DD254_HDTRA1-15-T-0031.pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

b. LEVEL OF SAFEGUARDING REQUIRED

None

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (x and complete as applicable)

a. PRIME CONTRACT NUMBER

X

a. ORIGINAL (Complete date in all cases)

DATE (YYYYMMDD)

20150610

b. SUBCONTRACT NUMBER

b. REVISED

(Supersedes all previous specs)

REVISION NO. DATE (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

c. FINAL (Complete item 5 in all cases)

DATE (YYYYMMDD)

HDTRA1-15-T-0031

4. IS THIS A FOLLOW-ON CONTRACT?

YES X NO. If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES X NO. If Yes, complete the following:

In response to the contractor’s request dated , retention of the identified classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Consulting services for the Convey High Performance Computing System.

10. CONTRACTOR WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION X

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA X

b. RECEIVED CLASSIFIED DOCUMENTS ONLY X

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION X

c. RECEIVE AND GENERATE CLASSIFIED MATERIAL X

d. FORMERLY RESTRICTED DATA X

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE X

e. INTELLIGENCE INFORMATION:

e. PERFORM SERVICES ONLY X

(1) Sensitive Compartmented Information (SCI) X f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI X

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER X

f. SPECIAL ACCESS INFORMATION X

h. REQUIRE A COMSEC ACCOUNT X

g. NATO INFORMATION X

i. HAVE TEMPEST REQUIREMENTS X

h. FOREIGN GOVERNMENT INFORMATION X

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS X

i. LIMITED DISSEMINATION INFORMATION X

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION X

l. OTHER (Specify) X

k. OTHER(Specify) X

Information Assurance: Privileged User Access Training and Certification

ACCM

ORCON

DD Form 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE.

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release Direct X Through (Specify):

Defense Threat Reduction Agency

8725 John J. Kingman Road, MS 6201

Ft. Belvoir, VA 22060-6201 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DOD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

Item 13a: The contractor shall comply with the Security Agreement (DD Form 441) including the NISPOM and any revisions to that manual, notice of which has been furnished to the contractor.

Item13b: The contractor's employees performing work under this contract shall be U.S. citizens and been granted appropriate security clearance, based on the need for access to specific classified information. That is SECRET clearance based on favorably adjudicated National Agency Check with Law and Credit Check (NACLC) or a TOP SECRET clearance based on

Single Scope Background Investigations favorably adjudicated by the Defense Security Service, DoD Central Adjudicative

Facility, Fort Meade, Maryland 20755.

All contractors in privileged user positions must have a completed single scope background investigation (SSBI) in accordance with DOD I 8500.2, 6 February 2003, paragraph E3.4.8. and Table E3.T1, prior to filling the position. Privileged users are defined as but not limited to, persons in the following roles or positions: Information Assurance Managers/Officers, supervisors of IT positions, systems administrators, maintainers of IA-enabled products as routers, switches, firewalls, personnel performing system monitoring and testing, and personnel who issue classified PKI certificates.

Item 13c: Should the contractor visit or perform work in support of this contract at any DTRA facility, the contractor shall submit proof of clearance (Visit Authorization Letter) to the DTRA Security and Counterintelligence Office (ATTN: Visitor

Control). Visit Authorization Letters (VALs) shall contain the information specified in paragraph 6-104 of the NISPOM.

VALs may be tele-faxed to (703) 767-7857. The term of the VAL shall be for the period of contract performance. All classified visit request by contractors should be forwarded to the Program Manager for approval and need-to-know.

(See continuation page for additional Security Guidance instructions.)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. X Yes No

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

See block 13; Item 10j.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. X Yes No

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

See block 13; Item 10e.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL b. TITLE c. TELEPHONE (Include Area Code)

d. ADDRESS (Include Zip Code) 17. REQUIRED DISTRIBUTION

Defense Threat Reduction Agency

8725 John J. Kingman Road, MS 6201

Ft. Belvoir, VA 22060-6201

X a. CONTRACTOR

b. SUBCONTRACTOR

X c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

X e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD Form 254 (BACK), DEC 1999

BLOCK 13 (CONTINUED)

HDTRA1-15-T-0031

Item 10b: Restricted Data (RD). This contract requires access to RD and FRD material and information. This information is classified and is controlled under the Atomic Energy Act of 1954. Overall security oversight for RD and FRD is under the cognizance and control of the Department of Energy. Contractor personnel given access to RD and FRD shall be knowledgeable of requirements in 10CFR1045, "Nuclear Classification and Declassification," and DoD Directive 5210.2, "Access to and Dissemination of Restricted

Data," and shall be trained in accordance with 10CFR1045.35(a).

