Attachment16-DD254SecurityGuidelines.doc

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

1. CLEARANCE AND SAFEGUARDING

a. FACILITY CLEARANCE REQUIRED

TOP SECRET SECRET NONE

a. PRIME CONTRACT NUMBER

2008/XX/XX

b. SUBCONTRACT NUMBER

previous specifications)

Classified material received or generated under HQ0006-XX-F-XXXX (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254?

In response to the contractor's request dated retention of the identified classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entry (CAGE) Code)

7. SUBCONTRACTOR

8. ACTUAL PERFORMANCE

a. LOCATION

Missile Defense Agency

7100 Defense Pentagon

Washington, DC 20301-7100

See Block 13, Reference Item 8a (continued)

MDA/DOSS

7100 Defense Pentagon

Washington, DC 20301-7100

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

SETA Support to

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

X

b. RECEIVE CLASSIFIED DOCUMENTS ONLY

X

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

X

e. INTELLIGENCE INFORMATION:

e. PERFORM SERVICES ONLY

X

f. HAVE ACCESS TO CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

X

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

X

h. REQUIRE A COMSEC ACCOUNT

X

i. HAVE TEMPEST REQUIREMENTS

X

i. LIMITED DISSEMINATION INFORMATION

X

l. OTHER (Specify

DD Form 254, December 1999 Previous editions are obsolete 805/340

12.

PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate Government authority. Proposed public release shall be submitted for approval prior to release.

Missile Defense Agency

7100 Defense Pentagon, ATTN: MDA/PA

Washington, DC 20301-7100

13.

SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract: and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

ALL CONTRACTS

ACCESS TO SCI/SAP- CONTRACT SPECIFIC

OFF-SITE WORK AUTHORIZED-CONTRACT SPECIFIC

IDENTIFY ALL PERFORMANCE LOCATIONS

CONTRACT SPECIFIC

NORMALLY ON-SITE

Forward a copy of any DSS letter that informs of any serious deficiency to MDA/DOSS within 48 hours of receipt.

Any incident of possible compromise will be reported to MDA/DOSS within 24 hours.

Reference Item 8.a. (continued) (The Cognizant Security Office in all cases is MDA/DOSS)

Missile Defense Agency, Bldg 5222, Martin Road, Redstone Arsenal, AL 35898

Missile Defense Agency, 106 Wynn Drive, Room 1A2800, Huntsville, AL 35807

Missile Defense Integration and Operations Center, 720 Irwin Ave, Schriever AFB, Colorado Springs, CO 80912

Airborne Laser, Kirtland AFB, Albuquerque, NM 87117

Alaska Command, Elmendorf AFB, AK 99506 Continued on page 3

14.

ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to NISPOM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

No

See Block 13, Reference Item 10.j and 11.l.

15.

INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

No

MDA/DOSS reserves the right to conduct compliance inspections for the protection of BMDS Controlled Unclassified Information. See Reference Items 10.e (1), 10.J, 11.l, 14.

16.

CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a.

TYPED NAME OF CERTIFYING OFFICIAL

d.

ADDRESS (Include Zip Code)

17. REQUIRED DISTRIBUTION

7100 Defense Pentagon

b. SUBCONTRACTOR

Washington, DC 20301-7100

e.

SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

DD Form 254, Reverse, December 1999

SECURITY GUIDANCE (BLOCK 13) CONTINUATION:

Reference Item 10.a & 11.h.: Contractor is required to comply with the requirements of DoD 5220.22-M and NSA/CSS Policy Manual No. 3-16, Control of Communications Security (COMSEC) Material, 5 August 2005.

Reference Item 10.b: NISPOM requirements apply.

Reference Item 10.c: Written permission from MDA/DOSS is required prior to authorizing CNWDI access to a Subcontractor. Processing or transmitting CNWDI is not authorized on a Local Area Network without specific written authorization from MDA/DOC.

Reference Item 10.e (1): This contract requires access to SCI material. The contractor is not required to have an accredited SCIF but requires access to SCI at other locations. Additionally, the FSO will ensure that when a contractor with access to SCI is due for a Periodic Reinvestigation (PR), the Periodic Reinvestigation request is identified to be conducted to meet SCI standards. Written U.S. Government approval (the Special Security Branch) is required prior to imposing this requirement on a subcontractor. See attached SCI Supplement.

Reference Item 10.e (2): NISPOM requirements apply.

Reference 10.f: See attached SAP Supplement.

Reference Item 10.g: NISPOM Requirements apply.

Reference Item 10.j: See For Official Use Only/Controlled Unclassified Information Supplement below. THIS REQUIREMENT WILL BE IMPOSED ON ALL SUBCONTRACTS.

