Attach_3_DD_Form_254_25SEP18.pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

TOP SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYYYMMDD) 2018/09/10

b. SUBCONTRACT NUMBER b. REVISED (Supersedes all previous specs)

Revision No.

Date (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYYYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYYYMMDD)

HQ0147-18-R-0027

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the Contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code) See Block 13, Reference Item 8.a.

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Technical Engineering Analytical and Management Support (TEAMS) (F&O Commercial Services)

Visual Information Production Center (VIPC) Support

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify)

k. OTHER Specify) Additional Requirements for Contractor’s

Unclassified Automated Information Systems

DD Form 254, DEC 1999 Previous editions are obsolete

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct

Through (Specify):

Missile Defense Agency/DS

5222 Martin Road

Redstone Arsenal, AL 35898 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the Contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

The Contractor is required to flow-down all applicable requirements of the DD Form 254 to its Subcontractor(s).

Direct all questions pertaining to the DD Form 254 to the MDA Industrial Security office by phone at (256) 450-

0939, by email at MDAIndustrialSecurity@mda.mil, or by mail to MDA, ATTN: Industrial Security Office (EIR), Building 5222 Martin Road, Redstone Arsenal, AL 35898.

See Continuation Pages (3-7)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No

See Reference Items; 10.j and 11.l.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

Delores Lloyd

b. TITLE

Contracting Officers'

Security Representative

c. TELEPHONE (Include Area Code)

(256) 450-0939

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

Missile Defense Agency

a. CONTRACTOR

5222 Martin Road

b. SUBCONTRACTOR

Redstone Arsenal, AL 35898

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY MDA Industrial Security

DD Form 254 Reverse, DEC 1999

SECURITY GUIDANCE (BLOCK 13) CONTINUATION PAGES:

Special Instructions:

Reporting Requirements:

The Contractor shall provide the following to the MDA Industrial Security Office (contact information listed in block 13 of page two of the DD Form 254):

Provide a copy to the MDA Industrial Security Office of any security incident report (initial and final) involving the loss, compromise, or suspected compromise of classified information sent to the Defense Security Service. The Contractor shall provide a complete copy of the report (without redaction) to the MDA within the same reporting timeframe as is required by the Defense Security Service (72 hours for Secret/Confidential and 24 hours for Top Secret)

Provide a complete copy of the report (without redaction) to the MDA Industrial Security

Office of any report involving a cyber-intrusion of MDA program information sent to the

Federal Bureau of Investigation and the Defense Security Service per NISPOM Chapter 1, Section 301 and Industrial Security Letter 2013-05.

Provide a complete copy of the report (without redaction) to the MDA Industrial Security

Office of any Defense Security Service letter that indicates a less than satisfactory security rating and/or that negatively impacts the Facility Clearance Level (FCL) of the company within 48-hours of receipt.

Provide electronic copies of Subcontractor DD Form 254s issued by the Prime and the

Subcontractor. The Prime Contractor shall act as the focal point for collecting their

Subcontractor’s DD Form 254s and the Prime is responsible for forwarding these DD Form

254s to the MDA Industrial Security Office.

In accordance with NISPOM Chapter 1, Section 300, the Contractor and its subcontractors shall notify the Contracting Officer, the Contracting Officer’s Representative, and MDA Industrial

Security in writing within 24 hours of becoming aware of adverse information regarding an employee, who works within a Government/MDA facility, which could affect their access to classified information.

Subcontractor Classified Access Approvals:

The Prime Contractor and Subcontractor are authorized to flow access to and/or dissemination of classified information to the TOP SECRET level to their Subcontractor. Dissemination is only authorized and applicable for information safeguarded at the Contractor’s facility. This authorization includes access to Critical Nuclear Weapon Design Information (CNWDI)

(NISPOM Chapter 9, Section 204), Non-Sensitive Compartmented Information (SCI) (NISPOM

Chapter 9, Section 300) and North Atlantic Treaty Organization (NATO) (NISPOM Chapter 10, Section 708) information. The Contractor shall provide the appropriate accesses to its

Subcontractors as required per NISPOM 5-502. The Prime Contractor and Subcontractor must verify Facility Clearance, Safeguarding Capability and Access Authorizations prior to the dissemination of classified information.