Item 10c: Contractor requires access to Critical Nuclear Weapons Design Information (CNWDI). Permission of the contracting activity is required prior to subcontracting. CNWDI special briefings and procedures are required. A government representative initially briefs the contractor security facility officer for CNWDI, who in turn is responsible to brief other contractor employees who require access. A final U.S government security clearance is required for this access as defined in DoD Directive 5210.2.

Item 10d: Formerly Restricted Data (FRD). This contract requires access to RD and FRD material and information. This information is classified and is controlled under the Atomic Energy Act of 1954. Overall security oversight for RD and FRD is under the cognizance and control of the Department of Energy. Contractor personnel given access to RD and FRD shall be knowledgeable of requirements in 10CFR1045, "Nuclear Classification and Declassification," and DoD Directive 5210.2, "Access to and Dissemination of Restricted Data," and shall be trained in accordance with 10CFR1045.35(a).

Item 10e(1): In accordance with DoDM 5105.21, Volumes 1-3, Sensitive Compartmented Information (SCI) Administrative Security

Manual, dated 19 October 2012, and the Continued Responsibility Form that all contractors sign when they are SCI indoctrinated, all contractors performing work on a DTRA/SCC-WMD contract that requires SCI access must comply with the following:

1. All contractor employees requiring SCI must be U.S. citizens and be eligible for a TOP SECRET clearance and have met the

Intelligence Community Directive (ICD) 704, (Personnel Security Standards and Procedures Governing Eligibility for Access to SCI and Other Controlled Access Program Information, 1 October 2008 and Intelligence Community Policy Guidance-ICPG 704.1, 704.2, 704.3, 704.4, and 704.5), requirements prior to granting of SCI access. Clearance is based on a Single Scope Background Invesigation

(SSBI) adjudicated by Defense Security Service (DSS) in Columbus, Ohio. Individual must be indoctrinated for SCI prior to being given access to such information. It is the Contractor/Facility Security Officer's responsibility to ensure that the SSBI is current and that a PPR/PR is submitted in a timely manner for all of their contractor employees performing SCI work.

2. All DTRA/SCC-WMD contractors will receive their initial SCI indoctrination/training once granted eligibility by the Defense

Intelligence Agency (DIA) or the Department of Defense (DoD CAF). All contractors are also obligated to annually complete the

DTRA/SCC-WMD SCI refresher training.

3. All contractors with SCI access, prior to traveling outside the Continental United States (OCONUS), for unofficial and official reasons, must report that travel to the Special Security Office (SSO) using the DTRA Form 195 (DTRA/SCC-WMD Foreign travel

Questionnaire, part 1, Pre-Travel). Within five working days of the completion of the trip reply to the post-travel email that you will receive from the SSO.

4. All contractors with SCI access will report contact with a foreign national, which meets the following criteria, to the SSO within

72 hours, or immediately following an OCONUS trip:

a. That is of a close continuing associations (i.e., communicating regurlarly via telephone, e-mail, etc), characterized by ties of kinship, casual contacts and associations arising from living in a community normally need not be reported.

b. In which illegal or unauthorized access is sought to classified, sensitive, or proprietary information or techology, either within or outside the scope of the employee's official activities, or curiosity or normal business inquiries.

Item 10e(1) and (2): a.) Classified material generated in support of this SCI contract is not releasable to foreign nationals without the written permission of Defense Intelligence Agency (DIA) and Director, DTRA/SCC-WMD through the Special Security Office

(SSO), Security & Counterintelligence Office.

b.) SCI documents received under this contract may not be released to subcontractors without the permission of DTRA/SCC-WMD, SSO, Security & Counterintelligence Office.

c.) The Prime Contractor is not authorized to issue subcontract in furtherance of the security requirements delineated in this specification without the written coordination and approval of the DTRA/SCC-WMD SSO. All DD Form 254's issued to subcontractors must be coordinated and approved by the DTRA/SCC-WMD SSO prior to the issuance of the DD Form 254 by the

Prime Contractor.

d.) Contractor generated or Government furnished material is not releasable to the Defense Technical Information Center (DTIC).

Technical reports will bear the statement "Not Releasable to DTIC".

e.) Contractor will access SCI information at an approved DTRA/SCC-WMD Sensitive Compartmented Information Facility (SCIF) only or the nearest servicing Special Security Office where the actual performance of the contract is being done. A Co-User

Agreement (CUA) between DTRA/SCC-WMD, SSO and the servicing SSO (site location) is required to provide the assistance and must be approved and in place.

f.) The contractor is required to adhere to the NISPOM and any revisions to the manual, ICD 700 (Protection of National Intelligence, 21 September 2007), ICD 701 (Security Policy for Unauthorized Disclosures of Classified Information), ICD 705 (Sensitive

Compartmented Information Facilities, 26 May 2010, Intelligence Community Standard-ICS 705-1, 17 September 2010, ICS 705-2, 17 September 2010, and DoDM 5105.21, Volumes 1-3, Sensitive Compartmented Information (SCI) Administrative Security Manual, dated 19 October 2012 for the proper handling and protection of SCI material.

g.) Upon expiration of this contract, the contractor shall request disposition instructions for all classified and unclassified project material. The contractor may be directed to properly destroy the material or return it. If classified or unclassified project material is to be retained by tbe contractor, every effort will be taken to transfer it to a follow on contract or similar effort. Unless written authorization by the contracting office to retain specific material for a specific period of time is received, the material shall be returned or destroyed as instructed.