Reference Item 10.k:

This contract requires that specified contractor employees be granted access to the space where Safeguarding Nuclear Command and Control Extremely Sensitive Information (NC2-ESI) is located. This requirement is necessary because the C2BMC equipment where the specified contractor employees work area is located in a NC2-ESI area at USSTRATCOM. Employees requiring NC2-ESI access will be processed in accordance with the requirements of DoD Instruction 5220.28, Application of Special Eligibility and Clearance Requirements in the NC2-ESI Program for Contractor Employees.

a. The COR, in coordination with USSTRATCOM, shall forward a request to process certain employees of the company for NC2-ESI access. The request will be marked with the appropriate markings (i.e., FOUO, Privacy Act Protected, etc.) and/or classified as may be required by SCG (i.e., justification). This request will contain the following:

(1) Name and SSAN of the employee(s).

(2) Company name, address, CAGE code, telephone number.

(3) Date and place of birth for employee(s).

(4) Citizenship of employee(s).

(5) Citizenship of employee's spouse.

(6) NC2-ESI Category required.

(7) Employee's clearance level and date, investigation type and date.

(8) Inclusive dates SIOP access will be required.

(9) Contract number.

(10) Contract expiration date.

(11) Contract review date.

(12) Justification for requesting NC2-ESI accesses.

b. When access to NC2-ESI has been approved by the Joint Chiefs of Staff, forward this information to the FSO and authorize the employee(s) to be briefed for access.

c. The FSO is responsible for notifying USSTRATCOM when the employee is transferred from one facility to another within the company, when the employee's employment is terminated, when they resign, or have been transferred and/or no longer require NC2-ESI access.

d. The FSO is responsible for ensuring that the employees complete the required security forms for submission to DSS Clearance Office (DISCO) in a timely manner.

e. Information that an individual has been granted access to NC2-ESI is unclassified.

Reference Item 11.c:

Ballistic Missile Defense System (BMDS) SCG, Current Version.

Other Security Classification Guides will be provided as required.

Reference Item 11.j: Have Operations Security (OPSEC) Requirements.

This contract requires the application of Operations Security (OPSEC) in accordance with either specific instructions of the Contracting Officer/Contract Technical Monitor, "H" Clause, or DD Form 1423, Contract Data Requirements List, DD Form 1664, Data Item Description.

1. The contractor supporting specific event-oriented activities will develop OPSEC Plans/Annexes when directed by the supported program, or comply with the program's OPSEC Plan/Annex.

2. Contractor personnel assigned will receive OPSEC Awareness Education and Duty-Related Training as deemed necessary by the Government or program supported.

3. OPSEC Awareness Education and Training will be provided or coordinated through government channels (for example: MDA, Interagency OPSEC Support Staff (IOSS), etc) and OPSEC protective measures (countermeasures) will be applied as directed by government or program sponsors.

4. Public release review processes will include an OPSEC review and certification prior to submission into MDA public review processes. Point of Contact information will be documented by personnel at the contractor and government sponsor level and accompany submissions for MDA/PA and MDA/DOSS coordination.

Reference Item 11.l:

1. External electronic transmissions of specifically designated BMDS CUI (voice, facsimile, and data) shall be only over secure communications means approved for transmission of information to the maximum extent possible. Encryption of e-mail to satisfy this requirement shall be accomplished by use of NIST approved encryption. As an alternative to DoD PKI, the use of FIPS 140-2 validated encryption may be used, i.e., Internet Protocol Security (IPSec), Secure Socket Layer/ Transport Layer Security (SSL/TLS), Secure/Multipurpose Internet Mail Extensions (S/MIME), or Pretty Good Privacy (PGP). BMDS CUI may be sent through normal mail or distribution channels used for unclassified information. In all cases, BMDS CUI and FOUO information will be provided equal or greater protection than that afforded contractor proprietary information. Contractor will provide DOSS current proprietary information protection guidelines. THESE REQUIREMENTS WILL BE IMPOSED ON ALL SUB-CONTRACTS AS APPROPRIATE.

2. Contractor’s Unclassified LAN processing BMDS CUI requires:

a. MDA/DOSS shall review and assess the policy and procedures in place to protect BMDS CUI from unauthorized access from both internal and external sources. Any significant protection enhancements will require review for cost and impact by contractor management for possible negotiation. Use OMB Circular A-130, Revised, Management of Federal Information Resources, November 30, 2000 and DoD Directive 8100.2, "Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG)," April 14, 2004 as guidance documents. THIS REQUIREMENT WILL BE IMPOSED ON ALL SUBCONTRACTS, AS APPROPRIATE and

b. LAN access to designated Controlled Unclassified Information, which includes BMDS CUI (access qualifies as an ADP/IT-III Position requirement), must be limited to U.S. Persons (precludes access by individuals claiming dual citizenship without prior authorization from MDA/DOSS) that have a minimum interim level clearance; or have been the subject of a favorably completed National Agency Check (NAC) or a more stringent personnel security investigation (access pending completion of NAC and clearance determination is subject to approval by MDA/DOSS); or an approved contractor equivalent.

(1) Contractor Equivalent: Contractor equivalent includes various background checks such as those performed by employers during hiring process. Minimum checks shall include Citizenship, Personal Identification (Social Security Number), Criminal, and Credit. This option is subject to MDA/DOSS approval.

