Attachment_5_DD_254_Part_II.pdf

FOR OFFICIAL USE ONLY

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 1

DD254, Item 13………… Continuation Page

Government Customer Name: Luz D. Ortiz

Prime Contract Number:

Solicitation or Other Number: HQ0034-16-R-0284

Contractor Name:

ITEM 1a. FACILITY CLEARANCE

• When access to DoD information is at a government facility, the contractor shall follow all local government policy and procedures to safeguard information (classified or unclassified).

• Personnel clearances shall be issued and posted in JPAS prior to access.

• The contractor shall ensure all required security education/training requirements, and/or re-certifications are accomplished prior to access.

ITEM 1b. SAFEGUARDING

• Contractor is authorized to store classified material at its location at the level specified. DSS must approve safeguarding capability and provide oversight.

ITEM 7. SUBCONTRACTOR

• Contractor shall seek and obtain approval from the government prior to issuing a subcontract.

• Contractor shall issue a DD 254 to the subcontractor and provide applicable security classification guidance.

ITEM 8. ACTUAL PERFORMANCE

• This item provides information on the primary location for contract performance.

ITEM 10a. COMSEC INFORMATION (Information/Material/Equipment)

• Contractor requires access to COMSEC information and/or a COMSEC account as listed in the PWS/SOW. Access to COMSEC information may be at the customer location or at the contractor facility, if approved by DSS.

- Contractor shall follow policy and procedures to safeguard COMSEC information.

- Contractor shall not remove COMSEC information from the customer’s facility unless it has approved safeguarding capability and is authorized by the government.

- Contractor shall immediately notify the customer of missing COMSEC information.

- If a COMSEC account is required by the contract, the contractor shall follow government policy to establish an account and safeguard COMSEC information.

- Prior approval of the Government Contract Agency (GCA) is required in order for the prime contractor to grant COMSEC access to a subcontractor.

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 2

- COMSEC materials shall be returned to the government upon completion of this contract or when no longer required to support this contractor, whichever occurs first.

ITEM 10b. RESTRICTED DATA

• Contractor shall not have access to Restricted Data until all approvals are in place, briefings are completed and access authorizations are recorded in the Joint Personnel Adjudication System (JPAS).

• Contractor shall obtain DSS approval to store Restricted Data in the facility listed in Item 6a.

ITEM 10c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI)

• Contractor shall obtain DSS approval to store this material in the facility listed in Item 6a.

• Contractor shall obtain government approval for access to CNWDI and follow government policy to safeguard CNWDI.

• Contractor personnel shall not have access to CNWDI until all approvals are in place, briefings are completed and access recorded in JPAS.

• GCA approval is required prior to granting CNWDI access to a subcontractor.

ITEM 10d. FORMERLY RESTRICTED DATA

• Contractor shall obtain DSS approval to store this material in the facility listed in Item 6a.

• Contractor shall obtain government approval for access to Formerly Restricted Data and follow government policy to safeguard Formerly Restricted Data.

• Contractor shall not have access to Formerly Restricted Data until all approvals are in place, briefings are completed and (Restricted Data) access recorded in JPAS.

ITEM 10e(1). SENSITIVE COMPARTMENTED INFORMATION (SCI)

• Contractor shall obtain facility accreditation to store SCI in the facility listed in Item 6a, if required by the contract.

• Contractor shall not have access to SCI until all approvals, briefings, non-disclosures are signed, and SCI access recorded in JPAS.

• Prior approval from DIA is required before a subcontract requiring access to SCI can be issued.

• Contractor shall follow SCI policy and guidance as listed in DoDM 5105.21.

• All SCI will be handled in accordance with special security requirements, which will be furnished by the designated responsible special security office (SSO).

• SCI will not be released without approval from the OCA.

• Inquiries pertaining to SCI classification guidance will be directed to the SSO.

• SCI remains the property of the government and upon completion of the contract, will be returned or destroyed IAW instructions provided by the government.

ITEM 10e(2). NON-SCI

• Contractor shall obtain facility accreditation to store Non-SCI in the facility listed in Item 6a, if required by the contract.

