Attachment_5_HDTRA1-18-R-0045_DD254.pdf

CLASSIFICATOIN (When filled in):_____________________________________

DD Form 254, NOV 2017

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(Please read Instructions BEFORE completing this application.) (The requirements of the National Industrial Security Program

(NISP) apply to all security aspects of this effort.)

OMB No. 0704-0567 OMB approval expires October 31, 2020

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY CLEARANCE (FCL) REQUIRED

(See instructions)

Top Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/MATERIAL

REQUIRED AT CONTRACTOR FACILITY

None

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (x and complete as applicable)

a. PRIME CONTRACT NUMBER

X

a. ORIGINAL (Complete date in all cases)

DATE (YYYYMMDD)

20180709

b. SUBCONTRACT NUMBER

b. REVISED

(Supersedes all previous specs)

REVISION NO. DATE (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

c. FINAL (Complete item 5 in all cases)

DATE (YYYYMMDD)

HDTRA1-18-R-0045

4. IS THIS A FOLLOW-ON CONTRACT? X

NO

YES. If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? X

NO YES. If Yes, complete the following:

In response to the contractor’s request dated , retention of the identified classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

f. SPECIAL ACCESS PROGRAMS (SAP) INFORMATION

b. RESTRICTED DATA

g. NORTH ATLANTICE TREATY ORGANIZATION (NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (If CNWDI applies, RESTRICTED DATA must also be marked) X

h. FOREIGN GOVERNMENT INFORMATION

i. ALTERNATIVE COMPENSATORY CONTROL MEASURES (ACCM)

d. FORMERLY RESTRICTED DATA

e. NATIONAL INTELLIGENCE INFORMATION

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions)

(1) Sensitive Compartmented Information (SCI) X

k. OTHER (Specify) (See instructions.)

(2) Non-SCI X

PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATOIN (When filled in):_____________________________________

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions)

X

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY (Applicable only if there is no access or storage required at contractor facility. See instructions)

h. REQUIRE A COMSEC ACCOUNT

i. HAVE TEMPEST REQUIREMENTS

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

c. FABRICATE, MODIFY, OR STORE CLASSIFIED INFORMATION OR

MATERIAL

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE l. RECEIVE, STORE, OR GENERATE CONTROLLER UNCLASSIFIED INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements.

Non-DoD Components: See instructions.)

X e. PERFORM SERVICES ONLY

X

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

m. OTHER (Specify) (See instructions)

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION

CENTER

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial

Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone number contact information and if available, an e-mail address. (See instructions)

Direct X Through (Specify) PUBLIC RELEASE AUTHORITY:

Defense Threat Reduction Agency

8725 John J. Kingman Road, MS 6201

Ft. Belvoir, VA 22060-6201

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

Item 13a: The contractor shall comply with the Security Agreement (DD Form 441) including the NISPOM and any revisions to that manual, notice of which has been furnished to the contractor.

Item 13b: The contractor's employees performing work under this contract shall be U.S. citizens and been granted appropriate security clearance, based on the need for access to specific classified information. That is SECRET clearance based on favorably adjudicated National Agency Check with Law and Credit Check (NACLC) or a TOP SECRET clearance based on a

Single Scope Background Investigation (SSBI) favorably adjudicated by the Defense Security Service, DoD Central

Adjudicative Facility, Fort Meade, Maryland 20755.

All contractors in privileged user positions must have a completed SSBI in accordance with by DoDI 8500.01, "Cybersecurity

“Information Assurance (IA) Implementation”, 14 March 2014, prior to filling the position. Privileged users are defined as, but not limited to, persons in the following roles or positions: Information Assurance Manager/Officer, supervisors of Information

Technology positions, System Administrator, maintainers of IA-enabled products such as routers, switches, firewalls, personnel performing system monitoring and testing, and personnel who issue classified Public Key Infrastructure certificates.

Item 13c: Should the contractor visit or perform work in support of this contract at any DTRA facility, the contractor shall submit proof of clearance thru JPAS to SMO Code GQDD614 or fax a Visit Authorization Request (VAR) to The DTRA

Security and Counterintelligence Office (ATTN: Visitor Services). VARs shall contain the information specified in paragraph

6-104 of the NISPOM. VARs may be faxed to (703) 767-7857. The term of the VAR shall be for the period of contract performance. All classified visit request by contractors should be forwarded to the Program Manager for approval and need-to-know.

