Sec J Atch 1 - DD-254 HQ0147-11-R-0006 04.25.12.pdf

DEPARTMENT OF DEFENSE

1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

a. FACILITY CLEARANCE REQUIRED

SECRET

(The requirements of the National Industrial Security Program Operating Manual (NISPOM) apply to all security aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

SECRET

2. THIS SPECIFICATION IS FOR (x and complete as applicable) 3. THIS SPECIFICATION IS: (x and complete as applicable)

a. PRIME CONTRACT NUMBER

X

a. ORIGINAL (Complete date in all cases) Date (YYYYMMDD)

2011/11/01

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs) Revision No.

Date (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER

HQ0147-11-R-0006

Due Date (YYMMDD)

c. FINAL (Complete Item 5 in all cases) Date (YYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? YES X NO. If Yes, complete the following:

Classified material received or generated under ______________________ (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? YES X NO. If Yes, complete the following:

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. LOCATION

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE

8. ACTUAL PERFORMANCE

a. LOCATION

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Perform activities necessary for accomplishment of MDA Integrated Master Test Plan (IMTP) and other Testing on Upgraded Early Warning Radars (UEWR) and COBRA DANE (CD) radars

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. Communications Security (COMSEC) Information X a. Have Access To Classified Information Only At Another Contractor's Facility Or A Government Activity

X

b. Restricted Data (RD) X b. Receive Classified Documents Only X

c. Critical Nuclear Weapon Design Information (CNWDI) X c. Receive And Generate Classified Material X

d. Formerly Restricted Data (FRD) X d. Fabricate, Modify, Or Store Classified Hardware X

e. Intelligence Information: e. Perform, Services Only X

(1) Sensitive Compartmented Information (SCI) X f. Have Access To United States (US) Classified Information Outside The US, Puerto

Rico, US Possessions And Trust Territories X

(2) Non-SCI X g. Be Authorized To Use The Services Of Defense Technical Information Center (DTIC) Or Other Secondary Distribution Center

X

f. Special Access Information X h. Require a COMSEC Account X

g. North Atlantic Treaty Organization (NATO) INFORMATION X i. Have TEMPEST Requirements X

h. Foreign Government Information X j. Have Operations Security (OPSEC) Requirements X

i. Limited Dissemination Information X k. Be Authorized To Use The Defense Courier Service (DCS) X

j. For Official Use Only (FOUO) Information (Includes Term Controlled Unclassified Information (CUI))

X l. Other (Specify Restrict access to Contractor’s Unclassified Automated Information System

k. Other (Specify)

DD Form 254, December 1999 (Previous editions are obsolete)

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the NISPOM or unless it has been approved for public release by appropriate US Government authority. Proposed public release shall be submitted for approval prior to release

Direct X Through (Specify):

Missile Defense Agency/Public Affairs 5700 18th Street Fort Belvoir, Virginia 22060-5573 to the Directorate for Freedom of information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

This DD 254 is for solicitation only; MDA classified information may only be released to the contractor for the Request for Proposal (RFP) purposes following verification of the contractor’s facility clearance and safeguarding. This DD 254 shall act as security guidance for the safeguarding of RFP-related classified information at the contractor facility. The Defense Security Service maintains security cognizance of classified information stored at a contractor facility. However, the following stipulations apply:

• IAW National Industrial Security Program Operating Manual (NISPOM) paragraphs 5-200 and 5-600, contractors shall ensure full written accounting and control over all MDA classified information provided to the contractor by MDA or created as copies by the contractor.

• IAW NISPOM paragraphs 5-501 and 5-502, distribution of MDA classified information shall only be made to those cleared contractor personnel working on the solicitation, unless otherwise authorized by the Procurement Contracting Officer (PCO) and Contracting Officer’s Representative (COR).

• IAW NISPOM paragraph 5-509, for purposes of this RFP, further distribution of MDA classified information shall only be authorized by the MDA PCO/COR/FI overseeing this RFP.

• IAW NISPOM paragraphs 5-702, 5-703, and 5-704, all classified information provided for the RFP shall be returned to MDA or destroyed.

Forward a copy of any Defense Security Service letter that informs of any serious deficiency to MDA Industrial Security Office, Bldg 5222, Martin Road, Redstone Arsenal, AL 35898, within 48 hours of receipt. Any incident of possible compromise will be reported to MDA Industrial Security Office, Bldg 5222, Martin Road, Redstone Arsenal, AL 35898, within 24 hours.

