J-02 DD254_HM047625R0016_20250311.pdf

CLASSIFICATION (When filled in): UNCLASSIFIED

PREVIOUS EDITION IS OBSOLETE. Page 1 of 9

AEM LiveCycle Designer

DD FORM 254, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED

(See Instructions)

Top Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

None (See instructions)

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER

HM047625R0016

DUE DATE (YYYYMMDD)

20250310

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

20250310

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.HM047621D0009

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor) Add Row Remove last Row Delete All Rows

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.) Add Row Remove last Row Delete All Rows

a. LOCATION(S) (For actual performance, see instructions.)

National Geospatial-Intelligence Agency 7500 GEOINT Drive Springfield, VA 22150

b. CAGE CODE (If applicable, see Instructions.)

HM0476

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional) National Geospatial-Intelligence Agency Industrial and Physical Security Division 7500 GEOINT Drive Springfield, VA 22150 571-557-3355

a. LOCATION(S) (For actual performance, see instructions.)

National Geospatial-Intelligence Agency 3200 South Second Street St. Louis, MO 63118

b. CAGE CODE (If applicable, see Instructions.)

HM1575

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional) National Geospatial-Intelligence Agency Industrial and Physical Security Division 7500 GEOINT Drive Springfield, VA 22150 571-557-3355

PREVIOUS EDITION IS OBSOLETE. Page 2 of 9

AEM LiveCycle Designer

DD FORM 254, APR 2018

a. LOCATION(S) (For actual performance, see instructions.)

National Geospatial-Intelligence Agency 3838 Vogel Road Arnold, MO 63010

b. CAGE CODE (If applicable, see Instructions.)

HM1575

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional) National Geospatial-Intelligence Agency Industrial and Physical Security Division 7500 GEOINT Drive Springfield, VA 22150 571-557-3355

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

FS3i is a follow-on to the current FS2 contract being executed by Leidos. The intent of FS3i is to provide IT services to enable the operations and sustainment of Foundation GEOINT capabilities for our DOD, IC and international partners. FG includes data, information, products and services of earth.

Effort Name-Foundation Sustainment Support, Software, and Integration (FS3i)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.) h. FOREIGN GOVERMENT INFORMATION

d. FORMERLY RESTRICTED DATA i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

See box 13: PII, eNom, Foreign Trvl, Govt Furnished Property & Info Accounting for Classified, Classification Guidance

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

See box 13: Info Handling, Inspections & Incident Reporting, Protection of Unclass Info, Public Release

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below) Public Release Authority:

See Section 13

13. SECURITY GUIDANCE Add Signature Remove last Signature Delete All Signatures

PREVIOUS EDITION IS OBSOLETE. Page 3 of 9

AEM LiveCycle Designer

DD FORM 254, APR 2018

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

Questions regarding this solicitation DD Form 254 should be directed to the Technical POC for this solicitation. Prime contractor will provide copies of subcontractor DD Form 254s to NGA Industrial Security. For security issues for the solicitation please contact NGA Industrial Security Help Desk at: IndustrialSecurity@nga.mil for UNCLASSIFIED messages

DD Form 254 review date: 01 March 2027 Base: 3/02/2026 - 03/01/2027

OY1: 03/02/2027 - 03/01/2028

OY2: 03/02/2028 - 03/01/2029

OY3: 03/02/2029 - 03/01/2030

OY4: 03/02/2030 - 03/01/2031

OY5: 03/02/2031 - 03/01/2032

OY6: 03/02/2032 - 03/01/2033

At the time of DD Form 254 generation:

CO: Jimmy C. Ober COR: Bao H. Le

Accounting for Classified:

As indicated in the 32 CFR part 117, contractors authorized for safeguarding shall establish an information management system to protect and control the classified information in their possession. Contractors shall ensure that classified information in their custody is used or retained only for a lawful and authorized U.S. Government purpose. The U.S. Government reserves the right to retrieve its classified material or to cause appropriate disposition of the material by the contractor. The information management system employed by the contractor shall be capable of facilitating such retrieval and disposition in a reasonable period of time. Authorized NGA personnel may request and receive a listing from the contractor’s information system of all classified entrusted to the contractor from NGA or in connection to this contract for NGA. Authorized personnel consist of NGA program personnel for the contract and personnel from NGA Security. If there is any doubt if the person is authorized access, clarification will be made by Industrial Security or the contracting officer of record.

