ATTACHMENT_11__J-1_DD254.pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. AND SAFEGUARDING

a. CLEARANCE REQUIRED

b. LEVEL OF SAFEGUARDING REQUIRED

2. IS FOR: (X and complete as applicable)

a. CONTRACT NUMBER

b. SUBCONTRACT NUMBER

c. DUE DATE (YYYYMMDD)

3. IS: (X and complete as applicable)

a. (Complete date in all cases)

REVISION NO.

c. (Complete Item 5 in all cases)

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specs)

DATE (YYYYMMDD)

DATE (YYYYMMDD)

4. THIS A FOLLOW-ON CONTRACT? YES NO. Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. THIS A FINAL DD FORM 254? YES NO. Yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. (Include Commercial and Government Entity (CAGE) Code)

a. ADDRESS, AND ZIP CODE b. CAGE CODE c. SECURITY OFFICE (Name, Address, and Zip Code)

7.

a. ADDRESS, AND ZIP CODE b. CAGE CODE c. SECURITY OFFICE (Name, Address, and Zip Code)

8. PERFORMANCE

a. b. CAGE CODE c. SECURITY OFFICE (Name, Address, and Zip Code)

9. IDENTIFICATION OF THIS PROCUREMENT

10. CONTRACTOR WILL REQUIRE ACCESS TO: 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL:YES NO YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

d. FORMERLY RESTRICTED DATA

e. INTELLIGENCE INFORMATION

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI f.

g. NATO INFORMATION

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

j. FOR OFFICIAL USE ONLY INFORMATION

k. (Specify)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE TEMPEST REQUIREMENTS

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

l. (Specify)

CLEARANCE

FACILITY

THIS SPECIFICATION

PRIME

SOLICITATION OR OTHER NUMBER

THIS SPECIFICATION

ORIGINAL

FINAL

IS If

IS If

CONTRACTOR

NAME, COGNIZANT

SUBCONTRACTOR

NAME, COGNIZANT

ACTUAL

LOCATION COGNIZANT

GENERAL

SPECIAL ACCESS INFORMATION

OTHER

HAVE

OTHER

DD FORM 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE.

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Line

12. RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release a.

Direct Through (Specify)

d. ADDRESS (Include Zip Code)

Yes No to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. The security classifiection guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

14. Requirements, in addition to ISM requirements, are established for this contract.

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No15. Elements of this contract are outside the inspection responsibility of the cognizant security office.

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. questions shall be referred to the official named below.

b. TITLE c. (Include Area Code) e.

17. DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER f.

PUBLIC

TYPED NAME OF CERTIFYING OFFICIAL

SECURITY GUIDANCE.

ADDITIONAL SECURITY REQUIREMENTS.

INSPECTIONS.

All

TELEPHONE

SIGNATURE

REQUIRED

OTHERS AS NECESSARY

DD FORM 254 (BACK), DEC 1999

prudhommet Line

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

PrudhommeT Highlight

DD254, Item 13………… Continuation Page

Government Customer Name: FSD

Prime Contract Number: HQ0034-13-R-0003

Solicitation or Other Number: -

Contractor Name: TBD

Fieldsm Cross-Out

Fieldsm Inserted Text

HQ0034-14-R-0163

Fieldsm Sticky Note Accepted set by Fieldsm

Fieldsm Sticky Note Accepted set by Fieldsm

Item 8. Actual Performance

ITEM 8. ACTUAL PERFORMANCE

- Pentagon Reservation and the “Site” in Adams County Pennsylvania

- Storage/use of any DoD information at the contractor facility is prohibited.

- Storage/use of any DoD information at non DoD work sites (e.g. private residence) is prohibited.

Item 10. Contractor Will Require Access To

ITEM 10j. FOR OFFICIAL USE ONLY (FOUO)

- FOUO and/or other types of Controlled Unclassified Information (CUI) provided under this contract shall be safeguarded as required by government policy.

- Contractor shall ensure Personally Identifiable Information (PII) (also a type of CUI) protected under the Privacy Act Program is safeguarded as required by government policy.

- FOUO markings applied to information shall not be removed or altered unless approved in writing by the originator of the information.

- Enforce “need to know.”

- Do not release FOUO information to unauthorized persons to include the public/media.

- Destroy FOUO information by approved methods (e.g. burn bag).

ITEM 10k. OTHER (CONTRACTOR WILL REQUIRE ACCESS TO)

- Official DoD Information.