• Contractor shall obtain government approval for access to Non-SCI and follow government policy to safeguard Non-SCI.

• Contractor shall not have access to Non-SCI until all approvals and briefings are in place and SCI access recorded in JPAS.

• Prior approval of the GCA is required before a subcontract involving access to Non-SCI can be issued.

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 3

ITEM 10f. SPECIAL ACCESS INFORMATION

• Contractor shall obtain approval to store Special Access Program (SAP) information in the facility listed in Item 6a, if required by the contract.

• Access to SAP information requires approval from the SAP Program Security Office.

• Contractor shall follow government policy to safeguard SAP information.

ITEM 10g. NATO INFORMATION

• Contractor shall obtain approval to store NATO information at the facility listed in Item 6a, if required by the contract.

• Contractor shall follow government policy to safeguard NATO information.

• Contractor shall not have access to NATO information until the NATO briefing has been completed and

NATO access recorded in JPAS.

• The prime contractor must receive approval from the GCA to grant NATO access to a subcontractor.

ITEM 10h. FOREIGN GOVERNMENT INFORMATION

• Contractor shall obtain approval to store Foreign Government Information at the facility listed in Item 6a, if required by the contract.

• Contractor shall follow government policy to safeguard Foreign Government Information.

• The prime contractor must receive approval from the GCA to grant access to a subcontractor.

ITEM 10i. LIMITED DISSEMINATION INFORMATION

• NA, unless otherwise directed by the Security Manager.

ITEM 10j. FOR OFFICIAL USE ONLY (FOUO)

• FOUO and/or other types of Controlled Unclassified Information (CUI) provided under this contract shall be safeguarded as required by Volume 4 of the DoDM 5200.1.

• Contractor shall:

- Ensure Personally Identifiable Information (PII) (also a type of CUI) protected under the

Privacy Act Program is safeguarded as required by government policy.

- Not remove or alter FOUO markings unless approved in writing by the government.

- Enforce “need to know.”

- Not release FOUO information to unauthorized persons.

- Destroy FOUO information by approved methods (e.g. burn bag).

ITEM 10k. OTHER (Protection of Other Types of Sensitive Information)

• DoD INFORMATION: All information in the custody and control of the DoD. Contractor will protect DoD information in accordance with current DoD regulations.

• CONTROLLED UNCLASSIFIED INFORMATION (CUI): Unclassified, sensitive information that requires safeguarding and/or dissemination controls. Contractor will protect CUI in accordance with Volume 4 of the DoDM 5200.1.

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 4

• PERSONALLY IDENTIFIABLE INFORMATION (PII): Contractor shall protect PII as required by the Privacy Act of 1974, DoD 5400.11-R, DoDM 5200.1, Volume 4, etc. The following box provides guidelines for protecting PII:

PII PROTECTION

DOs and DON’Ts

DO: DON’T:

Immediately report known or suspected instances of a breach to the security manager at: whs.pentagon.em.mbx.security-officers@mail.mil.

Disclose PII to unauthorized individuals.

If involved in a breach, immediately attempt to recover the PII to bring it back under DoD control.

Leave your CAC in your computer when away from your desk.

Enforce need-to-know. Email unencrypted PII.

Safeguard PII in a locked desk drawer or file cabinet.

List PII on the subject line of emails.

Look for PII during end of day checks and if found, safeguard as required.

Email PII to personal email accounts/servers (e.g., yahoo or Gmail).

Apply appropriate markings to documents and email containing PII.

Post PII to a shared network drive/folder unless the folder is limited to access by those persons with an official need-to-know.

If emailing PII outside of .mil for an official purpose and you cannot encrypt the email, you must password protect the document.

Store PII on laptops or other removable media.

Store and process PII only in approved customer locations.

Share/use/post PII to social media sites or any publicly accessible web site.

If teleworking, access PII only via a WHS connection with a WHS-issued laptop.

Store PII on CD/DVDs unless approved in writing by the COR/COTR.

