HC1047-17-R-0001_-_Attachment_1_-_DD254.pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

b. LEVEL OF SAFEGUARDING REQUIRED

2. THIS SPECIFICATION IS FOR: (X and complete as applicable)

a. PRIME CONTRACT NUMBER

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable)

a. ORIGINAL (Complete date in all cases)

REVISION NO.

c. FINAL (Complete Item 5 in all cases)

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specs)

DATE (YYYYMMDD)

DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

10. CONTRACTOR WILL REQUIRE ACCESS TO: 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL:YES NO YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

d. FORMERLY RESTRICTED DATA

e. INTELLIGENCE INFORMATION

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

f. SPECIAL ACCESS INFORMATION

g. NATO INFORMATION

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

j. FOR OFFICIAL USE ONLY INFORMATION

k. OTHER (Specify)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE TEMPEST REQUIREMENTS

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

l. OTHER (Specify)

DD FORM 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE.

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release

a. TYPED NAME OF CERTIFYING OFFICIAL

Direct Through (Specify)

d. ADDRESS (Include Zip Code)

Yes No to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classifiection guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract.

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office.

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

b. TITLE c. TELEPHONE (Include Area Code)

e. SIGNATURE

17. REQUIRED DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD FORM 254 (BACK), DEC 1999

DD FORM 254, SECURITY SIGNATURE PAGE

PRIME CONTRACT NUMBER:

SUBCONTRACT NUMBER: _

CERTIFICATION AND SIGNATURES: “Security requirement stated herein are completed and adequate for safeguarding the classified information to be release or generated under this classified effort. All questions shall be referred to the official named below.”

Security Office Approval

Name:

Title:

Security Office Approval

All classified visit request by contractors shall be forwarded to the Contracting Officer Representative (COR) for approval and need -to-know certification before being sent to the facility to be visited.

All visit access requests (VARs) by contractors shall be sent via the Joint Personnel Adjudication System (JPAS) to the DISA VAR Center (JPAS SMO:DKABAA10) or appropriate SMO for the effort. The COR/TM must approve the VAR prior to sending the request to the facility being visited. Contractors must also provide a copy of the VAR to the security manager.

The COR/TM must be notified and approve the receipt and/or generation of classified information under this contract.

All classified information received and/or generated under this contract is the property of the U.S. Government regardless of proprietary claims. Upon completion or termination of this contract, the U.S. Government will be contacted for destruction or disposition instructions.

Foreign Nationals will not perform on any area of the contract (classified or unclassified).

See additional block 13 pages below for further guidance.

See additional information in BLOCK 13

Fort Meade, MD 20755

Reference Block 10h:The Prime Contractor must receive approval from DISA to authorize a subcontractor access to foreign government information.

Reference Block 10j: Contractor will be provided with and will abide by DoD Regulation 5400.7, DoD Freedom of Information Act Program, and DoD 5200.01-M, Information Security Program. Guidance provided under separate cover (Remove this sentence if guidance is provided in the contract package).

Reference Block 10k: SIPRNet and JWICS Access are required at the Government facility

Reference Block 11c: Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware. All classified information received or generated will be properly stored and handled according to the markings on the material. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of this contract, the U.S. Government will be contacted for proper disposition instructions.

Contractor will abide by the following security classification guidance:

DoDD 5200.1-R Information Security Program, Appendix 3 DoDD 5230.24 Distribution Statements on Technical Documents, Para 2.2 and Section 6 DoDD 5230.25 Withholding of Unclassified Technical Data From Public Disclosure

Reference Block 11f: Contractors when performing or traveling outside the United States under this contract will:

All personnel will receive the Antiterrorism Level I Awareness training within one year prior to travel.

Reference Block 11g:

a. Technical information on file at the Defense Technical Information Center will be made available to the contractor if the contractor requires such information.

b. The contractor must prepare and forward a DD Form 1540 to the COR/TM for authorization BEFORE the services may be requested.

c. Contractors requiring to courier classified information or equipment, up to Top Secret shall receive a Government Issued Collateral Courier card from the Government Security office prior to couriering classified information or material in support of official duties. The contractor will only be issued a collateral courier card to hand carry classified information or equipment if there are no other means of safely and securely transporting or sending the classified information or equipment.