(See continuation page for additional Security Guidance instructions.)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract.

No x Yes (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. Use Item 13 or click button if additional space is needed.)

See block 13; Item 10j.

CLASSIFICATOIN (When filled in):_____________________________________

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the CSO. No X Yes

(If Yes, explain and identify specific areas and government activity responsible for inspections. Click button or use Item 13 if additional space is needed.)

See block 13; Item 10e.

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICIAL (See instructions.)

c. ADDRESS (Include ZIP Code)

Defense Threat Reduction Agency HDTRA1 8725 John J Kingman Rd, Fort Belvoir, VA

22060

d. POC NAME (See instructions) e. POC TELEPHONE (Include Area Code) f. EMAIL ADDRESS (See instructions)

John Sheffer 5716166743 john.m.sheffer.civ@mail.mil

17. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See instructions)

b. TITLE 8725 John J Kingman Rd, Fort Belvoir, VA

22060 Pamela Gray Security Specialist

d. ACC OF THE CONTRACTING OFFICE

(See instructions)

e. CAGE CODE OF THE PRIME

CONTRACTOR (See instructions)

HDTRA1

f. TELEPHONE (Include Area Code) g. EMAIL ADDRESS (See instructions) h. DATE i. SIGNATURE

5716166296 pamela.d.gray8.civ@mail.mil

18. REQUIRED DISTRIBUTION BY CERTIFYING OFFICIAL

X a. CONTRACTOR f. OTHERS AS NECESSARY

b. SUBCONTRACTOR

X c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

X e. ADMINISTRATIVE CONTRACTING OFFICER

BLOCK 13 (CONTINUED)

HDTRA1-18-R-0045

Item 10e(1): In accordance with DoDM 5105.21, Volumes 1-3, Sensitive Compartmented Information (SCI) Administrative Security

Manual, dated 19 October 2012, and the Continued Responsibility Form that all contractors sign when they are SCI indoctrinated, all contractors performing work on a DTRA contract that requires SCI access must comply with the following:

1. All contractor employees requiring SCI must be U.S. citizens and be eligible for a TOP SECRET clearance and have met the

Intelligence Community Directive (ICD) 704, (Personnel Security Standards and Procedures Governing Eligibility for Access to SCI and Other Controlled Access Program Information, 1 October 2008 and Intelligence Community Policy Guidance-ICPG 704.1, 704.2, 704.3, 704.4, and 704.5), requirements prior to granting of SCI access. Clearance is based on a Single Scope Background

Investigation (SSBI) adjudicated by Defense Security Service (DSS) in Columbus, Ohio. Individual must be indoctrinated for SCI prior to being given access to such information. It is the Contractor/Facility Security Officer's responsibility to ensure that the SSBI is current and that a PPR/PR is submitted in a timely manner for all of their contractor employees performing SCI work.

2. All DTRA contractors will receive their initial SCI indoctrination/training once granted eligibility by the Defense Intelligence

Agency (DIA) or the Department of Defense (DoD CAF). All contractors are also obligated to annually complete the DTRA SCI refresher training.

3. All contractors with SCI access, prior to traveling outside the Continental United States (OCONUS), for unofficial and official reasons, must report that travel to the Special Security Office (SSO) using the DTRA Form 195 (DTRA Foreign travel Questionnaire, part 1, Pre-Travel). Within five working days of the completion of the trip reply to the post-travel email that you will receive from the

SSO.

4. All contractors with SCI access will report contact with a foreign national, which meets the following criteria, to the SSO within

72 hours, or immediately following an OCONUS trip:

A. That is of a close continuing associations (i.e., communicating regularly via telephone, e-mail, etc.), characterized by ties of kinship, casual contacts and associations arising from living in a community normally need not be reported.

B. In which illegal or unauthorized access is sought to classified, sensitive, or proprietary information or technology, either within or outside the scope of the employee's official activities, or curiosity or normal business inquiries.

