Atch 02 DD Form 254.doc

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. CLEARANCE AND SAFEGUARDING

FACILITY CLEARANCE REQUIRED

TOP SECRET

(The requirements of the National Industrial Security Program Operating Manual (NISPOM) apply to all security aspects of this effort) b.

LEVEL OF SAFEGUARDING REQUIRED

NONE

a.

PRIME CONTRACT NUMBER

2009/09/03 b.

SUBCONTRACT NUMBER

b.

REVISED (Supersedes all previous specs) Revision No.

Date (YYYYMMDD)

X

c. SOLICITATION OR OTHER NUMBER

HQ0006-09-R-0004

Due Date (YYMMDD)

4.

IS THIS A FOLLOW-ON CONTRACT?

YES

NO. If Yes, complete the following:

5.

IS THIS A FINAL DD FORM 254?

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of

6.

CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. LOCATION

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7.

SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

8.

ACTUAL PERFORMANCE

a. LOCATION

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9.

GENERAL IDENTIFICATION OF THIS PROCUREMENT

Technical Tasking Support for the Precision Tracking Space System (PTSS)

10.

THIS CONTRACT WILL REQUIRE ACCESS TO:

IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL:

a.

Communications Security (COMSEC) Information

Have Access To Classified Information Only At Another Contractor's Facility Or A Government Activity X b.

Restricted Data (RD) X b.

Receive Classified Documents Only

X c.

Critical Nuclear Weapon Design Information (CNWDI) X c.

Receive And Generate Classified Material

X d.

Formerly Restricted Data (FRD) X d.

Fabricate, Modify, Or Store Classified Hardware

X e.

Intelligence Information:

e.

Perform, Services Only

X

(1) Sensitive Compartmented Information (SCI) X f.

Have Access To United States (US) Classified Information Outside The US, Puerto Rico, US Possessions And Trust Territories

X

(2) Non-SCI X g.

Be Authorized To Use The Services Of Defense Technical Information Center (DTIC) Or Other Secondary Distribution Center X f.

Special Access Information

Require a COMSEC Account

X g.

North Atlantic Treaty Organization (NATO) INFORMATION X i.

Have TEMPEST Requirements

X h.

Foreign Government Information X j.

Have Operations Security (OPSEC) Requirements X i.

Limited Dissemination Information

Be Authorized To Use The Defense Courier Service (DCS)

X j.

For Official Use Only (FOUO) Information (Includes Term Controlled

Unclassified Information (CUI)) X l.

Other (Specify Restrict access to Contractor’s Unclassified Local Area Network (LAN).

X k.

Other (Specify)

X

DD Form 254, December 1999

Previous editions are obsolete.

805/340

12.

PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the NISPOM or unless it has been approved for public release by appropriate US Government authority. Proposed public release shall be submitted for approval prior to release

Missile Defense Agency/Public Affairs (MDA/PA)

7100 Defense Pentagon

Washington, DC 20301-7100 to the Directorate for Freedom of information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13.

SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

Forward a copy of any DSS letter that informs of any serious deficiency to MDA/DXSS within 48 hours of receipt.

Any incident of possible compromise will be reported to MDA/DXSS within 24 hours.

Reference Items 10.b, c, & d: NISPOM, Chapter 9, Sections 1 & 2, requirements apply. The Department of Energy requires that if a contractor's access to RD/CNWDI/FRD data is for the additional purpose of reviewing, analyzing, and creating new RD/CNWDI/FRD products or material, then they must complete relevant training. As a minimum training requirement, MDA requires successful completion of the DOE Historical Records Restricted Data Reviewers Course. Additionally, personnel must be appointed in writing as a Classifier by an MDA RD/Alternate RD Official and have access to the Joint DOD/DOE Security Classification Guide CG-W-5. Processing or transmitting CNWDI is not authorized on a Local Area Network (LAN) without system being accredited for CNWDI by the Defense Security Service. Flow this requirement to subcontractors when applicable.

Reference Item 10.e (1): This contract requires access to SCI material. The contractor is not required to have an accredited SCIF but requires access to SCI at other locations. Additionally, the FSO will ensure that when a contractor with access to SCI is due for a Periodic Reinvestigation (PR), the Periodic Reinvestigation request is identified to be conducted to meet SCI standards. Written US Government approval (MDA/DOSS-Z) is required prior to imposing this requirement on a subcontractor. See attached SCI Supplement.