Retention of classified after the period of performance is only authorized long enough to properly close out the contract and properly dispose of classified as directed by the contracting officer or representative. The manner of disposing of classified shall adhere to the32 CFR part 117. A copy of the certification of disposition by the contractor of government furnished property and information shall be provided to Industrial Security if classified was released to the safekeeping of the contractor.

Classification Guidance:

Access to specific classification guides for this program will be provided by the program office or COR on this effort directly to the contractor.

With the type of environment NGA operates in, the contractor may be exposed to other NGA programs or classified information not associated with this contract or the information may not be referenced in the program classification guides but may be referenced in the Consolidated NGA Security Classification Guide (CoNGA SCG). The contractor program manager or contractor security office can request access to the guides from the NGA program office who will provide links to the requested security guides. Current security guides can also be found on JWICS

E-Nomination Portal:

NGA Contractor SCI nomination process is completed within a web-based portal known as the e-Nomination portal. To gain access to the e-Nomination portal the prime contractor shall delegate a security professional to make the nominations. The number of personnel assigned to make nominations is limited per the COR. For technical issues the prime contractor will need to contact the e-Nomination support team via e-mail. The following information of the security professional shall be provided to the COR to generate an e-Nomination account.

1. Full Name

2. Primary e-mail address

3. Alternate e-mail address: in case the primary e-mail address holder is not available. It is recommended that this be a group e-mail box or

PREVIOUS EDITION IS OBSOLETE. Page 4 of 9

AEM LiveCycle Designer

DD FORM 254, APR 2018

distribution list.

4. Physical Address Once a nomination is submitted, the e-Nomination portal assigns an e-Nomination Number to the submission. In an effort to provide better OPSEC and protect personal identification information when corresponding via unsecure means (encrypted e-mail authorized) the prime contractor is not authorized to pair the nominated individual’s name with the assigned e-Nomination number. If the prime contractor misplaces their copy of nomination personnel and e-Nomination numbers list, the prime contractor security office shall contact the COR for assistance. NGA Industrial Security and NGA Personnel Security may be contacted for assistance if the COR is not available. Only a limited number of personnel in these offices have access to this information and may not be available for assistance at the time of call.

Foreign Travel:

Contractors with SCI access, conducting official or unofficial travel outside the Continental United States shall enter travel details into PeopleSoft 30 days prior to the trip. Upon reentry into the Continental United States, the individual has 10 calendar days to complete post travel forms located in PeopleSoft. If the individual does not have access to PeopleSoft, their information can be entered into PeopleSoft by their COR or FSO (this also applies to the post travel forms).

Government Furnished Property and Information:

If contract personnel are issued a Common Access Card (CAC) the contract personnel will follow the directions of their assigned Trusted Agent for the CAC. When contract personnel depart the contract they will need to notify their assigned Trusted Agent. If the contract personnel will no longer be supporting NGA via an NGA contract the CAC shall be turned in to the NGA Site CAC Office, the Trusted Agent or the COR. If contract personnel are unable to contact the Trusted Agent or return the CAC, it is the contractor security office’s responsibility to collect the CAC from the individual and notify and seek further direction from the COR and Industrial Security the same day.

Personnel on this contract may be issued other types of government identification or other items (together or separately is referred as items). These items are not limited to but may include the Intelligence Community Access Badge, tokens or NGA Parking Hang Tag.

When contract personnel depart the contract, the contracting company must notify the COR, the program office, and Industrial Security. If the contract personnel will no longer be supporting NGA via an NGA contract the items shall be turned into the NGA Workforce Support Center or the COR. If contract personnel are unable to turn these items in to the Workforce Support Center or COR, it is the contractor security office’s responsibility to collect the items from the individual to include completing any debriefing paperwork needed and notify and seek further direction from the COR or Industrial Security. Items shall be returned within 4 business days (timeline may be extended with authorized documented exceptions by NGA Security) to an NGA Site Security office. The contractor shall track and record delivery of items collected and keep the receipts of the returned items for the life of the contract and be able to present them for review if requested by NGA Security Personnel (military/government/contractor). Digitalizing receipts for filing to reduce storage is authorized.