(2) ADP/IT-III Requirement: For ADP/IT-III positions at the contractor's facility, when "contractor equivalent" option is NOT authorized and there is no record of a valid investigation, the contractor shall forward the employee information (completed SF 85P, "Questionnaire for Positions of Public Trust," and two DD Forms 258 [Fingerprint Cards]), through the Contracting Officer's Representative, to: MDA/DOSS; ATTN: Personnel Security, 7100 Defense Pentagon, Washington, D.C. 20301-7100.

c. See the “For Official Use Only/Controlled Unclassified Information Supplement” below for additional guidance on handling that information.

3. Publicly Accessible Internet Websites:

Contractor and subcontractor computer systems that provide public access via an Internet website will contain only BMDS information that has been officially approved in writing for public release by MDA/PA.

Reference Item 12:

1. Proposed public disclosure of unclassified information relating to work under this contract shall be coordinated with the MDA Task Manager for review. ONLY information that has been favorably reviewed and authorized by the MDA Public Affairs Directorate (MDA/PA) may be disclosed. Information developed after initial approval for public release must be submitted for review and processing.

2. Contemplated visits by public media representatives in reference to this contract shall receive prior approval from the MDA COR and from MDA/PA.

3. Critical technology subject to the provisions of DoD Directives 5230.24, “Distribution Statements on Technical Documents,” and 5230.25, “Withholding of Unclassified Technical Data from Public Disclosure,” shall be reviewed in accordance with established directives.

4. A request from a foreign government, or representative thereof, including foreign contractors, for classified and/or unclassified information in reference to this contract shall be forwarded to the MDA Security and Program Protection Division (MDA/DOSS) for review and appropriate action.

MDA SCI Supplement (Item 10.e.(1)) for DD Form 254:

This supplement applies to Prime Contract Number: HQ0006-0X-F-XXXX .

Delivery/Task Order Number Task Order . Expiration date: XXXXXXXXXXXXXXXX. (Do not include option years until option is exercised.)

A. The following controls will apply to SCI provided under this contract:

1. DoD 5105.21-M-1, "Sensitive Compartmented Information Administrative manual," DCIDs 6/1, "Security Policy for SCI," 6/4, "Personnel Security Standards and Procedures Governing Eligibility for access to SCI," and 6/9, "Physical Security for SCIFs," DoD Regulation 5200.1-R, "Information Security Program Regulation," and MDA SCI Handbook provide the necessary guidance for physical, personnel, and information security measures, to include proper marking requirements, and is part of the SCI security specifications for the contract. NOTE: CSSO/FSO are required to process all SCI administration requirements for all MDA SCI contract efforts per the MDA SCI Handbook. The Handbook can be obtained by contacting MDA/DOSS(Z).

2. Inquiries pertaining to classification guidance will be directed to the responsible MDA contracting officer's representative (COR). The name/phone number for the MDA COR is: XXXXXXXXXXXXXXXXX (Additionally, identify the Company Security POC (FSO/CSSO) & phone number and email address at the contractor’s/subcontractor’s location): XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

3. All SCI furnished to the contractor in support of this contract/delivery/task order remains the property of the Department of Defense, or the agency or command that releases it. Upon completion of the contract, SCI furnished to the prime contractor will be returned to MDA or destroyed as directed by the MDA COR. NOTE: Prime contractor and subcontractor company security officers who destroy derivative or MDA generated SCI material will be required to provide a copy of the destruction certificate to the MDA COR.

4. The contract/delivery/task order requires the following SCI access(es): (COR is required to mark with an "X" the SCI accesses needed to effectively fulfill the SCI contractual obligation) SI X , TK X , G X , HCS X . Contact MDA SSCO for additional accesses. Access will be granted by the government agency. Upon completion or cancellation of the contract the MDA COR will provide a by name list of all contractors required to be debriefed from SCI to the MDA SSCO before contract close-out. All debriefed contractors will be removed from MDA SCI billets immediately by the SSCO once they have been debriefed. This contract requires XX SCI billets.

5. Contractor personnel requiring access to SCI and justification for MDA SCI billets will be initiated by the company’s security officer with validation by the COR per the guidelines in the MDA SCI Administration Handbook enclosure found below. Company security officers are required to obtain a copy of the MDA SCI Handbook by contacting the MDA/DOSS(Z). NOTE: CSSO/FSO should only submit contractors employees who have a completed in scope (within the last 5 years) Single Scope Background Investigation (SSBI) for SCI access.

6. The CSSO/FSO shall advise the MDA SSCO, through the contracting officer's representative, upon reassignment of personnel to other duties not associated with this contract. NOTE: Individual contractors who no longer support a MDA SCI contract will be subject to a debrief from SCI access immediately. Company security officers are required to coordinate with the MDA SSCO to get their individual contractors debriefed.