Reference Item 8.a. (continued) Government Locations

Classified performance will occur at various MDA and/or government locations as directed by the contract via the Performance Work Statement, Statement of Work, or Statement of

Objectives or other agreement. The Contractor shall abide by the host government security requirements per NISPOM Chapter 1, Section 200 and Chapter 6, Section 105c. The cognizant security office at the performance location is MDA or the host installation.

Reference Item 10.b & d: Contractors shall adhere to the requirements of DoDI 5210.02, “Access to and Dissemination of Restricted Data (RD) and Formerly Restricted Data (FRD),” 3

June 2011, for access and training requirements. Flow this requirement to subcontractors when applicable.

1. Contractors shall possess a valid DoD security clearance at a level commensurate with the information concerned and shall have a need-to-know for access. DoD contractors require a final Secret security clearance for access to Secret RD information. Contractors shall have a final Top Secret security clearance for access to Top Secret RD information. NISPOM section 2-211a. applies.

2. The Prime contractor and its subcontractors shall be required to complete training for access to RD/FRD material and for derivative classification of RD/FRD information. This training is provided by the Department of Energy (DOE) as a slide presentation located online at the following website: “http://energy.gov/hss/services/classification/classification-training-institute” under the Training For Other Agency Personnel tab.

a. For individuals with access to RD/FRD information, personnel shall complete the

“Classification of Nuclear Weapons-Related Information (Restricted Data and Formerly

Restricted Data)” course. The contractor company shall maintain a record of the training for each individual with access to RD/FRD. These records shall be made readily available during security inspections or for other government purposes. Records shall be maintained for two years after an individual no longer requires access to RD/FRD information.

b. For individuals who will conduct derivative classification, personnel shall complete the

“Restricted Data Classifiers Course.” The contractor company shall maintain a record of the training for each individual designated as a RD Classifier. These records shall be made readily available during security inspections or for other government purposes. Records shall be maintained for two years after an individual is no longer designated as a RD Classifier.

Reference Item 10.c: NISPOM Chapter 9, Section 2 requirements apply. Access to Critical

Nuclear Weapons Design Information requires a final clearance.

Reference Item 10.e.(2): NISPOM Chapter 9, Section 3 requirements apply. Non-Sensitive

Compartmented Information (SCI) is intelligence information existing at the collateral level and is typically, but not always, identified by the NOFORN caveat. The ODNI defers to the 32 CFR

2001 and as stated in the ICS 703-01 for classified national intelligence information and only requires government (i.e. MDA) determination for prime contractor to subcontractor flow-down.

Reference Item 10.g: NISPOM Chapter 10, Section 7 requirements apply.

Reference Item 10.h: NISPOM Chapter 10, Section 3 requirements apply.

Reference Item 10.j:

1. The Contractor shall adhere to the requirements in the DoD Manual 5200.01, DoD

Information Security Program, Volume 4, Controlled Unclassified Information (CUI) for safeguarding, marking, transmission, dissemination, and disposition of all CUI/For Official Use

Only (FOUO) information.

2. Access.

a. Access to CUI/FOUO should be limited to U.S. Nationals that have either a current U.S.

security clearance (minimum interim SECRET clearance) or have been the subject of a favorably completed National Agency Check with Inquiries (i.e. Standard Form (SF) 85 Position of Trust investigation) or equivalent investigation (i.e. contractor equivalent).

(1) Definitions:

(a) A U.S. Person is defined as any form of business enterprise or entity organized, chartered or incorporated under the laws of the United States or its possessions and trust territories, and any person who is a citizen or national of the United States

(b) A U.S. National is defined as a citizen of the U.S., or a person who, though not a citizen of the U.S., owes permanent allegiance to the U.S. Also see 8 USC 1101(a) (22) or 8 USC 1401 paragraphs (a) through (g) for further clarification on those who may qualify as nationals of the

United States.

(2) Contractor Equivalent: Contractor equivalent includes various background checks such as those performed by employers during hiring process. Minimum checks shall include

Citizenship, Personal Identification (Social Security Number), Criminal, and Credit. The contractor shall submit a list of their procedures on company letterhead through the Contracting

Officer or their representative for concurrence by the designated MDA approving office.

b. Contractor personnel with dual or foreign citizenship (including but not limited to those with permanent resident status) will be subject to an additional review; and found favorable by MDA prior to access to CUI/FOUO. (Note: Contractor personnel with dual citizenship that have an active U.S. security clearance (interim Secret or higher) may have access to CUI/FOUO material without additional review.