Retrieve or clear PII from fax machines, printers, and copiers.

Store PII in a motor vehicle.

Use a burn bag to destroy PII. Dispose of PII in trash cans or recycle bins.

Ensure 100% accountability of paper documents containing PII.

Leave PII unprotected.

mailto:whs.pentagon.em.mbx.security-officers@mail.mil mailto:whs.pentagon.em.mbx.security-officers@mail.mil

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 5

ITEM 11a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR’S FACILITY

OR A GOVERNMENT ACTIVITY

• Refer to Item 8 on the DD Form 254 for actual performance locations.

ITEM 11b. RECEIVE CLASSIFIED DOCUMENTS ONLY

• Prior to the receipt/storage/generation of classified information at the facility listed in 6a, the contractor shall ensure DSS has authorized SAFEGUARDING at the appropriate level and that the level approved is reflected in the DSS Industrial Security Facilities Database (ISFD).

• Contractor shall comply with NISPOM requirements for the safeguarding of classified information.

ITEM 11c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

• Prior to the receipt/storage/generation of classified information at the facility listed in 6a., the contractor shall ensure DSS has authorized SAFEGUARDING at the appropriate level and that the level approved is reflected in the DSS Industrial Security Facilities Database (ISFD).

• Contractor shall ensure that any information system used to process classified under this contract is accredited by DSS PRIOR TO use, as required by the NISPOM.

• Contractor shall comply with the NISPOM for access to and safeguarding of classified information.

• Contractor employees who generate classified information are required to complete training related to derivative classification as well as all other training associated with the protection of classified material.

• Contractor shall not apply derivative classification until an approved Security Classification Guide is provided by the government customer.

• Contractor shall comply with the security classification guidance provided by the customer.

ITEM 11d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

• Contractor shall contact DSS to pursue approval for storage of unusually large hardware not suitable for standard GSA safes.

• Contractor shall identify the need for DSS approval of a restricted or closed area.

ITEM 11e. PERFORM SERVICES ONLY

• See Item 9 for a description of services.

ITEM 11f. HAVE ACCESS TO CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S.

POSSESSIONS AND TRUST TERRITORIES

• Contractor shall comply with security requirements at the installation identified in Item 8.

• Contractor shall comply with security inspections at the direction of the GCA and government customer.

ITEM 11g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMAITON CENTER

(DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

• Contractor shall comply with government policy for registration and access to DTIC.

• Contractor shall comply with government policy to safeguard information obtained from DTIC and shall not possess material with a higher classification than that of the facility clearance.

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 6

ITEM 11h. REQUIRE A COMSEC ACCOUNT

• See Item 10a. for details.

ITEM 11i. HAVE TEMPEST REQUIREMENTS

• As directed by the government customer and determined necessary by the results of a vulnerability assessment, contractors will apply TEMPEST countermeasures as required.

• TEMPEST is a requirement additional to NISPOM regulations.

• Prime contractors are not authorized to impose TEMPEST on subcontractors without GCA approval.

ITEM 11j. HAVE OPSEC REQUIREMENTS

• The GCA will provide the contractor with the appropriate OPSEC requirements/plan.

• OPSEC requirements are supplemental to NISPOM requirements.

• Prime contractors are not authorized to impose OPSEC on subcontractors without GCA approval.

ITEM 11k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

• Contractor shall ensure the GCA has obtained approval from the Commander, Defense Courier Service

(DCS).

• The use of DCS does not apply to all classified information. Refer to the NISPOM and GCA for guidance.

• Prior approval of the GCA is required before a prime contractor can authorize a subcontractor to use the services of DCS.

ITEM 11l. OTHER (Additional Information/Guidance)

• COMMON ACCESS CARD (CAC): CACs will be issued to contractors as required. The government issued CAC is the property of the U.S. Government and shall be returned when expired or no longer required for performance on this contract. The CAC must be returned to the issuing office or the WHS Security Manager at:

WHS Security Attn: Chris Forshey

4800 Mark Center Drive, 03F09-02 Alexandria, VA 22350

• DOD COMPUTER SECURITY: All DoD information shall be processed only on DoD approved information systems. When classified processing is required at the contractor location, the system must be accredited by the Defense Security Service (DSS) in accordance with the DoDM 5220.22 (NISPOM). Contractors shall not process classified information on systems prior to accreditation.