7. The CSSO must coordinate with the MDA COR prior to subcontracting any portion of the SCI efforts involved in their MDA SCI prime contract. A separate DD Form 254, utilizing this SCI Supplement, for the subcontractor will be processed and a copy provided to MDA SSCO and DIA SSO. NOTE: The SSCO will not provide any SCI administration support to prime contractors or subcontractors who do not have a signed active DD 254 for an MDA SCI contract.

8. The contractor shall not use references to SCI accesses, even by unclassified acronyms, in advertising, promotional efforts, or recruitment of employees.

9. All SCI work will be performed in a DIA accredited MDA SCIF unless otherwise authorized. Is there a SCIF required for this contract? ___X__ Yes or ___X___ No (COR required to mark and “X” in the appropriate space).

10. AIS SCI Processing. Electronic processing of SCI requires accreditation of the equipment in accordance with DCID 6/3 and DIAM 50-4.

11. Visit Cert. The contractor FSO/CSSO will submit the request for SCI visit certifications per guidelines of the MDA SCI Handbook through the COR for approval of the visit. The certification request must arrive at MDA/DOSS(Z) at least five (5) working days prior to the visit.

12. The contractor will not reproduce any SCI related material without prior written permission of the COR.

13. MDA has exclusive security oversight for all SCI released to the contractor or developed under this contract. Defense Intelligence Agency (DIA) is the cognizant security authority for all inspections of MDA sponsored contractor SCIF to ensure compliance with SCI Directives/Regulations. MDA/DOSS(Z) will conduct self-inspections of MDA-sponsored SCIFs.

B. The Missile Defense Agency is designated as the User Agency for SCI requirements.

Print name of MDA SSCO: Dave Gmaz_______________

MDA SSCO Signature: ______________________________ Date:

Phone: _(703) 697-9174

Print name of COR/Directorate designation: _XXXXXXXXXXXXXXXXXXXXXXXXXX_ COR Signature: _________________________________ _ Date: ___ __

Phone: XXXXXXXXXXXXXX

E-1 – SCI Access/Billet (Nomination) Request

(To be used by MDA affiliated CSSO/FSO in submitting contractors for SCI access)

(Put the template below on company letterhead)

Date

MEMORANDUM FOR DEFENSE INTELLIGENCE AGENCY

THRU MISSILE DEFENSE AGENCY, ASSISTANT DIRECTOR, SPECIAL

SECURITY (MDA/DOSS(Z))

SUBJECT: MDA Contractor SCI Access Nomination Request

Request the below named individual be nominated for SCI access.

a.

Name:

b.

Aliases:

c.

SSN:

d.

DOB/POB:

e.

Current Investigation/Type/Date:

f.

Citizenship:

g.

Position Title:

h.

COR’s Name, Grade, Organization, and Telephone Number:

i.

MDA SCI Contract Number:

j.

Contract Services Start and Expiration Date:

k.

Location of Facilities Where Work is to be Performed:

l.

Access required: (Fill in SCI compartments required, i.e. SI/TK/G/HCS) m.

Justification: (Separate justification for each compartment requested is required, why the job cannot be performed without SCI, and how the individual will use the information.)

Signature Block for MDA COR

Signature Block for CSSO/FSO

(Both Prime and Sub CSSO/FSO must sign if the individual supports a subcontract)

NOTE: Submit this signed letter with a copy of the candidate’s SF 86 with minimal pen and ink updates (initialed and dated), originally re-signed and re-dated within 60 days and a copy of the contract’s DD Form 254 (both sub and prime as applicable) as a part of the complete SCI Access/Billet (Nomination) Request package to MDA/DOSS(Z).

INSTRUCTIONS FOR COMPLETION OF SAP SUPPLEMENT TO DD 254

When access to MDA Special Access Programs (SAP) is required in order to execute the contract, you must check block 10f of the DD 254 and attach the following SAP Supplement. If the DD 254, itself, is unclassified then it will go through Lyle Holmes and to one of the POCs listed below. If the DD 254 is classified then it must go through Special Programs (DOSP) contracting office (DAC). The SAP Supplement must be signed by the COR and one of the POCs listed below or their designee. The COR or their representative must be able to identify which SAP the contract supports.

If you have any questions please contact the MDA SAP Central Office Robert Leffler, 256-450-1500.

SAP Supplement to Contract No: HQ0006-0X-F-XXXX

1. Item 10f:

a. The Department of Defense Overprint to the National Industrial Security Program (NISPOM) Operating Manual will be provided to the contractor named in Item 6a if they do not possess a copy. The MDA Special Programs Directorate (MDA/DOSP) will provide detailed, Special Access Program (SAP)-specific guidance to the contractor under separate cover.

b. Access to SAP information or material shall be at government facilities and other designated locations only as identified and approved by MDA/DOSP. Access to SAP information requires a final U.S. Government Secret or Top Secret with a favorable NACLC or SSBI investigation completed within the last five years, a SAP nomination, and a special access non-disclosure briefing prior to access. The Government Program Security Officer (PSO) will contact the contractor Facility Security Officer (FSO) to obtain security information on personnel nominated for access, to include a current and signed SF-86, within one year.