See Continuation Page

14.

ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to NISPOM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements

No to the cognizant security office. Use item 13 if additional space is needed.)

See Items 10.j and 11.l.

15.

INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas of elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

No

MDA/DXSS reserves the right to conduct compliance inspections for protection of BMDS Controlled Unclassified Information. See Block 13, Reference Items 10.e (1), 10.j and 11.l.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

d.

ADDRESS (Include Zip Code)

17.

REQUIRED DISTRIBUTION

Missile Defense Agency (MDA/DXSS)

7100 Defense Pentagon

b. SUBCONTRACTOR

e.

SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

DD Form 254 Reverse, December 1999 (Previous editions are obsolete)

SECURITY GUIDANCE (BLOCK 13) CONTINUATION:

Reference Item 10.e (2): NISPOM requirements apply.

Reference Item 10.g: NISPOM requirements apply.

Reference Item 10.j: See For Official Use Only/BMDS Controlled Unclassified Information Supplement below. This requirement will be imposed on all subcontracts.

Reference Item 11.c:

Ballistic Missile Defense System (BMDS) SCG, Current Version.

Space Tracking Surveillance System SCG, Current Version.

USNORTHCOM Ballistic Missile Defense (BMD) Operations SCG, Current Version.

STRATCOM Integrated Missile Defense (IMD) SCG, Current Version.

Other Security Classification Guides will be provided as required.

Reference Item 11.g: Contractor is authorized to use the services of DTIC or other secondary distribution center. The contractor and/or subcontractor will prepare the DD Form 1540 and DD Form 2345, if required, and submit to the contracting office.

Reference Item 11.j: This contract requires the application of OPSEC in Compliance with MDA O-5205.02-INS (MDA OPSEC Instruction) to either specific instruction of the Contracting Officer’s Representative or Department of Defense (DD) Form 1423, Contract Data Requirements List, DD Form 1664, Data Item Description.

1. The contractor supporting event-oriented activities will develop OPSEC Plans/Annexes when directed by the supported program, or comply with the program's OPSEC Plan/Annex.

2. Contractor personnel assigned will receive OPSEC Awareness Education and Duty-Related Training as deemed necessary by the Government or program supported. OPSEC Awareness Education and Training will be provided by or coordinated through government channels (for example, MDA, Interagency OPSEC Support Staff (IOSS), etc.) and OPSEC protective measures (countermeasures) will be applied as directed by government or program sponsors.

Reference Item 11.l:

1. Contractor’s Unclassified LAN

a. Contractor shall submit, and obtain approval of MDA/SS Information Assurance Manager for its procedures for protecting BMDS CUI from unauthorized access from both internal and external sources prior to placing BMDS CUI on the contractor’s unclassified LAN. Use Office of Management and Budget (OMB) Circular A-130, Revised, Management of Federal Information Resources, November 30, 2000 and DoD Directive 8100.2, "Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG)," April 14, 2004 as guidance documents.

b. LAN access to Controlled Unclassified Information, which includes BMDS CUI (access qualifies as an Automated Data Processing/Information Technology (ADP/IT)-III Position requirement), must be limited to U.S. Persons (precludes access by individuals claiming dual citizenship without MDA/DXSS permission) that have a minimum interim SECRET level clearance; or have been the subject of a favorably completed National Agency Check (NAC) or a more stringent personnel security investigation (access pending completion of NAC determination is subject to approval by MDA/DXSS); or contractor equivalent.

(1) Contractor Equivalent: Contractor equivalent includes various background checks such as those performed by employers during hiring process. Minimum checks shall include Citizenship, Personal Identification (Social Security Number), Criminal, and Credit. This option is subject to MDA/DXSS approval.

(2) ADP/IT-III Requirement: For ADP/IT-III positions at the contractor's facility, the contractor will forward their uncleared employee information (completed SF 85P, Questionnaire for Positions of Public Trust, and two DD Forms 258 (Fingerprint Cards), through the Contracting Officer's Representative, to: MDA/DXSS; ATTN: Personnel Security, 7100 Defense Pentagon, Washington, D.C. 20301-7100.

c. See the “For Official Use Only/Controlled Unclassified Information Supplement” below for additional guidance on handling that information.

2. Publicly Accessible Internet Websites:

Contractors and subcontractor must receive written official public release approval for MDA/BMDS information from MD/PA before that information is uploaded onto any respective computer system that provides public access via an Internet website.