Personnel Security Clearance:

All contractor Tier 5 (T5) Background Investigations – Periodic Reinvestigations (T5R) shall be submitted to the Defense Counterintelligence and Security Agency (DCSA) in a timely manner by the FSO to prevent interruption of continued access.

NGA Personnel Security offers status checks of personnel who have been nominated for SCI access. This is done in two separate methods.

One is done monthly and provides an in-depth review. To obtain this service the contractor security office needs to contact personnel security to establish a monthly reoccurring appointment. The other method is via e-mail. The e-mail status check will provide at what stage the nomination is in such as awaiting COR approval, adjudication action or awaiting additional information. The e-mail status is done bi-weekly. The subject of the e-mail shall be “Status Check”. Multiple nominations can be checked with one e-mail request however the list of personnel must be placed in an Excel compatible document.

Upon request from NGA, a list of all personnel supporting the contract shall be provided within 24 hours of request unless indicated otherwise.

Protection of Personally Identifiable Information (PII):

All PII information shall be safeguarded in accordance with established law, regulation and polices. The contractor will control all PII information connected to NGA as CUI. NGA defines PII as “Information that can be used to distinguish or trace an individual's identity, such as their name, Social Security number, biometric records, etc., alone or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, mother's maiden name, etc.”

A contractor shall report the detection or discovery of suspected or confirmed incidents involving PII to their program manager or COR. If the program manager or COR is unavailable or has a conflict of interest, contact the Privacy Office. The following is a short example list and does not include all that is considered or may be considered PII:

Security Clearance Level Leave Balances; type of leave used Family Data Religion, Race, National Origin Home Address Home Telephone Number Personal E-mail Address Social Security Number Biometric Identification (such as fingerprints)

PREVIOUS EDITION IS OBSOLETE. Page 5 of 9

AEM LiveCycle Designer

DD FORM 254, APR 2018

Date of Birth Place of Birth Mother’s Maiden Name Performance Ratings Participants Names/Results in NGA Courses Alien Registration Number Driver’s License Number Medical or Financial Records

Protection of Unclassified Information:

The Contractor shall not release outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the Contracting Officer has given prior written approval or in performance of a project that has been scoped and negotiated by NGA with the contractor. Release and disclosure guidance provided to subcontractors shall be “all release and disclosure request shall be submitted through the prime contractor to NGA”.

CUI is unclassified information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies. Per NGAI 5200.1, Information Security, Enclosure 15, The primary categories of CUI created by NGA are FOR OFFICIAL USE ONLY (FOUO) and LIMITED DISTRIBUTION (LIMDIS).

NGA uses FOUO to designate CUI that falls under one of the Freedom of Information Act Exemptions, 2 through 9 that can be found in Enclosure 3, Appendix 1 of NGA Instruction 5750.1 Freedom of Information Act / Privacy Act Requests / Mandatory Declassification Review Program. Information that is on the NGA OPSEC Program Critical Information List that can be found in Enclosure 8 of NGA Instruction 5200.4, Operations Security.

Information that is determined to be FOUO, regardless of medium, is indicated by the appropriate markings as provided. In general, markings on an FOUO document indicate the originating agency/office, banner line markings, and portion markings. NGA will continue to utilize the FOUO marking until the Office of the Director of National Intelligence (ODNI) provides further marking guidance to the Intelligence Community.

Public Release:

Unless noted in the contract or FAR, release request of contract information shall be routed to the Contracting Officer by the way of the NGA program office for this contract and/or task orders. Request to release information (classified or unclassified) to international partners requires approval from NGA’s Office of International Affairs.

Security Incident Reporting:

In addition to 32 CFR part 117 requirements, contractors shall report all security incidents, infractions and any other situation if it involves the possibility of unauthorized release or disclosure of classified information to include incidents that jeopardizes classified information.