2. Items 11a - c:

a. Access to MDA SAP information or data in regard to this Contract will be conducted in approved MDA SAP Facilities (SAPF) as authorized by MDA/DOSP.

b. Any facility that stores, processes or discusses SAP information or data in regard to this contract must be designated as an MDA-accredited SAPF. SAPFs will be accredited by MDA/DOSP prior to any discussions or receipt and/or generation of any classified material.

c. All SAP work will be performed in an approved SAPF. If a requirement to discuss, store, or process SAP information and to collate within an approved SAPF is identified, a Memorandum of Agreement for co-utilization must be executed between the MDA cognizant SAP security representative and the other government or contractor customer cognizant security representative. A Co-Utilization Agreement (CUA) is required between MDA/DOSP and the SCI Cognizant Security Authority (CSA) prior to introduction of MDA-sponsored SAP data into a Sensitive Compartmented Information Facility (SCIF). A Standard Operating Procedure (SOP) will be written for each SAPF and coordinated with MDA/DOSP.

3. Item 11i:

a. Prior to processing program or program-related information on Automated Information Systems (AISs), the contractor will provide MDA/DOSP with the necessary documentation outlined within the JAFAN 6/3 and be in receipt of subsequent approval.

b. AIS SOP shall implement security procedures tailored to system users for operations in accordance with program requirements, JAFAN 6/3, and where appropriate, the Overprint to the NISPOMSUP.

c. TEMPEST requirements may be necessary in the performance of this contract in accordance with program requirements, JAFAN 6/3, and where appropriate the Overprint to the NISPOMSUP.

4. Item 11j: OPSEC requirements may be necessary in the performance of this contract in accordance with individual program requirements and Overprint to the NISPOMSUP. Specific guidance will be provided by MDA/DOSP.

5. Item 12:

a. Public release of SAP information is PROHIBITED. Documents or other materials pertaining to this effort will not be released to the Defense Technical Information Center (DTIC) or any other such information service under any circumstances. A pre-publication and/or presentation(s) review is required prior to the use of any classified or unclassified information which is either tangentially or directly related to any SAP. In each case, approval must be obtained from MDA SAP Central Office. The request must be submitted by the person who desires to make the publication or presentation, via the Contract Program Security Officer (CPSO) to the MDA SAP Central Office Security Manager.

b. The contractor shall not use references to SAP accesses (Nicknames, Code Words, etc.) or information, even by unclassified acronyms, in advertising, promotional efforts or recruitment of employees.

6. Item 13: The following Regulations, Guides, Manuals, Program Security Classification and Procedures Guides apply to this contract: Chapter VIII, DoD 5200.1-R, Information Security Program Regulation; DoD 5220.22M Sup 1, National Industrial Security Program Operating Manual Supplement; DoD Overprint to the NISPOMSUP; JAFAN 6/3 and 6/9; SAP-specific Security Classification Guide(s), Applicable Facility Specific Standard Operating Procedures, Treaty Plans, and OPSEC Guides.

7. CONTRACT NUMBER. The complete contract number is HQ0006-XX-F-XXXX. The contractor may be required to establish non-attributable internal procedures and charge numbers that will be documented in the facility's Standard Operating Procedures (SOP) as necessary for cost accumulation by uncleared personnel.

8. SUBCONTRACTING. Subcontracting must have prior approval of MDA/DOSP. Any classified program activity that requires the use of a subcontractor facility must meet JAFAN 6/9 criteria and be approved by MDA/DOSP.

9. DOCUMENTATION.

a. Collateral information/material not directly relating to this contract shall not be introduced or authorized within a SAPF without prior written authorization from MDA/DOSP.

b. All invoices/vouchers submitted under this contract shall be UNCLASSIFIED, and shall be devoid of any information that would require them to be classified or cause an Operations Security (OPSEC) concern.

10. COMMUNICATIONS AND TRANSMISSIONS.

a. Any communications of SAP information with outside activities not involved with the specific supported SAP are PROHIBITED, unless otherwise authorized by MDA/DOSP.

b. All programmatic material relating to this contract and its administration shall be classified in accordance with the requirements outlined in MDA and SAP-specific classification guides and this DD254 or as directed by MDA/DOSP.

c. Program related telephonic communications will be conducted on secure telephone units.

d. All documentation concerning SAP portions of this contract will be transmitted in accordance with Chapter 5, Section 4, of the Overprint to the NISPOMSUP. If U.S. Postal mailing is used, MDA/DOSP will provide guidance, as required.

11. VOUCHERS. All invoices/vouchers submitted under this contract shall be UNCLASSIFIED and shall be devoid of any information that would require them to be classified. The invoice/voucher may reveal the contractor's name, customer name or UIC of the contract number. All invoices/vouchers shall be transmitted via means identified in paragraph 10, above, or as directed by MDA/DOSP.