Reference Item 12:

1. Proposed public disclosure of unclassified information relating to work under this contract shall be coordinated through the Organizational OPSEC Coordinator, to the MDA COR/Task Manager for submission to MDA Public Affairs (MDA/PA) for public release processing. ONLY information that has been favorably reviewed and authorized by the MDA Public Affairs Directorate (MDA/PA) may be disclosed. Information developed after initial approval for public release must be submitted for review and processing.

2. Contemplated visits by public media representatives in reference to this contract shall receive prior approval from the MDA COR and from MDA/PA.

3. Critical technology subject to the provisions of DoD Directives 5230.24, “Distribution Statements on Technical Documents,” and 5230.25, “Withholding of Unclassified Technical Data from Public Disclosure,” shall be reviewed in accordance with established directives.

4. A request from a foreign government, or representative thereof, including foreign contractors, for classified and/or unclassified information in reference to this contract shall be forwarded to the MDA Security and Program Protection Division (MDA/DXSS) for review and appropriate action.

MDA SCI Supplement (Item 10.e (1)) for DD Form 254:

This supplement applies to Prime Contract Number: .

Delivery/Task Order Number Task Order ______. Expiration date: ____________. (Do not include option years until option is exercised.)

A. The following controls will apply to SCI provided under this contract:

1. DoD 5105.21-M-1, "Sensitive Compartmented Information Administrative manual," DCIDs 6/1, "Security Policy for SCI," 6/4, "Personnel Security Standards and Procedures Governing Eligibility for access to SCI," and 6/9, "Physical Security for SCIFs," DoD Regulation 5200.1-R, "Information Security Program Regulation," and MDA SCI Handbook provide the necessary guidance for physical, personnel, and information security measures, to include proper marking requirements, and is part of the SCI security specifications for the contract. NOTE: CSSO/FSO is required to process all SCI administration requirements for all MDA SCI contract efforts per the MDA SCI Handbook. The Handbook can be obtained by contacting the Special Security Branch.

2. Inquiries pertaining to classification guidance will be directed to the responsible MDA contracting officer's representative (COR). The name/phone number for the MDA COR is: ___________________.

(Additionally, identify the Company Security POC (FSO/CSSO) & phone number and email address at the contractor’s/subcontractor’s location): ____________________________.

3. All SCI furnished to the contractor in support of this contract/delivery/task order remains the property of the Department of Defense, or the agency or command that releases it. Upon completion of the contract, SCI furnished to the prime contractor will be returned to MDA or destroyed as directed by the MDA COR. NOTE: Prime contractor and subcontractor company security officers who destroy derivative or MDA generated SCI material will be required to provide a copy of the destruction certificate to the MDA COR.

4. The contract/delivery/task order requires the following SCI access(es): (COR is required to mark with an "X" the SCI accesses needed to effectively fulfill the SCI contractual obligation) SI____, TK____, G____, HCS____. Contact MDA SSCO for additional accesses. Access will be granted by the government agency. Upon completion or cancellation of the contract the MDA COR will provide a by name list of all contractors required to be debriefed from SCI to the MDA SSCO before contract close-out. All debriefed contractors will be removed from MDA SCI billets immediately by the SSCO once they have been debriefed. This contract requires _____ SCI billets.

5. Contractor personnel requiring access to SCI and justification for MDA SCI billets will be initiated by the company’s security officer with validation by the COR per the guidelines in the MDA SCI Handbook. Company security officers are required to obtain a copy of the MDA SCI Handbook by contacting the the Special Security Branch. NOTE: CSSO/FSO should only submit contractors employees who have a completed in scope (within the last 5 years) Single Scope Background Investigation (SSBI) for SCI access.

6. The CSSO/FSO shall advise the MDA SSCO, through the contracting officer's representative, upon reassignment of personnel to other duties not associated with this contract. NOTE: Individual contractors who no longer support a MDA SCI contract will be subject to a debrief from SCI access immediately. Company security officers are required to coordinate with the MDA SSCO to get their individual contractors debriefed.

7. The CSSO must coordinate with the MDA COR prior to subcontracting any portion of the SCI efforts involved in their MDA SCI prime contract. A separate DD Form 254, utilizing this SCI Supplement, for the subcontractor will be processed and a copy provided to MDA SSCO and DIA SSO. NOTE: The SSCO will not provide any SCI administration support to prime contractors or subcontractors who do not have a signed active DD 254 for an MDA SCI contract.