Item 10g: Contractor access to North Atlantic Treaty Organization (NATO) and Foreign Government Information requires a final U.S.

Government clearance at the appropriate level.

Reference: DTRA Memorandum, North Atlantic Treaty Organization (NATO) Security Briefing for Secure Internet Protocol Router

Network (SIPRNET) Users.

All DTRA's contractors that require a SIPRNET account must be briefed on NATO.

Item 10h: Contractor access to Foreign Government Information requires a final U.S. Government clearance at the appropriate level.

Individuals should be briefed on NATO at the appropriate locations.

Item 10j: All "For Official Use Only" information shall be marked, safeguarded, transmitted, and disclosed in accordance with DoD

Manual 5200.01, Volume 3, Protection of Classified Information.

Item 10k: Alternative Compensatory Control Measures (ACCM). The Joint Staff Focal Point Program (JSFPP) is a Chairman of the

Joint Chiefs of Staff (CJCS) directed system that applies ACCMs to the handling of operationally sensitive information necessary to support the warfighter. Access to ACCM information is strictly controlled and must receive approval from the DTRA Focal Point

Program Control Officer (FPPCO) or appointed alternative, prior to being granted access. The FPPCO or appointed alternative will ensure approved personnel are briefed for access to applicable ACCMs. Access requires a final USG SECRET or TOP SECRET clearance, depending on material being accessed, and must be coordinated through the DTRA FPPCO. Contractor granted access to

ACCMs shall follow the guidelines as outlined in DoDM 5200.01 V2 & V3, DoD Information Security Program and CJCSM

3213.02C, The Joint Staff Focal Point (FP) Program.

1. The DTRA FPPCO or appointed alternate is responsible for:

a. Determining which personnel assigned to the contract has a NTK for FP program(s) for which they are responsible. All contractors may not necessarily be read-on to every FP program maintained by DTRA.

b. Providing program indoctrination briefing and providing specific security guidelines and requirements at the time of indoctrination.

c. Developing and maintaining the Access Control List of who has been granted access to individual FP program information and updating this list as required to maintain currency.

2. The Contractor shall be responsible for:

a. Ensuring individuals notify FPPCO for debriefing and adhere to their responsibilities for properly protecting program information when NTK is no longer demonstrated. Each individual is responsible for returning or destroying any program information material they hold.

b. If a contractor who has current access to a FPP is being detailed to an organization or another contract where they will not have a NTK for the program, they shall notify the FPPCO so they can be removed from the program.

c. Reporting all security violations immediately to the DTRA FPPCO or appointed alternative and the COR.

3. Additional briefings may be required as determined by the DTRA FPPCO.

Dissemination and Extraction of Information Controlled by Originator (ORCON). Contractor requires access to ORCON information.

Permission of the contracting activity is required prior to subcontracting. ORCON is a restrictive dissemination control marking under the purview of the DNI based on the National Security Act of 1947 Section 103(c)(5). Information bearing this marking may be disseminated to personnel on this DTRA contract and Government personnel of the recipient agency. Dissemination to personnel outside of this contract requires approval of the COR. Information marked ORCON may be incorporated in whole or in part into other briefings or products, provided the briefing or product is presented or distributed only to original recipients of the information.

Item 11c: All classified information received or generated under this contract is the property of the U.S. Government. At the termination or expiration of this contract, the U.S. Government will be contacted for proper disposition instructions. The PM/COTR will provide the appropriate Security Classification Guides to the contractor in support of this contract. Any security classification guidance will be provided by the Program Manager under separate cover. This applies to the actual performance location only.

Item 11d: The contractor is required to fabricate, modify, and store classified hardware. The Government will provide one work area and computer with DTRA network access. Under no circumstances shall individuals working on this contract remove from DTRA any classified electronic media without approval and permission.

All contractors in privileged user positions must have a completed single scope background investigation (SSBI) in accordance with

DOD I 8500.2, 6 February 2003, paragraph E3.4.8. and Table E3.T1, prior to filling the position. Privileged users are defined as, but not limited to, persons in the following roles or positions: Information Assurance Managers/Officers, supervisors of IT positions, system administrators, maintainers of IA-enabled products such as routers, switches, firewalls, personnel performing system monitoring and testing, and personnel who issue Classified PKI certificates.