12. LEGAL COUNSEL. Should the contractor require private counsel to represent corporate interests in matters related to or associated with SAP sponsored activities, the Procurement Contracting Officer, and MDA/DOSP shall be notified in writing. The private counsel shall be treated as a subcontractor. In those incidents where the issues are not program specific, it is the responsibility of the appropriate indoctrinated contractor personnel to prevent inadvertent dissemination of SAP related information/data, operational procedures and/or administrative details to the private counsel.

13. RETENTION OF PROGRAM RELATED DOCUMENTATION, SOFTWARE, AND HARDWARE. Upon completion of this contract and acceptance by the Government of final deliverables, the contractor shall:

a. Conduct an inventory/audit of all SAP material received and/or generated under this contract and forward it to MDA/DOSP.

b. In accordance with MDA/DOSP direction, the contractor shall destroy administrative security records and related documents utilizing approved destruction procedure/methods and maintain certificates of destruction for final close-out review. Retention of SAP information at the contractor facility is not generally authorized beyond contract close-out unless a follow on contract/task is anticipated. A written request for authorization for document retention must be forwarded to the Procurement Contracting Officer and the MDA SAP Central Office Security Manager for approval.

14. ISSUES/CONFLICT REPORTING.

a. Any questions regarding classification, access, or any other security related issue in regard to the SAP portion of this contract must be referred to MDA/DOSP.

b. Any conflict between instructions contained in the NISPOM, the Overprint to the NISPOMSUP and this DD Form 254 must be reported to MDA/DOSP by the most expedient and secure means.

Robert Leffler

COR Signature Block

SAP Security Policy

Missile Defense Agency

FOR OFFICIAL USE ONLY/ BMDS CONTROLLED UNCLASSIFIED INFORMATION SUPPLEMENT

1. Definitions.

a. Ballistic Missile Defense System Controlled Unclassified Information (BMDS CUI). MDA/BMDS Unclassified information associating specific technologies to components, sub-systems or systems revealing sensitive configurations of a sub-system or system; identification of out-year funding or redirection of funds to specific components or projects revealing a re-prioritization of program direction; or information revealing sensitive BMDS plans, intentions, or activities relating to BMDS operations or contingencies. Examples: 1) Unclassified information that, if not protected, could lead to revealing classified Critical Program Information. 2) Information that identifies the number of components intended to be configured that would make up the operational Field of View of an interceptor thus potentially leading to concluding the Instantaneous Field of View. 3) MDA/BMDS infrastructure information revealing the location of sensitive areas, the facility protective measures, information disclosing infrastructure or security operations, harm or damage to persons, systems, utilities, or facilities, that are not otherwise eligible for classification under Executive Order 12958, as amended. BMDS CUI meets the requirement of Controlled Unclassified Information, as defined below, requiring protection during dissemination.

b. Controlled Unclassified Information (CUI). Unclassified information which requires access and distribution limitations prior to appropriate coordination and an official determination by cognizant authority approving clearance of the information for release to one or more foreign governments or international organizations, or for official public release. It includes BMDS CUI or other information marked, or that is eligible for marking, as "For Official Use Only" (FOUO) in accordance with DoD 5400.7-R; technical information as discussed in DoD 5230.24 and 5230.25; information that is subject to export controls in accordance with the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR); sensitive information as defined in the Computer Security Act of 1987, or other qualifying information as identified in DoD 5200.1-R.

c. Designated BMDS CUI. Information identified within a Security Classification Guide to be protected as FOUO, identified by an MDA government official as requiring protective measures due to sensitivity, and/or is exempt from mandatory public disclosure by statute even though unclassified.

d. Dual Citizenship. A dual citizen is a citizen of two nations. For the purposes of this document, an individual must have taken an action to obtain or retain dual citizenship. Citizenship gained as a result of birth to non-U.S. parents or by birth in a foreign country to U.S. parents thus entitling the individual to become a citizen of another nation does not meet the criteria of this document unless the individual has taken action to claim and to retain such citizenship.

e. For Official Use Only (FOUO). Information that may be withheld from public disclosure under one or more of the 9 exemptions of the Freedom of Information Act (FOIA) (See DODD 5400.7). FOUO is not a form of classification to protect U.S. national security interests.

f. National of the United States. Title 8, U.S.C. Section 1101(a)(22), defines a National of the United States as:

(1) A citizen of the United States, or,

(2) A person who, though not a citizen of the United States, owes permanent allegiance to the United States.

NOTE: 8 U.S.C. Section 1401, paragraphs (a) through (g), lists categories of persons born in and outside the United States or its possessions that may qualify as Nationals and Citizens of the United States. This subsection should be consulted when doubt exists as to whether or not a person can qualify as a National of the United States. (Contact the Office of the General Counsel for interpretation of Statues and Regulatory guidance).

g. Personal Information. Information about an individual that is intimate or private to the individual, as distinguished from information related to the individual's official functions or public life.

h. Privacy Act. The Privacy Act of 1974, as amended, 5 U.S.C. Section 552a.

i. U.S. Person. Any form of business enterprise or entity organized, chartered, or incorporated under the laws of the United States or its possessions and trust territories and any person who is a citizen or national (see National of the United States) of the United States, or permanent resident of the United States under the Immigration and Nationality Act.