The contractors must also have a requirement to courier any classified information or equipment on a weekly basis. A courier letter can be issued by the Government Security Manager if there is a requirement to courier periodically. All contractors will follow the DoD Manual 5200.01, Information Security and the collateral courier card standard operating procedures (SOP) that is issued by the DISA Security Office. A collateral courier card or letter will only be issued up to the clearance level of the individual contractor.

Reference Block 11i:

a. The contractor will not process classified information by electrical means prior to a TEMPEST evaluation of the equipment/systems and facility, and written certification by the DIA Certified TEMPEST Technical Authority that the facility meets DIA’s TEMPEST criteria. In order to expedite the TEMPEST evaluation, the contractor shall provide a list and layout of equipment in accordance with DOD 5105.21 M-1 TEMPEST Addendum. The enclosure will include a floor plan layout that depicts placement of equipment in relation to other equipment, telephone lines and instruments, cable/conduit runs, etc. The drawing(s) are to show dimensions of rooms, physical relation to other rooms, equipment distances from walls or uncontrolled areas, and physical security being afforded the equipment both during processing and after hours.

b. Previous DIA Certified TEMPEST Technical Authority approval may be furnished provided it is not more than 2 years old so long as the physical accreditation has been maintained. If physical accreditation was lost or de-certified, the TEMPEST accreditation must be issued based on the new physical accreditation by DIA. The approval must be for processing information of the same or higher level security classification and for the same facility and blocks of equipment.

Reference Block 11j: The contractor will comply with OPSEC requirements contained in the contract or attached under separate cover.

13_cont1: Reference Block 10a: Contractor is authorized to receive Government furnished cryptographic equipment. Access to classified COMSEC information requires a final U.S. Government clearance at the appropriate level. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires prior approval of the government contracting activity. Non-accountable COMSEC information, though not tracked in the COMSEC material control system, may still require a level or control within a document control system. Refer to NSA/CSS Manual 3-16, Control of Communications Security Material, page E-4 for guidance.

Reference Block 10e(1): This contract requires access to SCI.

a. The number of personnel required to have access to SCI is determined by the COR/TM and the DISA SSO.

b. The Director, Defense Intelligence Agency (DIA) and Director, Defense Information Systems Agency (DISA), as the executive agent for DIA, have exclusive security responsibility for SCI released to the contractor or developed under this contract.

c. Contractor generated or Government furnished material may not be provided to the Defense Technical Information Center. Contract generated technical reports will bear the statement ‘Not Releasable to the Defense Technical Information Center per DoD Instruction 5230.24.

d. All contractor personnel requiring access to SCI information must: be U.S. citizens, have been granted a final ICD 704 security clearance by the U.S. Government, and have been indoctrinated for the applicable compartments of SCI access prior to being given any access to such information released or generated under this contract.

e. Classified material released or generated under this contract is not releasable to foreign nationals without the expressed written permission of the Director, DISA (through the DISA SSO) and Director, DIA.

f. SCI received under this contract may not be released to subcontractors without permission of the DISA SSO.

g. The contractor and COR/TM will revalidate all SCI billets under this contract with the DISA SSO annually or when a revised DD Form 254 issued, whichever is sooner.

h. All SCI visit requests by contractors shall be forwarded to the COR/TM for approval and need-to-know certification before being sent through the DISA SSO to the facility to be visited.

i. STE terminals installed at the contractor's facilities shall be supported by a COMSEC account (of the contractor of DISA). STEs in SCI Facilities (SCIFs) requires the KSV 21 Encryption Card.

(NOTE: Remove paragraph if SCI will only be accessed at government location.)

The COR/TM will coordinate with MPS6 to identify the SCIF and initiate any Co-utilization Agreement (CUA) as required.

Prior approval of DISA SSO is required before a subcontract involving access to Intelligence Information can be issued.