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 7

The following box provides reminders for computer security:

DoD COMPUTER SECURITY DOs and DON’Ts

DO: DON’T:

Complete Information Assurance (IA) awareness training as required, and prior to use of any DoD system(s).

Process DoD information on personal computer devices.

Use digital signatures for DoD email. Transfer data using commercial web email.

Encrypt all emails containing unclassified sensitive information such as FOUO, CUI and PII.

Download files from commercial web email or entertainment sharing sites to DoD computers.

Avoid opening suspicious emails and report them to the Security Manager.

Plug personal devices into DoD computers.

Remove CAC when away from the workstation.

Use DoD procured and/or owned removable storage media on non-government networks and computers.

Lock computer when away. Click on pop-up messages or unknown links.

Ensure the computer is protected with the most updated virus software.

Store passwords on electronic devices or online.

Create complex passwords. Email DoD information to personal email accounts such as Yahoo/Hotmail.

Shut down the computer when leaving the office.

Email Personally Identifiable Information (PII) to personal emails accounts such as Yahoo/Hotmail.

Log out of every site logged into (e.g., web browsers, instant messaging clients, etc.)

Modify DoD information systems or introduce hardware or software unless approved by the CO and government customer.

• WIRELESS SECURITY POLICY: The contractor shall not install or operate wireless access points (e.g.

hot spots, routers) or any other Radio Frequency (RF) installations without written government approval. Personal electronic devices (e.g. cell phone, iPad) are not authorized in any government secure facilities.

• UNCLASSIFIED DOD INFORMATION PROCESSING: All unclassified DoD information must be processed on DoD information systems and may not be transferred to any information system that is not owned, used, or operated by the DoD.

• WEB SITES: Contractor shall not post DoD information to any DoD controlled web site or publicly accessible web site unless directed, in writing, by the CO and/or government customer.

• PERSONAL DEVICES: Contractor shall not use any personal or other non DoD approved devices (e.g.

laptops, cell phones, PDAs, cameras, voice recorders) to store, receive, process or transmit DoD information.

• COMPLIANCE WITH GCA SECURITY PROGRAM REQUIREMENTS: Contractor shall comply with GCA security program requirements while on site at the government location for the duration of the contract.

• ORIGINAL CLASSIFICATION AUTHORITY: NOT AUTHORIZED.

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 8

• DERIVATIVE CLASSIFICATION: Derivative classification may not be performed at the contractor location until safeguarding capability has been authorized and approved, and a Security Classification Guide is provided to the contractor by the CO and/or government customer.

- Contractors on-site at the government location performing this function must first complete the Derivative Classification training found on the DSS CDSE website.

• DECLASSIFICATION & DOWNGRADING OF CLASSIFIED INFORMATION: Declassification & downgrading of classified information is prohibited.

• SECURITY VIOLATIONS: In addition to NISPOM required actions, the contractor shall report all security violations to the WHS Security Office mailbox at Whs.pentagon.em.mbx.security-officers@mail.mil. The report will include the “who, what, where, when and why” details regarding the incident. Reports shall not contain classified information.

• UNAUTHORIZED DISCLOSURES OF CLASSIFIED INFORMATION: Contractor shall report all unauthorized disclosures of classified information to the WHS Security Office via its mailbox at Whs.pentagon.em.mbx.security-officers@mail.mil. The report will include the “who, what, where, when and why” details regarding the unauthorized disclosure. Reports shall not contain classified information.

• HAND CARRYING CLASSIFIED MATERIAL: Hand carrying is limited to the National Capital Region (NCR) and all personnel performing these duties must have a courier card. Prior to transfer, contractors shall receive training and ensure the classified material is contained in a double, lockable courier bag. Travel via aircraft is prohibited.