Item 10e(1) and (2): a.) Classified material generated in support of this SCI contract is not releasable to foreign nationals without the written permission of Defense Intelligence Agency (DIA) and Director, DTRA through the Special Security Office (SSO), Security &

Counterintelligence Office.

b.) SCI documents received under this contract may not be released to subcontractors without the permission of DTRA, SSO, Security

& Counterintelligence Office.

c.) The Prime Contractor is not authorized to issue subcontract in furtherance of the security requirements delineated in this specification without the written coordination and approval of the DTRA SSO. All DD Form 254's issued to subcontractors must be coordinated and approved by the DTRA SSO prior to the issuance of the DD Form 254 by the Prime Contractor.

D.) Contractor generated or Government furnished material is not releasable to the Defense Technical Information Center (DTIC).

Technical reports will bear the statement "Not Releasable to DTIC".

E.) Contractor will access SCI information at an approved DTRA Sensitive Compartmented Information Facility (SCIF) only or the nearest servicing Special Security Office where the actual performance of the contract is being done. A Co-User Agreement (CUA) between DTRA, SSO and the servicing SSO (site location) is required to provide the assistance and must be approved and in place.

F.) The contractor is required to adhere to the NISPOM and any revisions to the manual, ICD 700 (Protection of National

Intelligence, 21 September 2007), ICD 701 (Security Policy for Unauthorized Disclosures of Classified Information), ICD 705

(Sensitive Compartmented Information Facilities, 26 May 2010, Intelligence Community Standard-ICS 705-1, 17 September 2010, ICS 705-2, 17 September 2010, and DoDM 5105.21, Volumes 1-3, Sensitive Compartmented Information (SCI) Administrative

Security Manual, dated 19 October 2012 for the proper handling and protection of SCI material.

G.) Upon expiration of this contract, the contractor shall request disposition instructions for all classified and unclassified project material. The contractor may be directed to properly destroy the material or return it. If classified or unclassified project material is to be retained by the contractor, every effort will be taken to transfer it to a follow on contract or similar effort. Unless written authorization by the contracting office to retain specific material for a specific period of time is received, the material shall be returned or destroyed as instructed.

Item 10f: SAP Material and Information: SAP Material and Information: SAP access requirements will be vetted through the DTRA

Special Programs Manager (DTRA SAPCON) and DTRA Program Security Officer (PSO), who will coordinate access requirements with the organization owning the SAP or SAP material. The contractor will comply with applicable DoD and NISP documents and the

Security Classification Guide (SCG) for the DTRA SAP and/or external SAPs worked on while on contract with DTRA, which will be provided under separate cover. The contractor will only perform work on SAP information and materials in an accredited DTRA

SAPF, or a SAPF accredited by the organization owning the SAP or SAP information. All contractor personnel who are required to have SAP access must meet the requirements specified in Department of Defense Manual 5205.07, Volume 2, Dated: 24 November

2015. Unless otherwise approved, the contractor shall not retain any SAP material or information upon the termination of this contract.

Item 10g: Contractor access to North Atlantic Treaty Organization (NATO) and Foreign Government Information requires a final U.S.

Government clearance at the appropriate level.

Reference: DTRA Memorandum, North Atlantic Treaty Organization (NATO) Security Briefing for Secure Internet Protocol Router

Network (SIPRNET) Users.

All DTRA's contractors that require a SIPRNET account must be briefed on NATO.

Item 10h: Contractor access to Foreign Government Information requires a final U.S. Government clearance at the appropriate level.

Individuals should be briefed on NATO at the appropriate locations.

Item 10j: All "For Official Use Only" information shall be marked, safeguarded, transmitted, and disclosed in accordance with DoD

Manual 5200.01, Volume 3, Protection of Classified Information.

Item 11a: The location for contract performance is at another contractor address, or Defense Threat Reduction Agency (DTRA) 8725

John J. Kingman Road, Fort Belvoir, Virginia and other DTRA sites.

Item 11e: The contractor is performing logistical support and services only. Classification markings on material furnished contractor will provide the classification guidance necessary for the performance of the contract.

PERFORM SERVICES ONLY CONTRACTS:

Although contract does not require access to classified information, employees supporting this effort will be in areas where visual and aural access to classified information cannot be precluded.