2. General.

a. The FOIA requires U.S. Government offices to disclose to any requestor information resident in U.S. Government files unless the information falls under one of 9 exemption categories. BMDS CUI and other information may fall in this category.

b. BMDS CUI in the hands of contractors may not be released to the public by the contractor unless (a) the Contracting Officer's Representative (COR) concurs, (b) it has been reviewed by The Information Safeguards Branch, and (c) written approval has been provided by MDA/PA.

c. Access.

(1) Access to BMDS CUI must be limited to U.S. Persons (precludes access by individuals claiming dual citizenship without MDA/DOSS permission) unless the access is authorized by MDA/DOSS or, in the case of technical data as defined by the ITAR, the access is covered by a Technical Assistance Agreement or other form of duly licensed export. This requirement does not apply to use of commercial off the shelf (COTS) equipment and services that do not have export limitations.

(2) Non-Sensitive Positions (ADP/IT-III positions). Non-sensitive positions associated with BMDS CUI are found at contractor facilities processing BMDS CUI on their (contractor's) unclassified computer systems. Personnel nominated to occupy ADP/IT-III designated positions (applies to any individual that may have access to BMDS CUI on the contractor's computer system) must have at least a National Agency Check (NAC) or contractor equivalent (company hiring practices reviewed and approved by MDA/DOSS). When "contractor equivalent" option is NOT authorized and there is no record of a valid investigation, the contractor shall forward the employee information (completed SF 85P, "Questionnaire for Positions of Public Trust," and two DD Forms 258 [Fingerprint Cards]), through the Contracting Officer's Representative, to: MDA/DOSS, ATTN: Personnel Security, 7100 Defense Pentagon, Washington, D.C. 20301-7100.

d. Impact of 9/11/01. Listings and locations of critical infrastructure, lists of individuals, information on security systems, and other information that may allow terrorists to target a facility have taken on greater significance. This type information is now protected as FOUO or, in many cases, is being classified.

3. Identification Markings.

a. An unclassified document containing BMDS CUI shall be marked "For Official Use Only" at the bottom of the page on the outside of the front cover (if any), on the first page, on each page containing FOUO information, on the back page and on the outside of the back cover (if any), centered at the bottom of the page. For convenience, all pages, even those that do not contain FOUO information, may be marked "For Official Use Only" in documents generated by an automated system.

b. Individual pages within a classified document that contain both FOUO and classified information shall be marked at the top and bottom with the highest security classification of information appearing on the page. Individual portions/paragraphs containing FOUO information but no classified information shall be marked "FOUO." Individual pages containing FOUO information but no classified information shall be marked "For Official Use Only" at the top and bottom of the page (unless all pages are being marked with the highest overall security classification level).

c. Certain classified material on this contract may be declassified by the Declassification Authority to UNCLASSIFIED. When classified material that is approved to be downgraded to UNCLASSIFIED is used, extracted, reissued, transmitted and/or updated, it must be reviewed by The Information Safeguards Branch and MDA/PA for public release, foreign disclosure or continued protection as For Official Use Only.

d. E-mails and other electronic files shall be marked in the same fashions as described for documents above, to the maximum extent possible.

4. Handling.

a. During any temporary sojourn of MDA Unclassified information outside of the contractor controlled work space (residence, telework facility, hotel), the material must be stored in a locked room, drawer, filing cabinet, briefcase, or other storage device, so that access to the material by unauthorized individuals (i.e., family members, hotel staff, etc.) is prevented whenever untended by the contract employee.

(1) Long term task driven deadlines or the need to be able to perform official work while in an extended travel status on contract-driven business, require extended access to MDA Unclassified information outside of “official” work spaces. When that happens, employees may request written approval from their supervisors to possess, work on, and store MDA Unclassified information in non-contractor facilities for a period of not more than thirty calendar days.

(2) Requests for extended possession, use, and storage of MDA Unclassified information outside of “official” work spaces shall take the form of a Memorandum For Record (MFR) prepared by the employee which specifies the body of information to be removed by listing the: title or subject matter; Program, Project, or Task being supported; general volume and format of the information concerned; and projected date of return. Additionally, the MFR shall contain a signature block for the supervisor to sign and date when approval is granted.

(3) The availability of supervisory copies of MFRs as described in this section may be an inspection item during Security Program Reviews conducted by the MDA/DOSS staff.

(4) The affected employee shall keep the originally signed MFR in validation of authorization granted for the agreed term of use. The supervisor shall maintain a copy of the MFR with employee records for the same term.