- Defined as: All information that is in the custody and control of the Department of Defense, relates to information in the custody and control of the Department, or was acquired by DoD employees as part of their official duties or because of their official status within the Department.

- Classified information up to the level indicated in item 1a.

- The contractor shall coordinate with Defense Security Service for processing personnel security clearances.

o Contractor shall not have access to classified information until:

A valid Facility Clearance is in place with Defense Security Service Personnel Security Clearances have been issued Each individual has received security training Each individual has completed a Standard Form 312 Classified Information

Non-Disclosure Agreement The security clearance/access has been posted to JPAS

- Contractor shall comply with Government policy to safeguard classified information.

- Contractor shall not release any DoD/Federal Government/Foreign Government information to any unauthorized person/entity/public/media.

Item 11. In Performing This Contract, The Contractor Will

ITEM 11a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

- Refer to Item 8 for actual performance locations.

ITEM 11c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

- Contractor shall successfully complete training related to derivative classification. Refer to Defense Security Service training.

- Contractor shall comply with security classification guidance when generating classified information. For classification guidance contact the Security Manager, Facilities Services Directorate at: 703-614-7649.

- Only DoD approved information systems shall be used.

- See Derivative Classification section.

ITEM 11j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

- Contractor shall comply with OPSEC requirements. Point of contact is the Security Manager, Facilities Services Directorate at: 703-614-7649.

ITEM 11l. OTHER (specify)

GOVERNMENT POLICY

- Contractor shall follow government policy for access to and safeguarding of all government information, facilities and equipment.

- The fact specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy.

PENTAGON BADGE

- If a Pentagon Badge is required for performance on this contract, each individual must have at a minimum, a completed favorable NCIC check before receiving a Pentagon Badge.

- Contractor shall follow instructions provided to complete this process.

All badges shall be returned when expired or no longer required for performance of this contract.

Return badges to: Ronald House

1155 Defense Pentagon Room 2E1009 Washington DC 20301-1155

COMMON ACCESS CARD (CAC)

The government issued credential (CAC) is the property of the U.S. Government and shall not be retained by the cardholder upon expiration, replacement, or when the DoD affiliation of the employee has been terminated. Unauthorized possession of an official credential, like a CAC, can be prosecuted criminally under section 701, title 18, United States Code.

The CAC must be returned to the issuing office or the DA&M WHS Security Manager at:

Ronald House

1155 Defense Pentagon Room 2E1009 Washington DC 20301-1155

- If a CAC is required for performance on this contract (access to DoD information systems or facilities) each individual must have at a minimum, a completed favorable NACI. Other acceptable (favorable) background checks are:

- BI, BIPN, BIPR, CNCI, IBI, LBI, LBIP, LBIX, MBI, NACB, NACLC, NACS, NLC, NNAC, NSI, PPR, PRI, PRS, PRSC, PTSBI, SBBI, SBPR, SSBI.

- Individuals who require a security clearance to perform on this contract will be issued a CAC when appropriate based on the favorable results of ongoing or previous background checks.

Favorable results of a background check and eligibility of a security clearance must be posted to

JPAS.

- Individuals who do not require a security clearance to perform on this contract will be processed for a NACI background check by WHS (if the individual does not have a prior acceptable favorable background check).

- Individuals must comply with requirements for submission of the NACI check. Coordinate with the GCA and government customer.

- A CAC will be issued by WHS when appropriate.

INFORMATION SYSTEMS

- Personnel occupying Information Assurance management or user access positions must have the appropriate investigation level, security clearance and approval(s) in place.

- Contractor shall ensure DoD information is processed according to government policy. Some policy requirements are:

- DoD information shall be processed only on DoD approved information systems.

- Classified information shall be processed only on information systems approved for classified processing at the appropriate level.

- DoD information shall not be processed on Non DoD approved information systems (e.g.

personal/home/contractor computers).

- Contractor shall not modify DoD information systems or introduce hardware or software unless approved by the GCA and government customer.

- Contractors shall not use removable media (e.g. thumb drives, CDs).

WIRELESS SECURITY POLICY

- Contractor shall not install or operate wireless access points (e.g. Hot spots, routers) or other Radio Frequency (RF) installation without prior Reservation Installation Application (RAI) approval.

http://www.law.cornell.edu/uscode/18/701.shtml

DOD COMPUTING SECURITY BEST PRACTICES

- Contractor shall follow these best practices.

DO: DON’T:

- Complete IA awareness training. - Transfer data using commercial web email.

- Use digital signatures for DoD email.