8. The contractor shall not use references to SCI accesses, even by unclassified acronyms, in advertising, promotional efforts, or recruitment of employees.

9. All SCI work will be performed in a DIA accredited MDA SCIF unless otherwise authorized. Is there a SCIF required for this contract? _______ Yes or _______ No (COR required to mark an “X” in the appropriate space).

10. AIS SCI Processing. Electronic processing of SCI requires accreditation of the equipment in accordance with DCID 6/3 and DIAM 50-4.

11. Visit Cert. The contractor FSO/CSSO will submit the request for SCI visit certifications per guidelines of the MDA SCI Handbook through the COR for approval of the visit. The certification request must arrive at the Special Security Branch at least five (5) working days prior to the visit.

12. The contractor will not reproduce any SCI related material without prior written permission of the COR.

13. MDA has exclusive security oversight for all SCI released to the contractor or developed under this contract. Defense Intelligence Agency (DIA) is the cognizant security authority for all inspections of MDA sponsored contractor SCIF to ensure compliance with SCI Directives/Regulations. The Special Security Branch will conduct self-inspections of MDA-sponsored SCIFs.

B. The Missile Defense Agency is designated as the User Agency for SCI requirements.

Print name of MDA SSCO: Dave Gmaz ______

MDA SSCO Signature: ______________________________ Date:

Phone: __________________________

Print name of COR/Directorate designation: _____________________________

COR Signature: Date:

Phone:

E-1 – SCI Access/Billet (Nomination) Request

(To be used by MDA affiliated CSSO/FSO in submitting contractors for SCI access)

(Put the template below on company letterhead)

Date

MEMORANDUM FOR DEFENSE INTELLIGENCE AGENCY

THRU MISSILE DEFENSE AGENCY, ASSISTANT DIRECTOR, SPECIAL

SECURITY BRANCH

SUBJECT: MDA Contractor SCI Access Nomination Request

Request the below named individual be nominated for SCI access.

a.

Name:

b.

Aliases:

c.

SSN:

d.

DOB/POB:

e.

Current Investigation/Type/Date:

f.

Citizenship:

g.

Position Title:

h.

COR’s Name, Grade, Organization, and Telephone Number:

i.

MDA SCI Contract Number:

j.

Contract Services Start and Expiration Date:

k.

Location of Facilities Where Work is to be Performed:

l.

Access required: (Fill in SCI compartments required, i.e. SI/TK/G/HCS) m.

Justification: (Separate justification for each compartment requested is required, why the job cannot be performed without SCI, and how the individual will use the information.)

Signature Block for MDA COR

Signature Block for CSSO/FSO

(Both Prime and Sub CSSO/FSO must sign if the individual supports a subcontract)

NOTE: Submit this signed letter with a copy of the candidate’s SF 86 with minimal pen and ink updates (initialed and dated), originally re-signed and re-dated within 60 days and a copy of the contract’s DD Form 254 (both sub and prime as applicable) as a part of the complete SCI Access/Billet (Nomination) Request package to the Special Security Branch.

FOR OFFICIAL USE ONLY/ BMDS CONTROLLED UNCLASSIFIED INFORMATION SUPPLEMENT

1. Definitions.

a. Ballistic Missile Defense System Controlled Unclassified Information (BMDS CUI). MDA/BMDS Unclassified information associating specific technologies to components, sub-systems or systems revealing sensitive configurations of a sub-system or system; identification of out-year funding or redirection of funds to specific components or projects revealing a re-prioritization of program direction; or information revealing sensitive BMDS plans, intentions, or activities relating to BMDS operations or contingencies. Examples: 1) Unclassified information that, if not protected, could lead to revealing classified Critical Program Information. 2) Information that identifies the number of components intended to be configured that would make up the operational Field of View of an interceptor thus potentially leading to concluding the Instantaneous Field of View. 3) MDA/BMDS infrastructure information revealing the location of sensitive areas, the facility protective measures, information disclosing infrastructure or security operations, harm or damage to persons, systems, utilities, or facilities, that are not otherwise eligible for classification under Executive Order 12958, as amended. BMDS CUI meets the requirement of Controlled Unclassified Information, as defined below, requiring protection during dissemination.