This includes FGI and NATO classified information. Notification recipients shall include the DCSA IS Rep for the company, NGA Industrial Security, NGA Investigations Division, NGA Continuous Evaluation Unit (CEU), the COR. In addition, the incident must be entered into eReport via PeopleSoft. The Initial notification will consist of only the following information via e-mail of the day of discovery:

Incident type Personnel Involved Contract Number Primary COR Task Order COR Date and Time of Incident Lead Company Investigator for the Incident Estimated Date of Completion of Investigation Incident information can elevate to the level of classified. Be cognizant of the data and the classification level of the report. The investigation incident report shall be transmitted to NGA Investigation Division (for government investigation and determination), NGA Industrial Security (to ensure compliance), and the CORs for the base contract (number located on the DD 254) and the task order contract (if applicable) for contract monitoring. The report will be transmitted by the most secure means possible. Only as a last resort should the investigation report be hand carried to Industrial Security for distribution. If AIS equipment is involved it is the contractor's responsibility to have the AIS equipment properly transported (such as courier authorization) to an NGA facility for investigation, if requested by NGA.

Defense Counterintelligence and Security Agency (DCSA) remains the Cognizant Security Authority (CSA) for individuals performing work with collateral (SECRET or TOP SECRET) security clearances. As such, Security Executive Agent Directive (SEAD) 3 reporting requirements should continue though Defense Information Security System (DISS). DCSA will also dictate mandatory security training as the CSA for the collateral cleared community. Please note, all personnel that have NGA PeopleSoft records, will also be required to complete the NGA mandatory training. This includes any individuals cleared with SECRET or TOP SECRET. The COR can advise which SECRET or TOP SECRET cleared personnel will be required to complete the NGA mandatory training.

PREVIOUS EDITION IS OBSOLETE. Page 6 of 9

AEM LiveCycle Designer

DD FORM 254, APR 2018

Subcontracting requirement:

All subcontracts requiring access to classified information require CO/COR approval first. If CO/COR approves, the CO/COR will send an e-mail notification to Industrial Security to review the subcontractor DD Form 254. Subcontracts not requiring access to classified information still require the contract program office approval.

The prime contractor shall certify their proposed subcontractor is not effectively owned or controlled by a foreign interest or cleared under a Special Security Agreement (SSA). This validation will be through the Defense Counterintelligence and Security Agency. Access to proscribed information by a company cleared under an SSA may require NGA to complete a National Interest Determination (NID) to determine if release of proscribed information to the subcontractor is in the best interest of national security. The subcontractor personnel will not be nominated for or given access to classified information until the NID is validated by NGA Industrial Security.

Industrial Security Branch Support:

NGA is responsible for all SCI connected to this contract. To assist and provide proper oversight to the contractor, NGA will conduct visits to the contractor sites. These visits (commonly known as Customer Assistance Visits or CAVs) will range from one NGA Industrial Security person (who may be military, government, or contractor for security services to NGA) or a team of personnel to provide guidance and assistance in protection of national security information. Other government organization may be invited to attend or be notified of such visits and the results of such visits. There may be other visits (announced and unannounced) to ensure compliance of other security and non-security related requirements. The contractor security professional responsible for the contract will contact NGA Industrial Security to coordinate the CAV annually.

Initially, all physical security requirements connected to ICD 705 will be coordinated through NGA Industrial Security. The NGA Classification Guide provides general classification guidance when dealing with safeguarding SCI. Per ICD 705-2, if a SCIF conference room (accredited under this contract) will be used by another organization (when a Co-utilization/Joint Utilization is not in place or being coordinated) the contractor shall notify Industrial Security via e-mail within 10 days. It is understood at times meetings are scheduled within the 10-day window, in this case immediate notification is required.

If requested NGA Industrial Security will provide a limited supply of physical and digital copies or training aids and reference material such as the NISPOM and ICD 705.