See Continuation Page

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to NISPOM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements

X Yes No to the cognizant security office. Use item 13 if additional space is needed.)

See Items 10.j, 11.j, 11.l, and 14.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas of elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

Yes X No

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL/APPROVAL OFFICIAL b. TITLE c. TELEPHONE (Include Area Code)

James M Sullivan Director, Research, Development & Acquisition Security

571-231-8457

d. ADDRESS (Include Zip Code)

17. REQUIRED DISTRIBUTION

Missile Defense Agency

X a. CONTRACTOR

5700 18th Street b. SUBCONTRACTOR

Fort Belvoir, Virginia 22060-5573 X c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

X e. ADMINISTRATIVE CONTRACTING OFFICER

X f. OTHERS AS NECESSARY : MDA Industrial Security

DD Form 254 Reverse, December 1999 (Previous editions are obsolete)

SECURITY GUIDANCE (BLOCK 13) CONTINUATION:

Reference Item 8. (continued) Performance Locations may include one or more of the following MDA Facilities: (The Cognizant Security Office in all cases is MDA/Research, Development, and Acquisition Security)

-Missile Defense Agency, Bldg 5222 Martin Road, Redstone Arsenal, AL 35898 -Missile Defense Agency, Bldg 5224 Martin Road, Redstone Arsenal, AL 35898 -Missile Defense Agency, 5000 Bradford Drive, Huntsville, AL 35805

Reference Item 8.a to 8.c. Performance Location at a contractor facility:

a. COLSA ARC b. 4U825 c. Defense Security Service (IOFSH) 6724 Odyssey Drive 1525 Perimeter Pkwy, Suite 250 Huntsville, AL 35806 Huntsville, AL 35806

Reference Item 10.a and 11.h: Contractor shall comply with the requirements of DoD 5220.22-M and National Security Agency/Central Security Service (NSA/CSS) Policy Manual Number (No.) 3-16, Control of COMSEC Material, dated 5 August 2005.

Reference Items 10.d: NISPOM, Chapter 9, Sections 1 & 2, requirements apply. Flow this requirement to subcontractors when applicable.

Reference Item 10.e (2): NISPOM requirements apply.

Reference Item 10.g: NISPOM requirements apply.

Reference Item 10.h: NISPOM requirements apply.

Reference Item 10.j: See For Official Use Only/Controlled Unclassified Information Supplement below.

This requirement will be imposed on all subcontracts.

Reference Item 11.c: Following Security Guidance applies:

1. Ballistic Missile Defense System (BMDS) Security Classification Guide (SCG), 19 October 2010 to include Admin Changes 11 July 2011 or current version.

2. Ground-Based Midcourse Defense (GMD) Security Classification Guide (SCG), 7 August 2006, with Change 1 dated 25 August 2008, to include admin change dated July 29, 2009 or current version.

3. Ground-Based Radar Missile Warning Systems Security Classification Guide, dated 1 September

2003 or current version.

4. Other Security Classification Guides will be provided as required.

Reference Item 11.f:

1. Contractor is not authorized to establish a contractor facility Outside the United States, Puerto Rico, US Possessions and Trust Territories as part of this contract.

2. Travel to such areas needing access to classified information requires that the contractor’s security clearance information be included as part of the Country Clearance.

Reference Item 11.g: Contractor is authorized to use the services of DTIC or other secondary distribution center. The contractor and/or subcontractor will prepare the DD Form 1540 and DD Form 2345, if required, and submit to the contracting office.

Reference Item 11.j:

1. This contract requires the application of OPSEC in Compliance with MDA O-5205.02-INS (MDA OPSEC Instruction) to either specific instruction of the Contracting Officer/Contract Technical Monitor, "H" Clause, or Department of Defense (DD) Form 1423, Contract Data Requirements List, DD Form 1664, Data Item Description.

2. The contractor supporting event-oriented activities will develop OPSEC Plans/Annexes when directed by the supported program, or comply with the program's OPSEC Plan/Annex.

3. Contractor personnel assigned will receive OPSEC Awareness Education and Duty-Related Training as deemed necessary by the Government or program supported. OPSEC Awareness Education and Training will be provided by or coordinated through government channels (for example, MDA, Interagency OPSEC Support Staff (IOSS), etc.) and OPSEC protective measures (countermeasures) will be applied as directed by government or program sponsors.