3. See Reference Item 11.l. for safeguarding of CUI/FOUO on a contractor’s unclassified information system(s).

4. The contractor shall flow-down this requirement to all subcontractors requiring access to

CUI/FOUO information regardless if the subcontractor has a facility security clearance or not.

For those uncleared subcontractors, the prime contractor shall ensure this section exists within the language of the subcontract/purchase order

Reference Item 11.a: Classified contract performance is restricted to MDA/government facilities and/or other Contractor company facilities. The host Contractor/government activity will provide required security classification guidance for the performance of this contract, consistent with work performed at that location. The Prime Contractor, as listed in Item 6.a, shall be required to follow all security policies and procedures and use Security Classification

Guides of the host activity. This requirement shall be imposed on all subcontracts.

Reference Item 11.f:

1. The Contractor shall require access to classified information overseas at areas designated in the Statement of Work, Performance Work Statement, or Statement of Objectives.

2. Contractor personnel traveling on DoD-sponsored (official) travel overseas shall complete all training and messaging requirements outlined within the DoD Foreign Clearance Guide (FCG) for the foreign country being visited and support administrative reporting requirements specified by their program Country Clearance Message (CCM) Coordinator within 45-days prior to travel.

Contractor personnel should review U.S. Department of State (DoS) Travel Warnings, Travel

Alerts, and individual country specific information located at U.S. Department of State (DoS)

Travel Warnings web address and are encouraged to enroll in the U.S. DoS Smart Traveler

Enrollment Program (STEP) prior to commencing official travel overseas.

3. The Contractor shall submit foreign visit requests as dictated by the NISPOM, Chapter 10, Section 5. A Contractor shall submit the visit request through the Defense Security Service-designated security official.

4. The Contractor is not authorized per the NISPOM to establish a contractor facility outside of the U.S., its possessions, or its territories. Storage, custody, and control of classified information required by a U.S. Contractor employee abroad is the responsibility of the U.S. Government.

Storage of classified information shall be at a U.S. military facility, a U.S. Embassy or

Consulate, or another location occupied by a U.S. Government organization.

Reference Item 11.g: The Contractor is authorized to use the services of the Defense Technical

Information Center (DTIC) or other secondary distribution center. As required, the Contractor will prepare and submit the DD Form 1540, “Registration for Scientific and Technical

Information Services” and DD Form 2345, “Militarily Critical Technical Data Agreement” to the contracting office for approval. Subcontractors are required to submit requests through the

Prime Contractor.

Reference Item 11.l:

Contractor’s Unclassified Automated Information System:

1. The Contractor shall safeguard and protect Controlled Unclassified Information/For Official

Use Only (CUI/FOUO) information provided by or generated for the Government that transits, resides, or is processed on any non-Government information technology system IAW the procedures in DoDI 8582.01, “Security of Unclassified DoD Information on Non-DoD

Information Systems,” June 6, 2012, Enclosure 3. Additionally, if the contract includes the

DFARS Clause 252.204-7012, Safeguarding of Covered Defense Information and Cyber

Incident Reporting, then the contractor must comply with its requirements. If the DFARS Clause

252.204-7012 does not exist on contract, the contractor shall comply with the requirements of the

Office of Management and Budget Circular A-130 and the DoD Directive 8100.2 until such time as the DFARS Clause 252.204-7012 may be added.

2. The contractor shall ensure that all persons accessing CUI/FOUO meet the qualifications as stated in Reference Item 10.j. of this DD Form 254.

3. MDA reserves the right to conduct compliance inspections of Contractor unclassified information systems and other repositories to verify the protection of CUI/FOUO information.

4. The contractor shall flow this reference item to all subcontractors that process and access

CUI/FOUO information regardless if the subcontractor has a facility security clearance or not.

For those uncleared subcontractors, the prime contractor shall ensure this section exists within the language of the subcontract/purchase order.

Reference Item 12: The Prime Contractor shall forward all requests for public release authorization through the Contracting Officer’s Representative to the listed MDA program office. Per NISPOM section 5-511, the Contractor shall include all necessary information to assist with the decision of the MDA program office. Per NISPOM Chapter 7, Section 102c., the

Prime Contractor shall act as the focal point for all Subcontractor requests for public release. A lack of response from the MDA program office does not constitute as public release authorization. The Prime Contractor shall not release information to the public prior to receiving written authorization from the MDA program office (this requirement includes any information system that provides public access).