Inspection Reporting:

Contractor is responsible to submit the following Defense Counterintelligence and Security Agency documents to the NGA Industrial Security Branch within 30 days of completion or upon request prior to an NGA Industrial Security Customer Assistance Visit:

• DCSA Results Letter

• Rating Matrix

• List of Vulnerabilities, observations, recommendations, and other documentation provided by DCSA following an inspection

Classified Work Performance Security Requirements:

Contractor personnel performing Top Secret/Sensitive Compartmented Information (TS/SCI) work on the contract are required to have active TS/SCI clearances for access to NGA facilities, when performing duties within TS/SCI environments, and for access to TS/SCI NGA computer systems.

Contractors are subject to a Counterintelligence Scope Polygraph, as requested by the Government. All Contractor personnel shall possess a current Top-Secret Personnel Security Clearance and be eligible for favorable NGA adjudication for SCI access.

The government will be responsible for verifying security clearances/SCI eligibility of the Contractor personnel IAW Security Executive Agent Directive (SEAD) 7: “Reciprocity of Background Investigations and National Security Adjudications”. NGA will sponsor SCI accesses, NGA Badges, Common Access Cards (CAC) and other items (e.g. parking hangtags) when applicable, for required contract personnel.

Contractors must abide by the DD Form 254 - Contract Security Classification Specification and applicable security policies and regulations.

Contractor personnel shall follow all applicable NGA, IC, and DoD information security and operational security policies and guidance during performance of contract requirements.

The Contractor shall inform the Government when its employees no longer support the contract. The Government desires notification prior to the day the individual no longer supports the contract, but requires notification no later than the day support ends.

If Contractor personnel will no longer be supporting NGA via an NGA contract, any debriefing paperwork, notifications, and/or requests for further direction from the COR or Industrial Security shall be turned into the NGA Workforce Support Center, NGA Site Security Office, or the COR.

If Contractor personnel are unable to turn these items into the NGA Workforce Support Center, NGA Site Security Office, or COR then it is the Contractor’s security office’s responsibility to collect the items from the individual. If the Contractor debriefs the employee, the Contractor shall send a copy of the debriefing statement, plus any Government items (e.g. NGA Badge, CAC, Courier Card, parking hangtags, etc.) within four (4) business days (timeline may be extended with authorized documented exceptions by NGA Security) to an NGA Site Security Office or the NGA Workforce Support Center.

All classified work performed at a non-NGA facility must be approved by the COR.

Any classified work performed at collaborator sites must be performed in either an NGA accredited SCIF or Other Government Agency (OGA) SCIF that has either a Memorandum of Agreement (MOA), Memorandum of Understanding (MOU), Joint Use Agreement or Co-

PREVIOUS EDITION IS OBSOLETE. Page 7 of 9

AEM LiveCycle Designer

DD FORM 254, APR 2018

Use Agreement with NGA for this contract.

Cleared Contractor personnel may hand-carry contract-related classified information as authorized by the COR. Contractor personnel will obtain NGA courier authorization prior to hand-carrying of contract-related classified information. Contractor personnel will be limited to hand-carrying classified information between the Contractor facilities and NGA facilities only.

Cleared Contractor personnel will be enrolled into Director of National Intelligence (DNI) Continuous Evaluation System (CES) throughout the lifecycle of the contract while at NGA IAW SEAD 6: “Continuous Evaluation”.

Cleared Contractor personnel must self-report security issues, foreign contacts, and other reporting requirements in accordance with SEAD 3: “Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position” and NGA Instruction 5205.3, “Security Reporting Requirements”. In addition, cleared Contractors will be required to submit electronic fingerprints and will be enrolled into NGA’s Report of Arrest and Prosecution Background (RAPBack) program, which supports CES.

Cleared Contractor personnel, who are designated as Tier 3 Privileged Users or holding enhanced access through a Special/Controlled Access Program (SAP/CAP), will be required to participate in NGA’s annual Security Financial Disclosure Program (SFDP) as directed by D/NGA in the 20 November 2020 memorandum titled “Designation of NGA Personnel Required to Participate in the Security Financial Disclosure Program.

Unclassified Work Performance Security Requirements:

If applicable, and after discussion with the COR, and the COR has provided written approval, uncleared Contractor personnel are authorized to work on this contract up to the Unclassified level, with access to DoD Controlled Unclassified Information (CUI) at the Contractor site without the requirement of a security clearance.