Reference Item 11.l:

1. Contractor’s Unclassified AIS:

a. The contractor shall submit, and obtain approval of the Program supported for its procedures for protecting FOUO/CUI from unauthorized access from both internal and external sources prior to placing FOUO/CUI on the contractor’s unclassified AIS. Use Office of Management and Budget (OMB) Circular A-130, Revised, Management of Federal Information Resources, November 30, 2000 and DoD Directive 8100.2, "Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG)," April 14, 2004 as guidance documents.

b. AIS access to Controlled Unclassified Information, which includes FOUO/CUI (access qualifies as an Automated Data Processing/Information Technology (ADP/IT)-III Position requirement), must be limited to U.S. Persons (precludes access by individuals claiming dual citizenship without MDA/Special Security permission) that have a minimum interim SECRET level clearance; or have been the subject of a favorably completed National Agency Check (NAC) or a more stringent personnel security investigation (access pending completion of NAC and final clearance determination is subject to approval by MDA/Special Security); or contractor equivalent.

(1) Contractor Equivalent: Contractor equivalent includes various background checks such as those performed by employers during hiring process. Minimum checks shall include Citizenship, Personal Identification (Social Security Number), Criminal, and Credit. This option is subject to MDA/Special Security approval.

(2) ADP/IT-III Requirement: ADP/IT-III positions are located at the contractor's facility.

Only electronic SF-85Ps can now be submitted. The contractor shall contact MDA/Special Security and provide the information requested. MDA/Special Security will electronically notify the individual when they may enter e-QIP through the OPM portal. The individual shall then enter information to complete the SF 85P, Questionnaire for positions of Public Trust, electronically. It will be necessary to mail 2 DD Forms 258 (Fingerprint Cards), through the Contracting Officer's Representative, to: MDA/Special Security, 5700 18th Street, Fort Belvoir, Virginia 22060-5573.

c. See the “For Official Use Only/Controlled Unclassified Information Supplement” below for additional guidance on handling that information.

d. MDA/Research, Development, and Acquisition Security reserves the right to conduct compliance inspections for the protection of For Official Use Only/Controlled Unclassified Information.

2. Publicly Accessible Internet Websites: Contractors and subcontractor must receive written official public release approval for MDA/BMDS information from MDA Public Affairs before that information is uploaded onto any respective computer system that provides public access via an Internet website.

Reference Item 12:

1. Proposed public disclosure of unclassified information relating to work under this contract shall be coordinated through the Organizational OPSEC Coordinator, to the MDA COR/CLIN COTR/Task Manager for submission to MDA Public Affairs for public release processing. ONLY information that has been favorably reviewed and authorized by MDA/Public Affairs may be disclosed. Information developed after initial approval for public release must be submitted for re-review and processing.

2. Contemplated visits by public media representatives in reference to this contract shall receive prior approval from the MDA COR/CLIN COTR and from MDA/Public Affairs.

3. Critical technology subject to the provisions of DoD Directives 5230.24, “Distribution Statements on Technical Documents,” and 5230.25, “Withholding of Unclassified Technical Data from Public Disclosure,” shall be reviewed in accordance with established directives.

4. A request from a foreign government, or representative thereof, including foreign contractors, for classified and/or unclassified information in reference to this contract shall be forwarded to MDA International Security for review and appropriate action.

Reference Item 14:

Critical Program information (CPI) and Critical Technologies (CT), shall be identified by MDA, and protected by the contractor to the standards articulated in DoD INST 5200.39, Incorporating Change 1, December 28, 2010 and implemented by a Program Protection Plan. If a Program Protection Implementation Plan is required, it shall be submitted by the contractor to MDA/Research, Development, and Acquisition Security for review and approval.

FOR OFFICIAL USE ONLY/CONTROLLED UNCLASSIFIED

INFORMATION SUPPLEMENT

1. Definitions.

a. Automated Information System (AIS). An assembly of computer hardware, software, and firmware configured to automate functions of calculating, computing, sequencing, storing, retrieving, displaying, communicating, or otherwise manipulating data, information, or textual material.

b. Controlled Unclassified Information (CUI). Unclassified information which requires access and distribution limitations prior to appropriate coordination and an official determination by cognizant authority approving clearance of the information for release to one or more foreign governments or international organizations, or for official public release. Per DoD 5200.1-R it includes the following types of information: "For Official Use Only" (FOUO) in accordance with DoD 5400.7-R; “Sensitive But Unclassified” (State Department information); “DEA Sensitive Information” (Drug Enforcement Agency information); “DoD Unclassified Controlled Nuclear Information”; “Sensitive Information” as defined in the Computer Security Act of 1987; and information contained in technical documents (i.e., Technical Data) as discussed in DoD 5230.24, 5230.25, International Traffic in Arms Regulation (ITAR), and the Export Administration Regulations (EAR).

