Exhibit_3_DD_254.pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

1. AND SAFEGUARDING

a. CLEARANCE REQUIRED

b. LEVEL OF SAFEGUARDING REQUIRED

2. IS FOR: (X and complete as applicable)

a. CONTRACT NUMBER

b. SUBCONTRACT NUMBER

c. DUE DATE (YYYYMMDD)

3. IS: (X and complete as applicable)

a. (Complete date in all cases)

REVISION NO.

c. (Complete Item 5 in all cases)

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specs)

DATE (YYYYMMDD)

DATE (YYYYMMDD)

4. THIS A FOLLOW-ON CONTRACT? YES NO. Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. THIS A FINAL DD FORM 254? YES NO. Yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of

6. (Include Commercial and Government Entity (CAGE) Code)

a. ADDRESS, AND ZIP CODE b. CAGE CODE c. SECURITY OFFICE (Name, Address, and Zip Code)

7.

a. ADDRESS, AND ZIP CODE b. CAGE CODE c. SECURITY OFFICE (Name, Address, and Zip Code)

8. PERFORMANCE

a. b. CAGE CODE c. SECURITY OFFICE (Name, Address, and Zip Code)

9. IDENTIFICATION OF THIS PROCUREMENT

10. CONTRACTOR WILL REQUIRE ACCESS TO: 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL:YES NO YES NO

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

d. FORMERLY RESTRICTED DATA

e. INTELLIGENCE INFORMATION

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI f.

g. NATO INFORMATION

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

j. FOR OFFICIAL USE ONLY INFORMATION

k. (Specify)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE TEMPEST REQUIREMENTS

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

l. (Specify)

CLEARANCE

FACILITY

THIS SPECIFICATION

PRIME

SOLICITATION OR OTHER NUMBER

THIS SPECIFICATION

ORIGINAL

FINAL

IS If

IS If

CONTRACTOR

NAME, COGNIZANT

SUBCONTRACTOR

NAME, COGNIZANT

ACTUAL

LOCATION COGNIZANT

GENERAL

SPECIAL ACCESS INFORMATION

OTHER

HAVE

OTHER

DD FORM 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE.

12. RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release a.

Direct Through (Specify)

d. ADDRESS (Include Zip Code)

Yes No to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. The security classifiection guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

14. Requirements, in addition to ISM requirements, are established for this contract.

(If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No15. Elements of this contract are outside the inspection responsibility of the cognizant security office.

(If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. questions shall be referred to the official named below.

b. TITLE c. (Include Area Code) e.

17. DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER f.

PUBLIC

TYPED NAME OF CERTIFYING OFFICIAL

SECURITY GUIDANCE.

ADDITIONAL SECURITY REQUIREMENTS.

INSPECTIONS.

All

TELEPHONE

SIGNATURE

REQUIRED

OTHERS AS NECESSARY

DD FORM 254 (BACK), DEC 1999

Continuation Pages Item #13 of DD254 Company Name:

TBD

Contract No: TBD

Continuation Pages Item #13 of DD254 Company Name:

TBD

Contract No: TBD

ITEM 10j. FOR OFFICIAL USE ONLY (FOUO)

-FOUO and /or other types of Controlled Unclassified Information (CUI) provided under this contract shall be safeguarded as required by government policy.

-Contractor shall ensure Personally Identifiable Information (PII) protected under the Privacy Act Program is safeguarded as required by government policy.

-FOUO markings applied to information shall not be removed or altered unless approved in writing by the originator of the information.

-Enforce “need to know”

-Do not release FOUO information to unauthorized persons to include the public.

-Destroy FOUO information by approved methods (e.g. burn bags) at the Pentagon, Mark Center, and RRMC facilities.

10k OTHER

-The contractor shall coordinate with Defense Security Service for processing personnel security clearances.

-Contractor must have an active facility clearance equal to the level of the contract.

-Personnel selected to work on the contract that require access to classified material, must possess an active final security clearance at the level of the contract.

-Each individual has received required initial/refresher security training.

-Each individual has completed a Standard Form 312 Classified Non-Disclosure Agreement.