b. Controlled Unclassified Information (CUI). Unclassified information which requires access and distribution limitations prior to appropriate coordination and an official determination by cognizant authority approving clearance of the information for release to one or more foreign governments or international organizations, or for official public release. It includes BMDS CUI or other information marked, or that is eligible for marking, as "For Official Use Only" (FOUO) in accordance with DoD 5400.7-R; technical information as discussed in DoD 5230.24 and 5230.25; information that is subject to export controls in accordance with the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR); sensitive information as defined in the Computer Security Act of 1987, or other qualifying information as identified in DoD 5200.1-R.

c. Dual Citizenship. A dual citizen is a citizen of two nations. For the purposes of this document, an individual must have taken an action to obtain or retain dual citizenship. Citizenship gained as a result of birth to non-U.S. parents or by birth in a foreign country to U.S. parents thus entitling the individual to become a citizen of another nation does not meet the criteria of this document unless the individual has taken action to claim and to retain such citizenship.

d. For Official Use Only (FOUO). Information that may be withheld from public disclosure under one or more of the 9 exemptions of the Freedom of Information Act (FOIA) (See DoD 5400.7-R). FOUO is not a form of classification to protect U.S. national security interests.

e. National of the United States. Title 8, United States Code (U.S.C.) Section 1101(a)(22), defines a National of the United States as:

(1) A citizen of the United States, or,

(2) A person who, though not a citizen of the United States, owes permanent allegiance to the United States.

NOTE: 8 U.S.C. Section 1401, paragraphs (a) through (g), lists categories of persons born in and outside the United States or its possessions that may qualify as Nationals and Citizens of the United States. This subsection should be consulted when doubt exists as to whether or not a person can qualify as a National of the United States.

f. Personal Information. Information about an individual that is intimate or private to the individual, as distinguished from information related to the individual's official functions or public life.

g. Privacy Act. The Privacy Act of 1974, as amended, 5 U.S.C. Section 552a.

h. U.S. Person. Any form of business enterprise or entity organized, chartered, or incorporated under the laws of the United States or its possessions and trust territories and any person who is a citizen or national (see National of the United States) of the United States, or permanent resident of the United States under the Immigration and Nationality Act.

2. General.

a. The FOIA requires U.S. Government offices to disclose to any requestor information resident in U.S. Government files unless the information falls under one of 9 exemption categories. BMDS CUI and other information may fall in this category.

b. BMDS CUI in the hands of contractors may not be released to the public by the contractor unless (a) the Contracting Officer's Representative (COR) concurs, (b) it has been reviewed by The Information Safeguards Branch, and (c) written approval has been provided by MDA/PA.

c. Access.

(1) Access to BMDS CUI must be limited to U.S. Persons (precludes access by individuals claiming dual citizenship without MDA/DXSS permission) unless the access is authorized by MDA/DXSS or, in the case of technical data as defined by the ITAR, the access is covered by a Technical Assistance Agreement or other form of duly licensed export. This requirement does not apply to use of commercial off the shelf (COTS) equipment and services that do not have export limitations.

(2) Non-Sensitive Positions (ADP/IT-III positions). Non-sensitive positions associated with BMDS CUI are found at contractor facilities processing BMDS CUI on their (contractor's) unclassified computer systems. Personnel nominated to occupy ADP/IT-III designated positions (applies to any individual that may have access to BMDS CUI on the contractor's computer system) must have at least a National Agency Check (NAC) or contractor equivalent (company hiring practices reviewed and approved by MDA/DXSS). When "contractor equivalent" option is NOT authorized and there is no record of a valid investigation, the contractor shall forward the employee information (completed SF 85P, "Questionnaire for Positions of Public Trust," and two DD Forms 258 (Fingerprint Cards), through the Contracting Officer's Representative, to: MDA/DXSS; ATTN: Personnel Security, 7100 Defense Pentagon, Washington, D.C. 20301-7100.

d. Impact of 9/11/01. Listings and locations of critical infrastructure, lists of individuals, information on security systems, and other information that may allow terrorists to target a facility have taken on greater significance. This type information is now protected as FOUO or, in many cases, is being classified.