c. Dual Citizenship. A dual citizen is a citizen of two nations. For the purposes of this document, an individual must have taken an action to obtain or retain dual citizenship. Citizenship gained as a result of birth to non-U.S. parents or by birth in a foreign country to U.S. parents thus entitling the individual to become a citizen of another nation does not meet the criteria of this document unless the individual has taken action to claim and to retain such citizenship.

d. For Official Use Only (FOUO). FOUO is information that may be withheld from public disclosure under one or more of the 9 exemptions of the Freedom of Information Act (FOIA) (See DOD 5400.7-R). FOUO is not a form of classification to protect U.S. national security interests.

e. National of the United States.Title 8, U.S.C. Section 1101(a)(22), defines a National of the U.S.

as:

(1) A citizen of the United States, or,

(2) A person who, though not a citizen of the U.S., owes permanent allegiance to the U.S.

NOTE: 8 U.S.C. Section 1401, paragraphs (a) through (g), lists categories of persons born in and outside the U.S. or its possessions that may qualify as Nationals and Citizens of the U.S. This subsection should be consulted when doubt exists as to whether or not a person can qualify as a National of the U.S.

f. Personal Information. Information about an individual that is intimate or private to the individual, as distinguished from information related to the individual's official functions or public life.

g. U.S. Person. Any form of business enterprise or entity organized, chartered, or incorporated under the laws of the United States or its possessions and trust territories and any person who is a citizen or national (see National of the United States) of the United States, or permanent resident of the United States under the Immigration and Nationality Act.

h. Privacy Act. The Privacy Act of 1974, as amended, 5 U.S.C. Section 552a.

2. General.

a. The FOIA requires U.S. Government offices to disclose to any requestor information resident in U.S. Government files unless the information falls under one of 9 exemption categories. FOUO/CUI and other information may fall in this category. Mark such information as “For Official Use Only.”

b. FOUO/CUI in the hands of contractors may not be released to the public by the contractor unless (a) the COR/CLIN COTR concurs and (b) written approval has been provided by MDA/Public Affairs. Note: MDA/Public Affairs coordinates public release requests with MDA Research, Development, and Acquisition Security.

c. Access:

(1) Access to FOUO/CUI must be limited to U.S. Persons (precludes access by individuals claiming dual citizenship without MDA/Special Security permission) or, in the case of technical data as defined by the ITAR, the access is covered by a Technical Assistance Agreement or other form of duly licensed export. This requirement does not apply to use of commercial off the shelf (COTS) equipment and services that do not have export limitations.

(2) Non-Sensitive Positions (ADP/IT-III positions). Non-sensitive positions associated with FOUO/CUI are found at contractor facilities processing such information on their (contractor's) unclassified computer systems. Personnel nominated to occupy ADP/IT-III designated positions (applies to any individual that may have access to FOUO/CUI on the contractor's computer system) must have at least a National Agency Check (NAC) or contractor equivalent (company hiring practices reviewed and approved by MDA/Special Security). When "contractor equivalent" option is NOT authorized and there is no record of a valid investigation, the contractor shall contact MDA/Special Security at (571) 231- 8459, and provide the requested information. MDA/Special Security will electronically notify the individual when they may enter e-QIP through the OPM portal. The individual will then enter information to complete the SF 85P, Questionnaire for Positions of Public Trust, electronically. It will be necessary to mail 2 DD Forms 258 (Fingerprint Cards), through the Contracting Officer's Representative, to: MDA/Special Security, 5700 18th Street, Fort Belvoir, Virginia 22060-5573.

