DD254_Item_13_Continuation.pdf

FOR OFFICIAL USE ONLY

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 1

DD254, Item 13………… Continuation Page

Government Customer Name: WHS HLD

Prime Contract Number: TBD

Solicitation or Other Number: TBD

Contractor Name: TBD

ITEM 1a. FACILITY CLEARANCE

• When access to DoD information is at a government facility, the contractor shall follow all local government policy and procedures to safeguard information (classified or unclassified).

• Personnel clearances shall be issued and posted in JPAS prior to access.

• The contractor shall ensure all required security education/training requirements, and/or re-certifications are accomplished prior to access.

ITEM 7. SUBCONTRACTOR

• Contractor shall seek and obtain approval from the government prior to issuing a subcontract.

• Contractor shall issue a DD 254 to the subcontractor and provide applicable security classification guidance.

ITEM 8. ACTUAL PERFORMANCE

• The work to be performed under this contract will be performed in a government provided office space in the OSD Historical Office in the Pentagon, with the exception of off-site interviews and archival research, which will be performed within the National Capital Region, and attendance at one historical conference outside the NCR. Contractor personnel may be requested to work at the Governments alternate locations during emergencies and emergency exercises.

ITEM 10c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI)

• Contractor shall obtain government approval for access to CNWDI and follow government policy to safeguard CNWDI.

• Contractor personnel shall not have access to CNWDI until all approvals are in place, briefings are completed and access recorded in JPAS.

• GCA approval is required prior to granting CNWDI access to a subcontractor.

• Contractor shall not have access to Formerly Restricted Data until all approvals are in place, briefings are completed and (Restricted Data) access recorded in JPAS.

ITEM 10g. NATO INFORMATION

• Contractor shall obtain approval to store NATO information at the facility listed in Item 6a, if required by the contract.

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 2

• Contractor shall follow government policy to safeguard NATO information.

• Contractor shall not have access to NATO information until the NATO briefing has been completed and

NATO access recorded in JPAS.

• The prime contractor must receive approval from the GCA to grant NATO access to a subcontractor.

ITEM 10j. FOR OFFICIAL USE ONLY (FOUO)

• FOUO and/or other types of Controlled Unclassified Information (CUI) provided under this contract shall be safeguarded as required by Volume 4 of the DoDM 5200.1.

• Contractor shall:

- Ensure Personally Identifiable Information (PII) (also a type of CUI) protected under the

Privacy Act Program is safeguarded as required by government policy.

- Not remove or alter FOUO markings unless approved in writing by the government.

- Enforce “need to know.”

- Not release FOUO information to unauthorized persons.

- Destroy FOUO information by approved methods (e.g. burn bag).

ITEM 10k. OTHER (Protection of Other Types of Sensitive Information)

• DoD INFORMATION: All information in the custody and control of the DoD. Contractor will protect DoD information in accordance with current DoD regulations.

• CONTROLLED UNCLASSIFIED INFORMATION (CUI): Unclassified, sensitive information that requires safeguarding and/or dissemination controls. Contractor will protect CUI in accordance with Volume 4 of the DoDM 5200.1.

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 3

• PERSONALLY IDENTIFIABLE INFORMATION (PII): Contractor shall protect PII as required by the Privacy Act of 1974, DoD 5400.11-R, DoDM 5200.1, Volume 4, etc. The following box provides guidelines for protecting PII:

PII PROTECTION

DOs and DON’Ts

DO: DON’T:

Immediately report known or suspected instances of a breach to the security manager at: whs.pentagon.em.mbx.security-officers@mail.mil.

Disclose PII to unauthorized individuals.

If involved in a breach, immediately attempt to recover the PII to bring it back under DoD control.

Leave your CAC in your computer when away from your desk.

Enforce need-to-know. Email unencrypted PII.

Safeguard PII in a locked desk drawer or file cabinet.

List PII on the subject line of emails.

Look for PII during end of day checks and if found, safeguard as required.

Email PII to personal email accounts/servers (e.g., yahoo or Gmail).

Apply appropriate markings to documents and email containing PII.

Post PII to a shared network drive/folder unless the folder is limited to access by those persons with an official need-to-know.

If emailing PII outside of .mil for an official purpose and you cannot encrypt the email, you must password protect the document.

Store PII on laptops or other removable media.

Store and process PII only in approved customer locations.

Share/use/post PII to social media sites or any publicly accessible web site.

If teleworking, access PII only via a WHS connection with a WHS-issued laptop.