If applicable, and after discussion with the COR, any Contractor personnel working with CUI information must receive a favorable HSPD-12 and/or HSPD-12 Tier 1 adjudication prior to accessing CUI information. Contractor personnel who require access to CUI for 60 days or less must receive a favorable HSPD-12 adjudication. Contractor personnel who require CUI access for greater than 60 days must receive a favorable HSPD-12 Tier 1 adjudication.

NGA will sponsor the HSPD-12 and HSPD-12 Tier 1 background investigation for required program personnel. NOTE: Contractor personnel submitted for SCI access cannot be submitted for a HSPD-12 or HSPD-12 Tier 1 adjudication while waiting for their SCI approval.

Contractor personnel shall not release any unclassified information, regardless of medium (e.g. film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the COR has given prior written approval or in performance of a project that has been scoped and negotiated by NGA.

Contractor personnel visiting NGA facilities and/or sites will receive the appropriate visitor badge and be escorted, as appropriate. The visitor badge will be returned at the end of each visit day. NOTE: NGA reserves the right to refuse access to personnel when necessary.

Contractor personnel are forbidden from bringing in prohibited, unauthorized, and/or Portable Electronic Devices (PEDs) items into any NGA installation or any secure office/working location covered under this agreement. A list of PEDs includes but is not limited to cell phones, cameras, two-way pagers, laptops, recorders (e.g. digital, tape, etc.), flash drives, or any other kind of removable media, without prior approval and approval paperwork from NGA. See NGA instructions/regulations/policy for a full list of prohibited and unauthorized items. Security violation repercussions will be determined on the severity of the violation.

Information Handling:

Contractor personnel will comply with the NGA, DoD, and IC policies and regulations (to include, but not limited to, the Consolidated NGA (CoNGA) Security Classification Guide) to properly mark (to include portion marking) classified and unclassified documentation, media, etc.

Document markings will be in accordance with the lowest security classification possible to ensure the confidentiality and integrity for the greatest release to partners in accordance with NGA and mission partner marking guides for classified information.

All Government-furnished information released to the Contractor or created in the performance of this contract will be destroyed or returned by the Contractor to NGA upon contract termination or when no longer required for contract performance. The determination to destroy or return will be at the direction of the NGA CO or COR.

Ref 10e1: SCI Access required. No public release of information authorized, public disclosure or confirmation of any subject related to the support contract is not authorized without first obtaining written approval from the GCA.

Ref 10e2: Non-SCI Information is not releasable to contractor employees who have not received a clearance at the appropriate security level. Written concurrence of the GCA is required prior to subcontracting. Access to Intelligence information required for performance.

Ref 10g: Personnel not assigned to a NATO staff position, but requiring access to NATO classified information, NATO Secret or access to the NATO accredited Automated Information Systems, must possess the equivalent U.S. Security Clearance based upon the appropriate

PREVIOUS EDITION IS OBSOLETE. Page 8 of 9

AEM LiveCycle Designer

DD FORM 254, APR 2018

personnel security investigation required. Personnel with access to NATO ATOMAL information must have the appropriate level FINAL U.S. Security Clearance. The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees are NATO briefed prior to access being granted. The contractor will maintain strict compliance in regards to NATO information IAW 32 CFR Part 117, NISPOM. Prior approval from the GCA is required for subcontracting. During this contract, the contractor will have access to NATO Information. Upon approval from NGA, the contractor will be indoctrinated at the appropriate access level. Per the NISPOM, contractors are required to have annual NATO refresher training.

Ref 10j: Controlled Unclassified Information (CUI) generated and/or provided under this contract shall be safeguarded and marked as specified in NGAI 5200.1. In accordance with DoD Instruction 5200.48, Controlled Unclassified Information (CUI), CUI information and material may be transmitted via first class mail, parcel post, or, bulk shipments. When practical, CUI information may be transmitted electronically (e.g., data, website, or e-mail), via approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure or transport layer security (e.g., https). Avoid wireless telephone transmission of CUI when other options are available. CUI transmission via facsimile machine is permitted; however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive CUI; facsimile machine located in a controlled government environment).