Reference Block 10f:

a. To execute this contract, additional security requirements in addition to DoD 5220.22-M will be required. The contractor shall comply with the security provisions of these programs. Marking and/or classification guidance for material originated or generated under this contract will be provided through the SAP Management Office under separate cover. Any material generated by the contractor (including correspondence, drawings, models, mockups, photographs, schematics, progress, special and inspection reports, engineering notes, computations and training aids) shall be classified according to content. Guidance for classification shall be derived from the applicable Security Classification Guides, documents, or special instructions. Such material shall not contain contractor logos or similar identifiers which identify the specific contractor or team members.

b. The Contractor Special Security Officers shall coordinate with the DISA Security Office (MPS6) and SAP Management Office prior to subcontracting any portion of this contract.

c. All personnel requiring access to SAP information must be U.S. citizens, have been granted a final U.S. Government security clearance, and have been indoctrinated for the applicable SAP prior to being given access to such information generated or received under this contract.

d. Contractor generated or Government furnished material may not be provided to the Defense Technical Information Center. Contractor generated reports will bear the statement: “Not Releasable to the Defense Technical Information Center” per DoD Instruction 5230.24.

e. Upon expiration of this contract, the contractor is required to have a close-out inspection by the DISA SSO and/or SAP Management Office to ensure proper disposition of material and equipment. The contractor shall request disposition instructions for all classified and unclassified project material. The contractor may be directed to properly destroy the material or return it. If classified or unclassified project material is to be retained by the contractor, every effort should be taken to transfer it to a follow-on contract or similar effort, if applicable. This must be done, however, with the contracting officer’s (KO) approval. The material shall be returned or destroyed as instructed, unless written authorization by the KO to retain specific material for a specific period of time is received. Any exception to security policy shall be referred to the Cognizant Security Office and the DISA Security Office (MPS6) for coordination with the appropriate agency(s) and the KO.

f. The contractor is required to have a close-out inspection

Reference Block 11k: Contractors requiring to courier classified information or equipment, up to Top Secret shall receive a Government Issued Collateral Courier card from the Government Security office prior to couriering classified information or material in support of official duties. The contractor will only be issued a collateral courier card to hand carry classified information or equipment if there are no other means of safely and securely transporting or sending the classified information or equipment. The contractors must also have a requirement to courier any classified information or equipment on a weekly basis. A courier letter can be issued by the Government Security Manager if there is a requirement to courier periodically. All contractors will follow the DoD Manual 5200.01, Information Security and the collateral courier card standard operating procedures (SOP) that is issued by the DISA Security Office. A collateral courier card or letter will only be issued up to the clearance level of the individual contractor.

IT-I requires at least a SSBI or PTSBI investigation.

(Task Orders will need to specify in their DD254) State requirements in Block 13 as reference Block 11l

IT-II requires at least a SSBI or PTSBI investigation.

(Task Orders will need to specify in their DD254) State requirements in Block 13 as reference Block 11l

Additional information from BLOCK 14:

When SCI or SAP task are sub-contracted, the sub-contractor DD254 must be sent to the DISA Industrial Security PM and be processed through the DISA SSO and or Program Security Officer for approval.

The contractor will abide by DCID 6/6 (formerly 1/7), Security Controls on the Dissemination of Intelligence Information, 11 July 2001. Provided under separate cover.

TEMPEST requirements apply. Guidance provided in Block 13 as reference Block 11i.

OPSEC requirements apply. Guidance provided in Block 13 as reference Block 11j.

Additional information from BLOCK 15:

• Special Access Programs where the Program Security Office has “carved out” the CSO from inspection responsibility. Not all SAPs are “carve outs” because, in some instances, the program or supporting SAP Security Office will allow the CSO to retain inspection responsibility.

• Contractor facilities operating on military installations when the installation commander has elected to retain security cognizance. In all cases, provide the CSO a copy of the DD 254.

The DISA Security Office (MPS6) is responsible for inspection of SCI under this contract.

IT-II access required.