Store PII on CD/DVDs unless approved in writing by the COR/COTR.

Retrieve or clear PII from fax machines, printers, and copiers.

Store PII in a motor vehicle.

Use a burn bag to destroy PII. Dispose of PII in trash cans or recycle bins.

Ensure 100% accountability of paper documents containing PII.

Leave PII unprotected.

mailto:whs.pentagon.em.mbx.security-officers@mail.mil mailto:whs.pentagon.em.mbx.security-officers@mail.mil

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 4

ITEM 11a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR’S FACILITY

OR A GOVERNMENT ACTIVITY

• Refer to Item 8 on the DD Form 254 for actual performance locations.

ITEM 11l. OTHER (Additional Information/Guidance)

• COMMON ACCESS CARD (CAC): CACs will be issued to contractors as required. The government issued CAC is the property of the U.S. Government and shall be returned when expired or no longer required for performance on this contract. The CAC must be returned to the issuing office or the WHS Security Manager at:

WHS Security Attn: Chris Forshey

4800 Mark Center Drive, 03F09-02 Alexandria, VA 22350

• DOD COMPUTER SECURITY: All DoD information shall be processed only on DoD approved information systems. When classified processing is required at the contractor location, the system must be accredited by the Defense Security Service (DSS) in accordance with the DoDM 5220.22 (NISPOM). Contractors shall not process classified information on systems prior to accreditation.

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 5

The following box provides reminders for computer security:

DoD COMPUTER SECURITY DOs and DON’Ts

DO: DON’T:

Complete Information Assurance (IA) awareness training as required, and prior to use of any DoD system(s).

Process DoD information on personal computer devices.

Use digital signatures for DoD email. Transfer data using commercial web email.

Encrypt all emails containing unclassified sensitive information such as FOUO, CUI and PII.

Download files from commercial web email or entertainment sharing sites to DoD computers.

Avoid opening suspicious emails and report them to the Security Manager.

Plug personal devices into DoD computers.

Remove CAC when away from the workstation.

Use DoD procured and/or owned removable storage media on non-government networks and computers.

Lock computer when away. Click on pop-up messages or unknown links.

Ensure the computer is protected with the most updated virus software.

Store passwords on electronic devices or online.

Create complex passwords. Email DoD information to personal email accounts such as Yahoo/Hotmail.

Shut down the computer when leaving the office.

Email Personally Identifiable Information (PII) to personal emails accounts such as Yahoo/Hotmail.

Log out of every site logged into (e.g., web browsers, instant messaging clients, etc.)

Modify DoD information systems or introduce hardware or software unless approved by the CO and government customer.

• WIRELESS SECURITY POLICY: The contractor shall not install or operate wireless access points (e.g.

hot spots, routers) or any other Radio Frequency (RF) installations without written government approval. Personal electronic devices (e.g. cell phone, iPad) are not authorized in any government secure facilities.

• UNCLASSIFIED DOD INFORMATION PROCESSING: All unclassified DoD information must be processed on DoD information systems and may not be transferred to any information system that is not owned, used, or operated by the DoD.

• WEB SITES: Contractor shall not post DoD information to any DoD controlled web site or publicly accessible web site unless directed, in writing, by the CO and/or government customer.

• PERSONAL DEVICES: Contractor shall not use any personal or other non DoD approved devices (e.g.

laptops, cell phones, PDAs, cameras, voice recorders) to store, receive, process or transmit DoD information.

• COMPLIANCE WITH GCA SECURITY PROGRAM REQUIREMENTS: Contractor shall comply with GCA security program requirements while on site at the government location for the duration of the contract.

• ORIGINAL CLASSIFICATION AUTHORITY: NOT AUTHORIZED.

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 6

• DERIVATIVE CLASSIFICATION: Derivative classification may not be performed at the contractor location until safeguarding capability has been authorized and approved, and a Security Classification Guide is provided to the contractor by the CO and/or government customer.

- Contractors on-site at the government location performing this function must first complete the Derivative Classification training found on the DSS CDSE website.

• DECLASSIFICATION & DOWNGRADING OF CLASSIFIED INFORMATION: Declassification & downgrading of classified information is prohibited.

• SECURITY VIOLATIONS: In addition to NISPOM required actions, the contractor shall report all security violations to the WHS Security Office mailbox at Whs.pentagon.em.mbx.security-officers@mail.mil. The report will include the “who, what, where, when and why” details regarding the incident. Reports shall not contain classified information.