3. Identification Markings.

a. An unclassified document that qualifies for FOUO marking, when marked, shall be marked "For Official Use Only" at the bottom of the page on the outside of the front cover (if any), on the first page, on each page containing FOUO information, on the back page and on the outside of the back cover (if any), centered at the bottom of the page. For convenience, all pages, even those that do not contain FOUO information, may be marked "For Official Use Only" in documents generated by an automated system.

b. Individual pages within a classified document that contain both FOUO and classified information shall be marked at the top and bottom with the highest security classification of information appearing on the page. Individual pages containing FOUO information but no classified information shall be marked "For Official Use Only" at the top and bottom of the page (unless all pages are being marked with the highest overall security classification level).

c. All declassified MDA BMDS information is “unclassified official government information” and requires official MDA Security and Policy Review prior to official public release.

d. E-mails and other electronic files shall be marked in the same fashions as described for documents above, to the maximum extent possible.

4. Handling.

a. During any temporary sojourn of MDA Unclassified information outside of the contractor controlled work space (residence, telework facility, hotel), the material must be stored in a locked room, drawer, filing cabinet, briefcase, or other storage device, so that access to the material by unauthorized individuals (i.e., family members, hotel staff, etc.) is prevented whenever untended by the contract employee.

(1) Long term task driven deadlines (in excess of five days) or the need to be able to perform official work while in an extended travel status on contract-driven business, require extended access to MDA Unclassified information outside of “official” work spaces. When that happens, employees may request written approval from their supervisors to possess, work on, and store MDA Unclassified information in non-contractor facilities for a period of not more than thirty calendar days.

(2) Requests for extended possession, use, and storage of MDA Unclassified information outside of “official” work spaces (periods in excess of 30 days) shall take the form of a Memorandum For Record (MFR) prepared by the employee which specifies the body of information to be removed by listing the: title or subject matter; Program, Project, or Task being supported; general volume and format of the information concerned; and projected date of return. Additionally, the MFR shall contain a signature block for the supervisor to sign and date when approval is granted.

(3) The availability of supervisory copies of MFRs as described in this section may be an inspection item during Security Program Reviews conducted by the MDA/DXSS staff.

(4) The affected employee shall keep the originally signed MFR in validation of authorization granted for the agreed term of use. The supervisor shall maintain a copy of the MFR with employee records for the same term.

(5) Requested extensions of supervisory authorization for employee possession, use, and storage of MDA Unclassified information outside of “official” work spaces may be granted in incremental blocks of 30 days each so long as the work-related requirement continues.

(6) All affected employees authorized to possess, use, and store MDA Unclassified information outside of “official” work spaces must return all MDA Unclassified information to contractor control upon “task” completion. When such a return has been completed, the supervisor shall annotate the date that all items were returned. The supervisor's copy shall be retained for a period of time, not to exceed one year.

b. The above excludes unclassified information of an administrative nature including necessary personnel recall rosters and official telephone lists which are needed by supervisors and employees to assure the physical security, safety, health, and general psychological well-being of the contractor work force.

5. Transmission/Dissemination/Reproduction.

a. The Prime and subcontractors are authorized to flow, exchange, or transmit CUI to each other, DOD officials, and other DOD contractors having "need to know" in accordance with the NISPOM and Export Control requirements. Further guidance on specific "need to know" determinations for information associated with this contract will be provided in the contract document or on-request from the contracting officer's representative (COR). The MDA Chief Information Officer (CIO) has determined that encryption of external data transmissions of BMDS CUI are now practical. The CIO has stated that Public Key Infrastructure (PKI) and Public Key (PK) enabling technologies are available and cost effective. The following general guidelines apply:

(1) In accordance with DoD 5200.1-R, Appendix III, external electronic data transmissions of CUI/FOUO shall be only over secure communications means approved for transmission of such information, whenever practical. Encryption of e-mail to satisfy this requirement shall be in accordance with MDA Directive 8190.01, Electronic Collaboration with Commercial, Educational, and Industrial Partners, May 12, 2009, being accomplished by use of DoD-approved Public Key Infrastructure Certification available from: http://iase.disa.mil/pki/eca/certificate.html. The MDA Information Management & Technical Operations Directorate (MDA/DOC) PKI/Common Access Card (CAC) Point of Contact is, Ms. Ingrid Weecks (719-721-7040).