- Download files from commercial web email or entertainment sharing sites to DoD computers.

- Use encryption to safeguard sensitive information.

- Open emails from unknown users or suspicious emails.

- Obtain a threat briefing if traveling

OCONUS.

- Discuss DoD information in public spaces.

- Remove your CAC from devices when you are not physically present.

- Use unknown computers to charge DoD devices.

- Report suspicious emails and/or activities to Security.

- Use DoD procured and/or owned removable storage media on non-government networks and computers.

- Click on pop-up messages or unknown links.

- Store passwords on electronic devices or online.

- Email DoD information to personal email accounts such as yahoo/hotmail.

- Email Personally Identifiable Information (PII) to personal emails accounts such as yahoo/hotmail.

DOD MOBILE DEVICE SECURITY BEST PRACTICES

- Contractor shall follow these best practices.

DO: DON’T:

- Obtain threat awareness training on wireless usage in public areas.

- Use wireless headsets or hands free devices.

- Disable wireless devices when not in use.

- Bring wireless enabled devices into classified areas.

- Use the CAC for authentication.

- Connect a blackberry type device to public wireless internet access points.

- Password protect wireless devices.

- Leave wireless devices unattended.

- Remove and secure removable media and peripheral devices when not in use.

- Use text messaging services to discuss sensitive information.

- Lock and secure devices when not in use.

- Accept Bluetooth connection requests.

- Immediately report lost or stolen devices to Security.

- Use removable storage media unless specifically approved by the GSA or government customer.

- Use personally procures and/or owned removable storage media on DoD networks and computers.

SECURITY OF UNCLASSIFIED DOD INFORMATION ON NON-DOD INFORMATION SYSTEMS

- Contractor is not authorized to process Unclassified DoD information on Non-DoD Information Systems.

- Non-DoD Information Systems.

Defined as: Any information system that is not owned, used, or operated by the Department of Defense AND that is not used or operated by a contractor or other non-DoD entity on behalf of the Department of Defense.

- Contractor shall coordinate with the GCA and government customer if there is a requirement to process Unclassified DoD Information on Non-DoD Information Systems.

WEB SITES

- Contractor shall not post DoD information to any DoD controlled restricted web site unless approved by the GCA and government customer.

- Contractor shall not post DoD information to any publicly accessible web.

PERSONAL DEVICES

- Contractor shall not use any personal or other non DoD approved devices (e.g. laptops, cell phones, pda’s, cameras, voice recorders) to store, receive, process or transmit DoD information.

CLEARANCE & "NEED TO KNOW"

- Contractor shall ensure intended recipients of classified information have the appropriate security clearance, access briefings, awareness training, completed non-disclosure agreement and "need to know."

COMPLIANCE WITH GOVERNMENT CUSTOMER SECURITY PROGRAMS

- Contractor shall comply with government customer programs designed to safeguard information, facilities, equipment and personnel by complying with established education & awareness programs and operating procedures including but not limited to: Information Security, Physical Security, Personnel Security, Communications Security, Information System Security, Controlled Unclassified Information, Operations Security, Counterintelligence, Anti Terrorism Force Protection and Emergency Planning.

ORIGINAL CLASSIFICATION AUTHORITY

- Contractor does not have Original Classification Authority.

- Contractor personnel who believe information requires classification (for the first time) in the best interest to National Security shall safeguard the information as classified and immediately notify the GCA, government customer and DA&M WHS Security Manager.

DERIVATIVE CLASSIFICATION

- Contractor shall not perform this function unless approved by the GCA and government customer and complete appropriate training.

- Personnel who require derivative classification must first complete training at dss.mil. Create a STEPP account. Complete course code: IF103.16. Email the certificate of completion to:

security@whs.mil.

- Contractor shall not re-word, modify or otherwise alter originally classified information.

DECLASSIFICATION & DOWNGRADING OF CLASSIFIED INFORMATION

- Declassification & downgrading of classified information is prohibited.

UNAUTHORIZED PUBLIC DISCLOSURE OF CLASSIFIED INFORMATION

- Contractor shall not release any classified information to the public/media.

- Disclosure includes but is not limited to: person to person, the internet, social web sites, newspapers, television, radio.

- Contractor shall report known or suspected instances of unauthorized public/media disclosure of classified information.

- Contractor shall report known or suspected unauthorized disclosures to the GCA, government customer and the DA&M WHS Security Manager at security@whs.mil.

- At a minimum include the information described at Enclosure 3 of DoDD 5210.50.