-The security clearance has been posted in JPAS and a Visit Request must be sent to Government Agency Security Manager.

-Contractor shall comply with Government policy to safeguard classified information.

-Contractor shall not release any DoD information to any unauthorized person/entity.

TBD

Contract No: TBD

Continuation Pages Item #13 of DD254 Company Name:

TBD

Contract No: TBD

-Contractor shall successfully complete training related to derivative classification. Refer to Defense Security Service Training (if applicable).

ITEM 11L. IN PERFORMANCE OF THIS CONTRACT, THE CONTRACTOR WILL:

-Contractor shall comply with security classification guidance when generating classified information (if applicable).

-Contractor shall comply with government policy for access to and safeguarding of classified information.

-Contractor shall follow government policy for access to and safeguarding of all government information, facilities and equipment.

-Prime contractor shall have an active SECRET facility clearance and the Government will verify through the Industrial Security Facilities Database.

DOCUMENT CONTROL

-As a user of classified information, you are personally responsible for the protection and control of this information. You must safeguard this information at all times to prevent loss or compromise and unauthorized disclosure, dissemination, or duplication. Unauthorized disclosure of classified material is punishable under the Federal Criminal Statutes or organizational policies.

-Contractor is not authorized to remove classified information from the Government Facility; any documents that are classified will be reviewed at the Government Facility by cleared individuals only.

- If classified material is left unattended (for example, on a desk without anyone present), it is your responsibility to ensure that the material is properly protected. Stay with the classified material and notify the COR or security office.

-Classified information that is not safeguarded in an approved security container shall be constantly under the control of a person having the proper security clearance and need-to-know.

-Upon completion of review of documents, the contractor must return the documents to the COR or Government Representative.

-The fact specific wording may not be written in this DD254 does not constitute a waiver to comply with government policy.

TBD

Contract No: TBD

Continuation Pages Item #13 of DD254 Company Name:

TBD

Contract No: TBD

HAVE OPSEC REQUIREMENTS

OPSEC promotes mission effectiveness by preserving essential secrecy about US intentions, capabilities, and current activities. Refer to DoD 5220.22R (Industrial Security Regulation), DoD 5220.22-M Sup 1 (National Industrial Security Program Operating Manual), and 5205.02 (DoD Operations Security Program).

OPSEC is concerned with all sources of OPSEC is directed towards protection of UNCLASSIFIED intelligence on classified or sensitive programs of such nature that disclosure of the indicators may lead to the compromise whenever open sources (such as technical articles, press releases, national publications, congressional records, or contract awards) provide information that hostile intelligence services (HOIS) can piece together resulting in actions harmful to US interest. It covers the total problem by addressing vulnerabilities, countermeasures and weaknesses in a program which could lead to the disclosure of classified information. Unlike other security programs, OPSEC doesn’t really lend itself to complete identification of security requirements (countermeasures) during initial contract preparation.

Input from the contractor in the form of an OPSEC plan must be developed and provided by the Contractor. OPSEC countermeasures and plans must be flexible to address changes in the threat environment.

The contractor shall provide a written OPSEC plan to the COR for review and approval by the OPSEC Officer. The plan must contain detailed procedures and actions to be taken by the prime contractor and or sub-contractor for the protection of hard copy and electronic information as well as physical security of the contractor facilities, access control procedures, etc, that afford protection to the information.

The contractor shall comply with OPSEC requirements imposed by any program supported. The contractor must develop OPSEC guidance as required by the Statement of Work/Performance of Work. OPSEC is a structured process that identifies critical information, analyzes friendly actions, integrates threat analysis and risk assessments and then helps personnel apply protective measures to mitigate unacceptable risks.

Contractors and their personnel supporting WHS (including all subordinate activities), must have OPSEC awareness and education/training initially and annually as required by the Government.