Item 11f: Access to classified information OCONUS shall only take place at NATO, SHAPE, and approved US Government facilities.

Item 13d: In contracts involving SCI/SAP information, the contractor is not authorized to issue subcontracts in furtherance of the security requirements delineated in this specification without the written authorization of the DTRA SSO.

Item 13e: In accordance with DTRA Policy and DTRA Instruction 5240.06, DTRA Counterintelligence Awareness, Briefing, and

Reporting Programs, dated Feb 6, 2004, section 4 under Policy, all contractors working under DTRA contracts are required to comply with the following:

4.1. All DTRA contractors will receive a CI Awareness Briefing upon in-processing at DTRA. All DTRA contractors will receive an annual update of the CI Awareness Briefing.

4.2 Prior to any official travel outside the Continental United States (OCONUS) or while attending domestic or overseas meetings, conferences or symposiums where meetings with foreign nationals are expected, all DTRA contractors and personnel contracted by

DTRA traveling via agency sponsored or supported activities or another DoD component, will contact the BDC or the local SC Field

Office to receive a AOR Specific Travel Briefing, no more than 90 days prior to any OCONUS travel in accordance with DoD

Directive 2000.16 (reference (b).

In accordance with DODI 2000.16, Antiterrorism (AT) Standards, Standard 19; and DTRA Directive 2000.12, DTRA Antiterrorism

Program, Standard 19 requires all DTRA employees and on-site DOD contractors at all DTRA locations to be provided AT Level I

Training. The Security and Counterintelligence Directorate will be responsible for ensuring completion of annual AT Level I

Training.

All personnel at DTRA (civilian, military, contractor or other government agency personnel), in accordance with DTRA instructions and policies, the use of personally owned electronic devices are prohibited in the DTRA facility . Unauthorized introduction of such devices into the DTRA facility constitutes a security incident; which will be followed with a security incident inquiry/report for corrective action. Unless issued/approved by DTRA, all electronic devices which require access into the DTRA facility must be coordinated and approved through the Security and Counterintelligence, Technical Security Branch.

The use of the public world-wide web/internet services is not authorized to discuss, disseminate, produce or transmit "For Official Use

Only" information and classified information

All personnel at DTRA (military, civilian, contractor or other government agency personnel) that require a permanent DTRA badge or access to the DTRA LAN must receive an in-processing security brief before issuance of a DTRA badge or access to the DTRA LAN.

Contractors or other government agency employees working at or supporting DTRA must be in DTRA spaces a minimum of three days per week for a DTRA permanent badge to be issued to them. Some contractors or other government agency employees working at or supporting DTRA may be required to have a DTRA LAN account. Contractors or other government agency employees working at or supporting DTRA that will be issued a DTRA permanent badge or a DTRA LAN account must in-process and receive a security briefing.

All personnel that possess a DTRA permanent badge or have access to the DTRA LAN must receive an out-processing security debrief in the event they are terminating employment, retiring, no longer supporting DTRA, being reassigned to another government agency, or will be absent from duty or employment for more than 60 consecutive days. Failure to do so may adversely affect departing personnel’s security clearance and future employment.

This sentence relates to full time DTRA contractors, and personnel who are contracted by DTRA that are located in other regions, academia, etc.

All contractors that will be working in DTRA space and/or having access to the Local Area Network are required to in and out process through Personnel Security.

CLASSIFICATION (When filled in):_____________________________________

CLASSIFICATION (When filled in):_____________________________________

The signatures below indicate this contract has been coordinated with the DTRA Program Manager, the Special Security Officer

(SSO) for SCI Information, the DTRA SAP Control Officer (SAPCON) and SAP Program Security Officer (PSO) for SAP information. For further assistance on the contract please contact the DTRA Program Manager listed below.

Program Manager:

___________________________________DATE:_________________Phone:________________

Printed Name

____________________________________ (Signature)

Special Security Office (SSO):

____________________________________DATE:_________________Phone:________________

Printed Name

____________________________________ (Signature)

DTRA SAPCON:

____________________________________DATE:_________________Phone:_________________

Print Name

_____________________________________(Signature)

Program Security Officer (PSO):

_________________________________DATE:_________________Phone:_________________

Printed Name

___________________________________(Signature)