• UNAUTHORIZED DISCLOSURES OF CLASSIFIED INFORMATION: Contractor shall report all unauthorized disclosures of classified information to the WHS Security Office via its mailbox at Whs.pentagon.em.mbx.security-officers@mail.mil. The report will include the “who, what, where, when and why” details regarding the unauthorized disclosure. Reports shall not contain classified information.

• HAND CARRYING CLASSIFIED MATERIAL: Hand carrying is limited to the National Capital Region (NCR) and all personnel performing these duties must have a courier card. Prior to transfer, contractors shall receive training and ensure the classified material is contained in a double, lockable courier bag. Travel via aircraft is prohibited.

• TELEWORK: Telework with classified information is prohibited. If approved for telework, contractors must use a DoD approved laptop to connect to the WHS intranet. Telework with DoD information in paper form or on removable media (e.g. CDs) is prohibited.

• DESTRUCTION OF CLASSIFIED INFORMATION: At the contractor location, classified material shall be destroyed as required by the NISPOM.

- At DoD locations within the NCR, classified material is disposed via burn bags which are transferred to the Pentagon Incinerator for destruction.

- At DoD locations outside the NCR, contractors shall follow the destruction procedures of the host DoD facility.

• DISPOSITION OF DOD INFORMATION: All DoD information related to this contract shall be returned at contract end or when no longer needed, whichever occurs first.

• GOVERNMENT FURNISHED EQUIPMENT (GFE): Contractor shall return all GFE when no longer required for performance on this contract.

• PHOTOGRAPHY/RECORDINGS: The recording of DoD information, equipment, personnel or facilities via any means (e.g., images, audio) is prohibited.

• CONTINUED RESPONSIBILITY: Safeguarding classified information is a lifelong obligation. Upon completion of this contract, contractor personnel shall continue to safeguard classified information, Controlled Unclassified Information, and any other sensitive information to which they had access.

ITEM 12. PUBLIC RELEASE

• All DoD information intended for publication or dissemination must undergo a security and policy pre-publication review. This material includes, but is not limited to, the following: books, manuscripts and theses, biographies, articles, book reviews, audio/video materials, speeches, press releases, conference briefings, research papers, gaming materials and other media

• Prior to the release of contract-related information, the contractor must submit the material to the DoD Office of Security Review for review and approval. Release of contract-related information is not authorized without approval from this office.

• All unauthorized releases of DoD information shall be reported to the WHS Security Office via the mailbox at Whs.pentagon.em.mbx.security-officers@mail.mil.

mailto:security@whs.mil mailto:security@whs.mil mailto:security@whs.mil mailto:security@whs.mil

The fact that specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy. The contractor must contact the government if there are questions regarding compliance. Page 7

ITEM 13. SECURITY GUIDANCE

• This document is contract specific and contains all additional security guidance.

ITEM 16e. CERTIFICATION AND SIGNATURE

• The signature on this form validates security requirements associated with this contract.

• Inquiries regarding contract expenses should be referred to the government contracting office.

QUESTIONS ABOUT THIS DD FORM 254

• Contact the WHS Security Office at: whs.pentagon.em.mbx.security-officers@mail.mil.

REFERENCES

• Applicable policies include, but are not limited to the following DoD regulations:

- DoD 5220.22-M, National Industrial Security Program Operating Manual, February 28, 2006

- DoDM 5200.1, Volumes 1 - 4, DoD Information Security Program, February 24, 2012

- DoDI 8523.01, Communications Security (COMSEC), April 22, 2008

- DoDM 5205.02-M, DoD Operations Security (OPSEC) Program Manual, November 3, 2008

- DoDM 5105.21, Volumes 1-3, Sensitive Compartmented Information (SCI) Administrative Security

Manual, October 19, 2012

- DoD 5200.2-R, Personnel Security Program, January 1987

- DoDI 5240.06, Counterintelligence (CI) Awareness, Briefing, and Reporting Programs, May 17, 2011, Incorporating Change 1, May 30, 2013

- DTM 08-003, Next Generation Common Access Card (CAC) Implementation Guidance, December 1, 2008, Incorporating Change 5, October 8, 2013

- Administrative Instruction 30, Force Protection on the Pentagon Reservation, June 26, 2009, Incorporating Change 2, September 27, 2012

- DoDD 5210.50, Management of Serious Security Incidents Involving Classified Information, October

27, 2014 mailto:whs.pentagon.em.mbx.security-officers@mail.mil