TBD

Contract No: TBD

Continuation Pages Item #13 of DD254 Company Name:

TBD

Contract No: TBD

HAVE INSIDER THREAT PROGRAM

On May 18, 2016, the Department of Defense published Change 2 to DoD 5220.22-M, “National Industrial Security Operating Manual (NISPOM).” NISPOM Change 2 requires contractors: 1. to establish and maintain an insider threat program to detect, deter and mitigate insider threats. Specifically, the program must gather, integrate, and report relevant and credible information covered by any of the 13 personnel security adjudicative guidelines: 2. that is indicative of a potential or actual insider threat to deter cleared employees; 3 from becoming insider threats; detect insiders4 who pose a risk to classified information; and mitigate the risk of an insider threat. 5 Contractors must have a written program plan in place to begin implementing insider threat requirements of Change 2 no later than November 30, 2016.

Industrial Security Letter 2016-02 (ISL2016-02) provides clarification and guidance to assist contractors as they establish and tailor an insider threat program to meet NISPOM Change 2 requirements.

Insider Threat Minimum Standards for Contractors

NISPOM 1-202 requires the contractor to establish and maintain an insider threat program that will gather, integrate, and report relevant and available information indicative of a potential or actual insider threat. DSS will consider the size and complexity of the cleared facility in assessing its implementation of an insider threat program to comply with NISPOM Change 2.

COMMON ACCESS CARDS

-The government issued credential (CAC) is the property of the U.S. Government and shall not be retained by the cardholder upon expiration, replacement, or when the DoD affiliate of the employee has been terminated. Unauthorized possession of an official credential like a CAC can be grounds for prosecution under section 701, title 18, US Code.

-If a CAC is required for performance of this contract, each individual must have at a minimum, a completed favorable NACI.

-Individuals who require a security clearance in performance of this contract will be issued a CAC when appropriate based on favorable results of the background check and eligibility of a security clearance posted in JPAS.

TBD

Contract No: TBD

Continuation Pages Item #13 of DD254 Company Name:

TBD

Contract No: TBD

-Individuals who do not require a security clearance in performance of this contract will be processed for an HSPD-12 NACI through WHS if a prior investigation is not valid to meet the requirements of a CAC.

-Contractor shall follow instructions provided to complete this process in a timely manner to prevent delays.

-All CACs shall be returned to the Government COR or Security Manager when expired or no longer needed for performance of this contract.

ACCESS TO DOD INFORMATION SYSTEMS

-Contractor shall ensure DoD information is processed according to government policy. Some policy requirements are:

-DoD information shall be processed only on approved DoD information systems.

-Classified information shall be processed only on information systems approved for classified processing at the appropriate level.

-DOD information shall not be processed on non-DoD approved information systems (e.g.

personal computers/contractor computers.

-Contractor shall not modify DoD information systems or introduce hardware or software unless approved by the government customer.

-Contractors shall not use removable media (e.g. thumb drives, CDs) to store DoD information.

WIRELESS SECURITY POLICY

-Contractor shall not operate wireless access points (e.g. Hot Spots, routers) or any other Radio Frequency (RF) installations.

VIOLATIONS

-Contractor shall report all suspected or known security violations to safeguard DoD information, equipment, facilities, and personnel to the Government Contracting Officer and Security Manager.

TBD

Contract No: TBD

Continuation Pages Item #13 of DD254 Company Name:

TBD

Contract No: TBD

SITE ACCESS/PROPERTY

-Contractor shall return all property to the DoD (government customer) when no longer required for performance of this contract. All contractors will follow the Pentagon/Mark Center and/or RRMC entry control procedures as specified by the Government.

-RRMC is a controlled access area and requires personnel be United States citizens and have eligibility for access to classified information at the Secret level and for non-escorted access. Non-U.S. Citizens are not allowed access to the installation.

CONTINUED RESPONSIBILITY

-Upon completion of the contract, the contractor shall continue to safeguard classified information, controlled unclassified information, and any other information they have had access to or knowledge of.

-Contractor shall report attempts by unauthorized persons to gain access to information. Notify the government customer but do not send any classified information in this notification.

-Information pertaining to this contract and details about DoD facilities will not be discussed with unauthorized personnel, posted on a web page, or released to the public without written approval from the Contracting Officer.

1155 Defense Pentagon Washington DC 20301-1155

***See attachment for additional security guidance

Washington DC 20301-1155