(5) Requested extensions of supervisory authorization for employee possession, use, and storage of MDA Unclassified information outside of “official” work spaces may be granted in incremental blocks of 30 days each so long as the work-related requirement continues.

(6) All affected employees authorized to possess, use, and store MDA Unclassified information outside of “official” work spaces must return all MDA Unclassified information to contractor control upon “task” completion. When such a return has been completed, the supervisor shall annotate the date that all items were returned. The supervisor's copy shall be retained for a period of time, not to exceed one year.

b. The above excludes unclassified information of an administrative nature including necessary personnel recall rosters and official telephone lists which are needed by supervisors and employees to assure the physical security, safety, health, and general psychological well-being of the contractor work force.

5. Transmission/Dissemination/Reproduction.

a. Authorized contractors, consultants and grantees may transmit/disseminate BMDS CUI internally to each other and to DoD components and officials of DoD components who have a legitimate need for the information in connection with this contract. The following general guidelines apply:

(1) External electronic transmissions (voice, facsimile, and data) of specifically designated BMDS CUI shall be only over secure communications means approved for transmission of information when practical. Encryption of e-mail to satisfy this requirement shall only be accomplished by use of software containing a National Institute of Standards and Technology (NIST)-approved security module and DoD-approved Public Key Infrastructure Certification available from: http://iase.disa.mil/pki/eca/certificate.html, whenever possible. As an alternative, utilization of any FIPS 140-2 validated encryption (e.g., IPSec, SSL/TLS, S/MIME, or PGP) may be used. In all cases, BMDS CUI and FOUO information will be provided equal or greater protection than that afforded contractor proprietary information. Contractor will provide DOSS current proprietary information protection guidelines.

(a) To transmit FOUO information to or from a Government computer, encryption should use a DoD-approved PKI certificate whenever possible.

(b) To transmit FOUO information between contractor computers, software with a NIST-approved security module and other-than-DoD PKI keys is acceptable.

(c) To transmit contractor information (competition sensitive, company proprietary, etc.) to a Government computer, the contractor is free to use whatever encryption they are comfortable with.

(2) BMDS CUI shall be transmitted over secure facsimile equipment. If not available, contractors shall use the following means of transmission when secure facsimile is not available:

(a) Hand-carry.

(b) U.S. Postal service.

(c) Overnight express mail services.

(3) BMDS CUI may be transmitted, processed, and stored internally on Automated Information Systems (AIS), electronic mail and other similar systems or networks 1) when distribution is to an authorized recipient and 2) if the receiving system is protected by either physical isolation or a password protection system. Holders shall not use general, broadcast, or universal e-mail addresses to distribute BMDS CUI. Discretionary access control measures may be used to preclude access to BMDS CUI files by users who are authorized system users, but who are not authorized access to BMDS CUI. External transmission of BMDS CUI shall be secured using NIST-validated encryption. Contractors shall use the following means of transmission when authorized encryption is not available:

(a) Hand-carry.

(b) U.S. Postal service.

(c) Overnight express mail services.

(4) The World Wide Web shall be equated with "Public Access." Information must be reviewed by The Information Safeguards Branch and MDA/PA and officially approved for public release before placing on publicly-accessible Web pages or electronic bulletin boards.

(5) Do not mark shipping containers as containing BMDS CUI or FOUO.

(6) Reproduction of BMDS CUI may be accomplished on unclassified copiers or within designated government or contractor reproduction areas.

6. Storage. During working hours, BMDS CUI shall be stored in a manner that limits access by persons who do not have an official need for the information. During non-working hours and when internal building security is provided, BMDS CUI may be filed with other unclassified records in unlocked files or desks. When there is no internal building security, locked buildings or rooms provide adequate after-hours protection, or the material can be stored in locked receptacles such as cabinets, desks, or bookcases.

7. Disposition.

a. When no longer needed, BMDS CUI shall be disposed of in the same manner as classified waste, or in a manner that will preclude reconstruction. To use the "preclude reconstruction" option, the following minimum standard must be met:

(1) Cross-cut shredder with a maximum width of 1/4" and a maximum length of 1.5", or

(2) Strip shredder (or tearing/cutting) with a maximum width of 1/4".

b. Removal of the FOUO or BMDS CUI status can only be accomplished by the government originator. The MDA COR shall review and/or coordinate with proper authority the removal of FOUO or BMDS CUI status for information in support of contract activity.

8. Unauthorized Disclosure. The unauthorized disclosure of CUI records does not constitute an unauthorized disclosure of DoD information classified for security purposes. Appropriate administrative action shall be taken, however, to fix responsibility for unauthorized disclosure whenever feasible, and appropriate disciplinary action shall be taken against those responsible. Unauthorized disclosure of CUI may also result in civil and criminal sanctions against responsible persons. The DoD Component that originated the CUI shall be informed of its unauthorized disclosure. Government and contractor organizations must inform the COR and MDA/DOSS of any unauthorized disclosures of BMDS CUI related to this contract.

PAGE

FOR OFFICIAL USE ONLY (when filled in)