3. Identification Markings.

Within the Department of Defense CUI shall be marked as FOR OFFICIAL USE ONLY or with a DISTRIBUTION STATEMENT, to include the appropriate WARNING for ITAR or the EAR.

a. An unclassified document that qualifies for FOUO marking, when marked, shall be marked "For Official Use Only" at the bottom of the page on the outside of the front cover (if any), on the first page, on each page containing FOUO information, on the back page and on the outside of the back cover (if any), centered at the bottom of the page. For convenience, all pages, even those that do not contain FOUO information, may be marked "For Official Use Only" in documents generated by an automated system.

b. Individual pages within a classified document that contain both FOUO and classified information shall be marked at the top and bottom with the highest security classification of information appearing on the page. Individual pages containing FOUO information but no classified information shall be marked "For Official Use Only" at the top and bottom of the page (unless all pages are being marked with the highest overall security classification level).

c. All declassified MDA information is “unclassified official government information” and requires official MDA Security and Policy Review prior to official public release.

d. E-mails and other electronic files shall be marked in the same fashion as described for documents above, to the maximum extent possible.

4. Handling.

a. During any temporary sojourn of U.S. Government Unclassified information outside of the contractor controlled work space (residence, telework facility, hotel), the material must be stored in a locked room, drawer, filing cabinet, briefcase, or other storage device, so that access to the material by unauthorized individuals (i.e., family members, hotel staff, etc.) is prevented whenever untended by the contract employee.

(1) Long term task driven deadlines (in excess of five days) or the need to be able to perform official work while in an extended travel status on contract-driven business, require extended access to MDA Unclassified information outside of “official” work spaces. When that happens, employees may request written approval from their supervisors to possess, work on, and store MDA Unclassified information in non-contractor facilities for a period of not more than thirty calendar days.

(2) Requests for extended possession, use, and storage of U.S. Government Unclassified information outside of “official” work spaces (periods in excess of 30 days) shall take the form of a Memorandum For Record (MFR) prepared by the employee which specifies the body of information to be removed by listing the: title or subject matter; Program, Project, or Task being supported; general volume and format of the information concerned; and projected date of return. Additionally, the MFR shall contain a signature block for the supervisor to sign and date when approval is granted.

(3) The availability of supervisory copies of MFRs as described in this section may be an inspection item during Security Program Reviews conducted by the MDA/Research, Development, and Acquisition Security staff.

(4) The affected employee shall keep the originally signed MFR in validation of authorization granted for the agreed term of use. The supervisor shall maintain a copy of the MFR with employee records for the same term.

(5) Requested extensions of supervisory authorization for employee possession, use, and storage of MDA Unclassified information outside of “official” work spaces may be granted in incremental blocks of 30 days each so long as the work-related requirement continues.

(6) All affected employees authorized to possess, use, and store U.S. Government Unclassified information outside of “official” work spaces must return all U.S. Government Unclassified information to contractor control upon “task” completion. When such a return has been completed, the supervisor shall annotate the date that all items were returned. The supervisor's copy shall be retained for a period of time, not to exceed one year.

b. The above excludes unclassified information of an administrative nature including necessary personnel recall rosters and official telephone lists which are needed by supervisors and employees to assure the physical security, safety, health, and general psychological well-being of the contractor work force.

5. Transmission/Dissemination/Reproduction.

a. Subject to compliance with official distribution statements, FOUO markings (e.g., Export Control, Proprietary Data) and/or Non-Disclosure Agreements which may apply to individual items in question; authorized contractors, consultants and grantees may transmit/disseminate FOUO/CUI information to each other, other DoD contractors and DoD officials who have a legitimate need to know in connection with any DoD authorized contract, solicitation, program or activity. The government Procuring Contracting Officer (PCO) will confirm with the Contracting Officer's Representative or Task Order Monitor "legitimate need to know" when required. The MDA/Chief Information Officer has determined that encryption of external data transmissions of FOUO/CUI are now practical. The MDA/Chief Information Officer has stated that Public Key Infrastructure (PKI) and Public Key (PK) enabling technologies are available and cost effective. The following general guidelines apply:

(1) In accordance with DoD 5200.1-R, Appendix III, external electronic data transmissions of CUI/FOUO shall be only over secure communications means approved for transmission of such information whenever practical. Encryption of e-mail to satisfy this requirement shall be in accordance with MDA Directive 8190.01, Electronic Collaboration with Commercial, Educational, and Industrial Partners, May 12, 2009, being accomplished by use of DoD approved Public Key Infrastructure Certification available from: http://iase.disa.mil/pki/eca/certificate.html or by the company’s participation in the “Federal Bridge. The MDA/Chief Information Officer, PKI Common Access Card (CAC) point of Contact is, Ms. Ingrid Weecks (719-721-7040).