The absence of the CUI marking on information does not mean the information may be released. Some records may still require protection.

The contract will seek further guidance when needed.

Ref 11a: Contractor performance is restricted to locations identified in Block 8 and 13. Government agency or activity will provide security classification guidance for performance of this contract.

Ref 11j: OPSEC: NGA applies strong OPSEC measures to deny potential adversaries’ access to NGA’s critical information. To ensure the continuation of denial, personnel assigned to this contract shall comply and support the OPSEC plans associated with this contract. The contractor shall remain compliant with NGA OPSEC training requirements. If warranted, the contractor will work with the OPSEC Program Management or the Key Component OPSEC Officer to protect NGA’s critical information.

Ref 11L: RECEIVE, STORE OR GENERATE CONTROLLED UNCLASSIFED INFORMATION (CUI): (DoD Components: refer to DoDI 5200.48 for specific CUI protection requirements. Non-DoD Components: see instructions.)

Max Subcontracting Level: None

[Block 12] DoDAAC[HM0476]

ATTN: MS S84-OCS

NGA Washington 7500 GEOINT Drive Springfield, VA 22150-7500

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form) Show Attachment Bar

NAME & TITLE OF REVIEWING OFFICIAL

LaShawn Dantzler Regional Security Officer

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

PREVIOUS EDITION IS OBSOLETE. Page 9 of 9

AEM LiveCycle Designer

DD FORM 254, APR 2018

See Section 13

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

NGA is responsible for oversight of SCI Ouid [NGA SISI]

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

National Geospatial-Intelligence Agency

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

HM0476

c. ADDRESS (Include ZIP Code) 7500 GEOINT Drive Springfield, VA 22150

d. POC NAME

NGA Industrial Security

e. POC TELEPHONE (Include Area Code)

+1 (571) 557-3355

f. EMAIL ADDRESS (See Instructions) industrialsecurity@nga.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

Buckley, Alan W.

b. TITLE

Industrial Security Specialist

c. ADDRESS (Include ZIP Code)

7500 GEOINT Drive Springfield, VA 22150

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

HM0476

e. CAGE CODE OF THE PRIME CONTRACTOR

(See Instructions.)

f. TELEPHONE (Include Area Code)

+1 (571) 557-5137

g. EMAIL ADDRESS (See Instructions) alan.w.buckley@nga.mil

h. SIGNATURE

i. DATE SIGNED (See Instructions)

20250311

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

industrialsecurity@nga.mil

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification

Industrial and Physical Security Division 7500 GEOINT Drive Springfield, VA 22150 571-557-3355 CSO: National Geospatial-Intelligence Agency Industrial and Physical Security Division 7500 GEOINT Drive Springfield, VA 22150 571-557-3355 CSO: National Geospatial-Intelligence Agency Industrial and Physical Security Division 7500 GEOINT Drive Springfield, VA 22150 571-557-3355

7500 GEOINT Drive Springfield, VA 22150 Location: National Geospatial-Intelligence Agency 3200 South Second Street St. Louis, MO 63118 Location: National Geospatial-Intelligence Agency 3838 Vogel Road Arnold, MO 63010 Block9: FS3i is a follow-on to the current FS2 contract being executed by Leidos. The intent of FS3i is to provide IT services to enable the operations and sustainment of Foundation GEOINT capabilities for our DOD, IC and international partners. FG includes data, information, products and services of earth.

Effort Name-Foundation Sustainment Support, Software, and Integration (FS3i)

DD Form 254 review date: 01 March 2027 Base: 3/02/2026 - 03/01/2027

OY1: 03/02/2027 - 03/01/2028

OY2: 03/02/2028 - 03/01/2029

OY3: 03/02/2029 - 03/01/2030

OY4: 03/02/2030 - 03/01/2031

OY5: 03/02/2031 - 03/01/2032

OY6: 03/02/2032 - 03/01/2033

At the time of DD Form 254 generation:

CO: Jimmy C. Ober COR: Bao H. Le

Accounting for Classified:

As indicated in the 32 CFR part 117, contractors authorized for safeguarding shall establish an…