(2) In accordance with DoD 5200.1-R, Appendix III, external electronic transmissions of BMDS CUI via voice, facsimile, or video teleconference shall be only over secure communications means approved for transmission of information wherever practical. Transmitting BMDS CUI via these means, without encryption requires prior written authorization by MDA/DOC - Chief Information Officer (CIO).

b. Failure of the contractor to encrypt CUI introduces significant risks to the BMDS mission. It is essential for the contractor to understand the risks and mitigation options that are available. The contractor must understand that failure to encrypt BMDS CUI carries with it certain risks to the mission. These risks can be mitigated with the thoughtful application of processes, procedures, and technology.

(1) Risks Include:

· Undermining our OPSEC efforts at a time that we begin to focus on implementing missile defense plans in Europe.

· The aggregation of CUI can communicate events and plans that may be classified (i.e., "classification by compilation").

· Not properly encrypting contributes to a lax security environment.

(2) Some of the available mitigation tools include:

· Approved DoD PKI/CAC hardware token certificates or DoD trusted software certificates for encrypting data in transport

· Industry best practice of Virtual Private Network (VPN) Internet Protocol Security (IPSEC) for intra-organization transport

· Industry best practice of Secure Sockets Layer Portal Web Services for document sharing and storage

· Approved DoD standard solutions for encrypting data at rest

· Approved DoD E-Collaboration services via MDA Portal or Defense Information Systems Agency (DISA) Network Centric Enterprise Services (NCES)

· Any FIPS 140-2 validated encryption [e.g., IPSEC, Secure Socket Layer/Transport Layer Security (SSL/TLS), Secure/Multipurpose Internet Mail Extensions (S/MIME)

· Procure and employ Secure Telephone Unit/Secure Telephone Equipment (STU/STE)

· Procure and employ secure facsimile (FAX) capability

· Utilize secure VTC capabilities

· Hand-carry CUI

· Utilize mailing through U.S. Postal Service

· Utilize overnight express mail services.

c. The MDA CIO has taken the position that encryption technologies are readily available, easy to obtain, inexpensive, and practical to implement. Therefore, if the contractor believes there are performance locations that cannot encrypt BMDS CUI, the contractor will provide within 120 days of contract signing, a list of those locations along with explanation as to why encryption is not practical. This list will be provided to the Procuring Contracting Officer (PCO) and Contracting Officer Representative for transmission to MDA/DOC (CIO) and MDA/DXSS. The MDA CIO will determine the acceptability of contractor submissions and will notify the PCO of any decisions regarding encryption.

d. BMDS CUI shall be processed and stored internally on Automated Information Systems (AIS) or networks: (1) when distribution is to an authorized recipient, and (2) if the receiving system is protected by either physical isolation or a password protection system. Holders shall not use general, broadcast, or universal e-mail addresses to distribute BMDS CUI. Discretionary access control measures may be used to preclude access to BMDS CUI files by users who are authorized system users, but who are not authorized access to BMDS CUI. External transmission of BMDS CUI shall be secured using NIST-validated encryption.

e. The World Wide Web shall be equated with "Public Access." Information must be reviewed by MDA/PA and officially approved for public release before it is placed on publicly-accessible Web pages or electronic bulletin boards. Contractor personnel who maintain and post information on websites or web logs (BLOGS), and who provide OPSEC reviews of such, should receive OPSEC Awareness information that specifically addresses DoD guidance associated with these activities.

f. Do not mark shipping containers as containing BMDS CUI or FOUO.

g. Reproduction of BMDS CUI may be accomplished on unclassified copiers within designated government or contractor reproduction areas.

6. Storage. During working hours, BMDS CUI shall be stored in a manner that limits access by persons who do not have an official need for the information. During non-working hours and when internal building security is provided, BMDS CUI may be filed with other unclassified records in unlocked files or desks. When there is no internal building security, locked buildings or rooms provide adequate after-hours protection, or the material can be stored in locked receptacles such as cabinets, desks, or bookcases.

7. Disposition.

a. When no longer needed, BMDS CUI shall be disposed of in the same manner as classified waste, or in a manner that will preclude reconstruction. To use the "preclude reconstruction" option, the following minimum standard must be met:

(1) Cross-cut shredder with a maximum width of 1/4" and a maximum length of 1.5", or

(2) Strip shredder (or tearing/cutting) with a maximum width of 1/4".

b. Removal of the FOUO or BMDS CUI status can only be accomplished by the government originator. The MDA COR shall review and/or coordinate with proper authority the removal of FOUO or BMDS CUI status for information in support of contract activity.

PAGE

FOR OFFICIAL USE ONLY