(2) In accordance with DoD 5200.1-R, Appendix III, external electronic transmissions of FOUO/CUI via voice, facsimile, or video teleconference shall be only over secure communications means approved for transmission of information wherever practical. Transmitting FOUO/CUI via these means, without encryption requires prior written authorization by MDA/Chief Information Officer.

b. Failure of the contractor to encrypt FOUO/CUI introduces significant risks to the BMDS mission. It is essential for the contractor to understand the risks and mitigation options that are available.

The contractor must understand that failure to encrypt FOUO/CUI carries with it certain risks to the mission. These risks can be mitigated with the thoughtful application of processes, procedures, and technology.

(1) Risks Include:

• Undermining our OPSEC efforts at a time that we begin to focus on implementing missile defense plans in Europe.

• The aggregation of FOUO/CUI can communicate events and plans that may be classified (i.e., "classification by compilation").

• Not properly encrypting contributes to a lax security environment.

(2) Some of the available mitigation tools include:

• Approved DOD PKI/CAC hardware token certificates or DOD trusted software certificates for encrypting data in transport

• Industry best practice of Virtual Private Network (VPN) Internet Protocol Security (IPSEC) for intra-organization transport

• Industry best practice of Secure Sockets Layer Portal Web Services for document sharing and storage

• Approved DOD standard solutions for encrypting data at rest

• Approved DOD E-Collaboration services via MDA Portal or Defense Information

Systems Agency (DISA) Network Centric Enterprise Services (NCES)

• Any FIPS 140-2 validated encryption [e.g., IPSEC, Secure Socket Layer/Transport Layer

Security (SSL/TLS), Secure/Multipurpose Internet Mail Extensions (S/MIME)

• Procure and employ Secure Telephone Unit/Secure Telephone Equipment (STU/STE)

• Procure and employ secure facsimile (FAX) capability

• Utilize secure VTC capabilities

• Hand-carry FOUO/CUI

• Utilize mailing through U.S. Postal Service

• Utilize overnight express mail services.

c. The MDA CIO has taken the position that encryption technologies are readily available, easy to obtain, inexpensive, and practical to implement. Therefore, if the contractor believes there are performance locations identified that cannot encrypt FOUO/CUI, the contractor will provide within 120 days of contract signing, a list of those locations along with explanation as to why encryption is not practical. This list will be provided to the PCO and COR/CLIN COTR for transmission to MDA/Chief Information Officer and MDA/Research, Development, and Acquisition Security. The MDA/Chief Information Officer will determine the acceptability of contractor submissions and will notify the PCO of any decisions regarding encryption.

d. FOUO/CUI shall be processed and stored internally on Automated Information Systems (AIS) or networks 1) when distribution is to an authorized recipient and 2) if the receiving system is protected by either physical isolation or a password protection system. Holders shall not use general, broadcast, or universal e-mail addresses to distribute FOUO/CUI. Discretionary access control measures may be used to preclude access to FOUO/CUI files by users who are authorized system users, but who are not authorized access to FOUO/CUI. External transmission of FOUO/CUI shall be secured using NIST-validated encryption.

e. The World Wide Web shall be equated with "Public Access." Information must be reviewed by MDA/Public Affairs and officially approved for public release before it is placed on publicly-accessible Web pages or electronic bulletin boards. Contractor personnel who maintain and post information on websites or web logs (BLOGS), and who provide OPSEC reviews of such, should receive OPSEC Awareness information that specifically addresses DoD guidance associated with these activities.

f. Do not mark shipping containers as containing CUI or FOUO.

g. Reproduction of FOUO/CUI may be accomplished on unclassified copiers within designated government or contractor reproduction areas.

6. Storage. During working hours, FOUO/CUI shall be stored in a manner that limits access by persons who do not have an official need for the information. During non-working hours and when internal building security is provided, FOUO/CUI may be filed with other unclassified records in unlocked files or desks. When there is no internal building security, locked buildings or rooms provide adequate after-hours protection, or the material can be stored in locked receptacles such as cabinets, desks, or bookcases.

7. Disposition.

a. When no longer needed, FOUO/CUI shall be destroyed in a manner to reasonably assure destruction beyond recognition and reconstruction. The following destruction methods are authorized:

burning; pulping; pulverizing; shredding; or tearing by hand. If tearing/cutting by hand, the minimum standard is a maximum tear/cut width of one-half of an inch.

b. Removal of the FOUO/CUI status can only be accomplished by the government originator.

The MDA COR/CLIN COTR shall review and/or coordinate with proper authority the removal of FOUO/CUI status for information in support of contract activity.