- Additionally the Contractor shall:

o Not include classified information when reporting the incident via unclassified telephone or unclassified computer systems.

o Not confirm or deny the existence of classified information to the media or public.

o Not save, copy, paste classified information to DoD networks or to personal or company computer systems.

o Not print classified information.

o Not share classified information with unauthorized persons.

o Follow instructions provided by the government.

o Understand the classified information disclosed to the public remains classified and still requires safeguarding. Only an Original Classification Authority can declassify the information.

- Refer queries from the public, media, or press to the DA&M WHS Security Manager.

- Refer all Congressional queries to the DA&M WHS Security Manager.

VIOLATIONS

- Contractor shall report to the GSA and government customer all suspected or known violations to safeguard DoD information, equipment, facilities, personnel.

HAND CARRYING CLASSIFIED MATERIAL

- Hand carrying is limited to the Washington/Baltimore regional area.

- Contractor shall receive training, be issued a courier card and have lockable double courier bags to hand carry classified information.

mailto:security@whs.mil

- Travel by aircraft with classified information is prohibited.

STORAGE OF CLASSIFIED INFORMATION & CUI

- Contractor shall store classified information in GSA approved safes or facilities approved by the appropriate security office.

- Storage of DoD information at non DoD approved locations or in non DoD approved containers is prohibited.

- Contractor shall not take classified or other DoD information to a private residence or other unauthorized work location.

TELEWORK

- Telework with classified information is prohibited.

- Telework must be accomplished by connection to the WHS established network using a DoD approved laptop.

- Telework with DoD information in paper form or on removable media (e.g. CDs) is prohibited.

DESTRUCTION OF DOD INFORMATION

- All DoD information shall be destroyed by using the Pentagon Incinerator.

- If outside the National Capitol Region follow DoD approved destruction procedures of the hosting

DoD facility/installation commander.

DISPOSITION OF DOD INFORMATION

- Contractor shall return all DoD information used in performance of this contract when no longer needed or upon conclusion of this contract, whichever occurs first.

PROPERTY

- Contractor shall return all property to the DoD (government customer) when no longer required for performance of this contract.

PHOTOGRAPHY/RECORDINGS

- Recording images/audio (by any means) of DoD information, equipment, personnel or facilities is prohibited.

CONTINUED RESPONSIBILITY

- Upon completion of this contract, Contractor shall continue to safeguard classified information, Controlled Unclassified Information, and any other information they have had access too or knowledge of.

- Contractor shall report attempts by unauthorized persons to gain access to information. Send email notification to the DA&M WHS Security Manager at: security@whs.mil. Notify the GCA and government customer. Do not send classified information in this notification.

Item 12. Public Release

- Safeguarding DoD information is a lifelong obligation.

- Classified information shall never be released to the public.

- CUI shall never be released to the public.

- Personally Identifiable Information (PII) (a type of CUI) shall never be released to the public.

- Any DoD information intended for publication or dissemination must undergo a security and policy pre-publication review. This includes, but is not limited to:

o Books o Manuscripts and theses o Biographies o Articles o Book reviews o Audio/videomaterials o Speeches o Press releases o Conference briefings o Research papers o Gaming materials o Other media

- DoD information shall not be released unless the proper security review and approval has taken place by the appropriate DoD Office of Security Review and DoD Public Affairs Official.

- Prior to initiating a security review ensure the owner (Government Agency) of the information has conducted an internal security review and written guidance has been provided.

- Instructions for a formal DoD Security Review can be found at:

http://www.dtic.mil/whs/esd/osr/, or call 703-614-5001

- To contact the WHS Public Affairs Official send email to: information@whs.mil.

- Report unauthorized releases of DoD information to: security@whs.mil.

http://www.dtic.mil/whs/esd/osr/ mailto:information@whs.mil

Item 16e. Signature

Signing this DD254 is for validation of security requirements only. Expenses necessary to comply with security requirements is strictly between the contracting office, government customer and the contractor.

Questions About This DD Form 254

Please contact the DA&M WHS Security Manager at: security@whs.mil.

END OF ITEM 13

N/A c_COGNIZANT_SECURITY_OFF1:

N/A b_CAGE_CODE2:

N/A c_COGNIZANT_SECURITY_OFF2:

N/A

See Item 13

Alexandria, VA 22350 email: security@whs.mil

See Item 13 Continuation Page(s).

Office of Security Review 1155 Defense Pentagon Washington, D.C. 20301-1155

N/A