• TELEWORK: Telework with classified information is prohibited. If approved for telework, contractors must use a DoD approved laptop to connect to the WHS intranet. Telework with DoD information in paper form or on removable media (e.g. CDs) is prohibited.

• DESTRUCTION OF CLASSIFIED INFORMATION: At the contractor location, classified material shall be destroyed as required by the NISPOM.

- At DoD locations within the NCR, classified material is disposed via burn bags which are transferred to the Pentagon Incinerator for destruction.

- At DoD locations outside the NCR, contractors shall follow the destruction procedures of the host DoD facility.

• DISPOSITION OF DOD INFORMATION: All DoD information related to this contract shall be returned at contract end or when no longer needed, whichever occurs first.

• GOVERNMENT FURNISHED EQUIPMENT (GFE): Contractor shall return all GFE when no longer required for performance on this contract.

• PHOTOGRAPHY/RECORDINGS: The recording of DoD information, equipment, personnel or facilities via any means (e.g., images, audio) is prohibited.

• CONTINUED RESPONSIBILITY: Safeguarding classified information is a lifelong obligation. Upon completion of this contract, contractor personnel shall continue to safeguard classified information, Controlled Unclassified Information, and any other sensitive information to which they had access.

ITEM 12. PUBLIC RELEASE

• All DoD information intended for publication or dissemination must undergo a security and policy pre-publication review. This material includes, but is not limited to, the following: books, manuscripts and theses, biographies, articles, book reviews, audio/video materials, speeches, press releases, conference briefings, research papers, gaming materials and other media

• Prior to the release of contract-related information, the contractor must submit the material to the DoD Office of Security Review for review and approval. Release of contract-related information is not authorized without approval from this office.

• All unauthorized releases of DoD information shall be reported to the WHS Security Office via the mailbox at Whs.pentagon.em.mbx.security-officers@mail.mil.

mailto:security@whs.mil mailto:security@whs.mil mailto:security@whs.mil mailto:security@whs.mil

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 9

ITEM 13. SECURITY GUIDANCE

• This document is contract specific and contains all additional security guidance.

ITEM 14. ADDITIONAL SECURITY REQUIREMENTS

• See Items 10e(1), 10e(2), and 10f for supplemental security requirements, as applicable.

ITEM15. INSPECTIONS

• This portion of the contract is outside the scope of Defense Security Service cognizance and DIA will retain oversight, provide guidance and perform inspections.

ITEM 16e. CERTIFICATION AND SIGNATURE

• The signature on this form validates security requirements associated with this contract.

• Inquiries regarding contract expenses should be referred to the government contracting office.

QUESTIONS ABOUT THIS DD FORM 254

• Contact the WHS Security Office at: Whs.pentagon.em.mbx.security-officers@mail.mil.

REFERENCES

• Applicable policies include, but are not limited to the following DoD regulations:

- DoD 5220.22-M, National Industrial Security Program Operating Manual, February 28, 2006

- DoDM 5200.1, Volumes 1 - 4, DoD Information Security Program, February 24, 2012

- DoDI 8523.01, Communications Security (COMSEC), April 22, 2008

- DoDM 5205.02-M, DoD Operations Security (OPSEC) Program Manual, November 3, 2008

- DoDM 5105.21, Volumes 1-3, Sensitive Compartmented Information (SCI) Administrative Security

Manual, October 19, 2012

- DoD 5200.2-R, Personnel Security Program, January 1987

- DoDI 5240.06, Counterintelligence (CI) Awareness, Briefing, and Reporting Programs, May 17, 2011, Incorporating Change 1, May 30, 2013

- DTM 08-003, Next Generation Common Access Card (CAC) Implementation Guidance, December 1, 2008, Incorporating Change 5, October 8, 2013

- Administrative Instruction 30, Force Protection on the Pentagon Reservation, June 26, 2009, Incorporating Change 2, September 27, 2012

- DoDD 5210.50, Management of Serious Security Incidents Involving Classified Information, October

27, 2014 mailto:security@whs.mil