Item 11j: OPSEC requirements apply. All contractors supporting this effort will receive initial and annual refresher OPSEC training and will be reminded of their continued responsibility to protect sensitive information.

At a minimum the contractor will adhere to the guidelines set forth in the Agency's OPSEC Policy Statement and Critical Information

List. Additionaly, the contractor will develop a Critical Information List specific to their portion of the contract work which will identify any sensitive/unclassified information which if disclosed may tip an adversary as to our intentions and/or capabilities.

Additionally, Critical Program Information (CPI) must be identified and protected IAW DoD Instruction 5200.39, Critical Program

Information Protection Within the Department of Defense, July 16, 2008. CPI is the classified, highly sensitive information pertaining to a program which if compromised could cause significant degradation in mission effectiveness; shorten the expected life span of the program; significantly alter program direction; or enable an adversary to defeat, counter, copy, or reverse engineer the technology or capability

Item 13d: In contracts involving SCI/SAP information, the contractor is not authorized to issue subcontracts in furtherance of the security requirements delineated in this specification without the written authorization of the DTRA SSO.

Item 13e: In accordance with DTRA Policy and DTRA Instruction 5240.06, DTRA Counterintelligence Awareness, Briefing, and

Reporting Programs, dated Feb 6, 2004, section 4 under Policy, all contractors working under DTRA contracts are required to comply with the following:

4.1. All DTRA contractors will receive a CI Awareness Briefing upon in-processing at DTRA. All DTRA contractors will receive an annual update of the CI Awareness Briefing.

4.2 Prior to any official travel outside the Continental United States (OCONUS) or while attending domestic or overseas meetings, conferences or symposiums where meetings with foreign nationals are expected, all DTRA contractors and personnel contracted by

DTRA traveling via agency sponsored or supported activities or another DoD component, will contact the BDC or the local SC Field

Office to receive a AOR Specific Travel Briefing, no more than 90 days prior to any OCONUS travel in accordance with DoD

Directive 2000.16 (reference (b).

In accordance with DODI 2000.16, Antiterrorism (AT) Standards, Standard 19; and DTRA Directive 2000.12, DTRA Antiterrorism

Program, Standard 19 requires all DTRA employees and on-site DOD contractors at all DTRA locations to be provided AT Level I

Training. The Security and Counterintelligence Directorate will be responsible for ensuring completion of annual AT Level I

Training.

All personnel at DTRA (civilian, military, contractor or other government agency personnel), in accordance with DTRA instructions and policies, the use of personally owned electronic devices are prohibited in the DTRA facility . Unauthorized introduction of such devices into the DTRA facility constitutes a security incident; which will be followed with a security incident inquiry/report for corrective action. Unless issued/approved by DTRA, all electronic devices which require access into the DTRA facility must be coordinated and approved through the Security and Counterintelligence, Technical Security Branch.

The use of the public world-wide web/internet services is not authorized to discuss, disseminate, produce or transmit "For Official Use

Only" information and classified information

All personnel at DTRA (military, civilian, contractor or other government agency personnel) that require a permanent DTRA badge or access to the DTRA LAN must receive an in-processing security brief before issuance of a DTRA badge or access to the DTRA LAN.

Contractors or other government agency employees working at or supporting DTRA must be in DTRA spaces a minimum of three days per week for a DTRA permanent badge to be issued to them. Some contractors or other government agency employees working at or supporting DTRA may be required to have a DTRA LAN account. Contractors or other government agency employees working at or supporting DTRA that will be issued a DTRA permanent badge or a DTRA LAN account must in-process and receive a security briefing.

All personnel that possess a DTRA permanent badge or have access to the DTRA LAN must receive an out-processing security debrief in the event they are terminating employment, retiring, no longer supporting DTRA, being reassigned to another government agency, or will be absent from duty or employment for more than 60 consecutive days. Failure to do so may adversely affect departing personnel’s security clearance and future employment.

This sentence relates to full time DTRA contractors, and personnel who are contracted by DTRA that are located in other regions, academia, etc.

All contractors that will be working in DTRA space and/or having access to the Local Area Network are required to in and out process through Personnel Security.

The signatures below indicate this contract has been coordinated with the DTRA, Special Security office (SSO) for SCI Information, Security Operations Branch and the DTRA Program Manager. For assistance on the contract, please contact the Program Manager listed below.

Program Manager:

___________________________________DATE:_________________Phone:________________

Printed Name

____________________________________ (Signature)

Special Security Office (SSO):

____________________________________DATE:_________________Phone:________________

Printed Name

____________________________________ (Signature)

Security Operations Branch:

____________________________________DATE:________________Phone:_______________

Printed Name

____________________________________ (Signature)

Timberlyn M. Harrington 06/10/2015 703-375-6258