC Annex to NISPOM DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM), 1 May 2000 DoD 5220.22-S COMSEC Sup to the Industrial Security Regulation, March 1988 DoDI 5230.24 Distribution Statements on Technical Documents, 18 Mar 1987 DoDR 5400.7-R DoD Freedom of Information Act Program, Sep 1998 DoD 5220.22-M Supp 1 National Industrial Security Program Operating Manual Supplement

Defense Intelligence Agency Directives:

DIAM 50-4 Security of Compartmented Computer Operations (U), Apr 1997 DIA Joint DODIIS/Cryptologic SCI Information Systems Security Standards, 11 Apr 2003

Director of Central Intelligence Directives:

DCID 6/6 Security Controls on the Dissemination of Intelligence Information, 6 Jun 2003 DCID 6/4 Minimum Personnel Security Standards and Procedures, May 2002 DCID 6/3 Security Policy for Uniform Protection of Intelligence Processed in Automated Information Systems and Networks, 11 Dec 2003 DCID 6/1 Security Policy for SCI and Security Policy Manual (U), 4 Nov 2003 DCID 6/9 Physical Security Standards for SCI, 17 Dec 2002

US Cyber Command Instruction:

USCYBERCOM Inst 5200-03 Administration, Security and Management Security Classification Guide, 11 Oct 2011

Defense Information Systems Agency Directives:

DISA Instruction 240-110-36 Physical Security, 9 April 2013 DISA Circular 300-115-3 Defense Information System Network (DISN) Secret Internet Protocol Routing Network (SIPRNet) Security Classification Guide, 1 Jun 2013 (U/FOUO)

APPENDIX B TO DD FORM 254

LIST OF ACRONYMS

ADP Automatic Data Processing AIS Automated Information System ATO Authority to Operate CIK Cryptographic Ignition Key CM Contract Monitor CNWDI Critical Nuclear Weapon Design Information CO Contracting Officer COMSEC Communications Security COR Contracting Officer’s Representative CSA Cognizant Security Agency CSSO Contractor Special Security Officer CYBERCOM Cyber Command DCI Director Central Intelligence DCID Director Central Intelligence Directive DCS Defense Courier Service DIA Defense Intelligence Agency DISA Defense Information System Agency DSO Defense Spectrum Organization DSS Defense Security Service DTIC Defense Technical Information Center FSO Facility Security Officer IA Information Assurance NISPOM National Industrial Security Operating Manual ORCON Originator Controlled PROPIN Proprietary Information Involved SAP Special Access Program SAR Special Access Request SCI Sensitive Compartmented Information SCIF Sensitive Compartmented Information Facility SIPRNet Secret Internet Protocol Router Network SSAN Social Security Account Number SSO Special Security Officer SSP Standard Security Procedures SSR Special Security Representative

Joint Spectrum Center Instructions:

JSC Instruction 240-70-1 Security, 21 October 2009