HQ0858-20-R-0002 Atch J-08 QMA DD-254 23 Apr 20.pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

TOP SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER

a. ORIGINAL (Complete date in all cases) Date (YYYYMMDD) 2020/04/21

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs)

Revision No. Date (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases) Date (YYYYMMDD)

HQ0858-20-R-0002

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the Contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Quality Mission Assurance Support (Small Business Set Aside) for Quality, Safety, and Mission Assurance

Functional Capability Group

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify)

k. OTHER Specify)

Additional Requirements for Contractor’s

Unclassified Automated Information Systems

DD Form 254, DEC 1999 Previous editions are obsolete

Approved for Public Release 20-MDA-10459 (15 Apr 20)

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial

Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct

Through (Specify):

Missile Defense Agency/CT

Bldg 5222 Martin Rd

Redstone Arsenal, AL 35898 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the Contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

The Contractor is required to flow-down all applicable requirements of the DD Form 254 to its Subcontractor(s).

Direct all questions pertaining to the DD Form 254 to the MDA Industrial Security office by phone at 256-450-

0939, by email at MDAIndustrialSecurity@mda.mil, or by mail to MDA, ATTN: Industrial Security Office (EIR), Building 5222 Martin Road, Redstone Arsenal, AL 35898.

See Continuation Pages (3-8)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes

No

See Reference Items; 10.e.(1), 10.j, 11.l. and 14

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

b. TITLE

Assistant Director, Research, Development

& Acquisition Security

c. TELEPHONE (Include Area Code)

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

Missile Defense Agency

a. CONTRACTOR

Bldg. 5222 Martin Road

b. SUBCONTRACTOR

Redstone Arsenal, AL 35898

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

Digitally signed by

BETHEA.NASU.R.1251

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY MDA Industrial Security

DD Form 254 Reverse, DEC 1999

Approved for Public Release mailto:MDAIndustrialSecurity@mda.mil

SECURITY GUIDANCE (BLOCK 13) CONTINUATION PAGES:

Special Requirements:

The Contractor shall provide the following to the MDA Industrial Security Office (contact information listed in block 13 of page two of the DD Form 254):

Provide a copy to the MDA Industrial Security Office of any security incident report (initial and final) involving the loss, compromise, or suspected compromise of classified information sent to the Defense Counterintelligence and Security Agency. The Contractor shall provide a complete copy of the report (without redaction) to the MDA within the same reporting timeframe as is required by the Defense Counterintelligence and Security Agency (72 hours for Secret/Confidential and 24 hours for Top Secret)

Provide a complete copy of the report (without redaction) to the MDA Industrial Security

Office of any report involving a cyber-intrusion of MDA program information sent to the

Federal Bureau of Investigation and the Defense Counterintelligence and Security Agency per NISPOM Chapter 1, Section 301 and Industrial Security Letter 2013-05.

Provide a complete copy of the report (without redaction) to the MDA Industrial Security

Office of any Defense Counterintelligence and Security Agency letter that indicates a less than satisfactory security rating and/or that negatively impacts the Facility Clearance Level

(FCL) of the company within 48-hours of receipt.

Provide electronic copies of Subcontractor DD Form 254s issued by the Prime and the

Subcontractor. The Prime Contractor shall act as the focal point for collecting their

Subcontractor’s DD Form 254s and the Prime is responsible for forwarding these DD Form

254s to the MDA Industrial Security Office.

Contractors sending classified mail shall actively (daily) track each classified package(s) throughout the entire transit process until the shipment is confirmed as received by the intended organization. The sender should monitor the transit process via the mail carrier's tracking process. If the last transit status entry on the mail carrier's tracking website was made more than one business day after the estimated delivery date, the sender will notify and provide the relevant details to their Facility Security Officer and the Missile Defense Agency in accordance with DD254 requirements.

Information transported externally to a cleared facility shall be encrypted. The encryption of all MDA Controlled UNCLASSIFIED and CLASSIFIED removable media while in transit via authorized means of transmission including Couriers, Hand Carriers, and Escorts; the

United States Postal Service (USPS); or other mail services (e.g., Federal Express, United

Parcel Service, etc.). Contract direction shall incorporate the following tenants: All removable media (Hard Disk Drive (HDD), optical disk, Flash Media (USB HDD),Solid-state Drives (SDD), etc.) shall utilize data-at-rest (DAR) encryption:

- Classified data shall be encrypted using a FIPS 140-2 validated technology.

- Unclassified data to include Personal Identifiable Information (PII)/ For Official

Use Only(FOUO)/ Covered Defense Information (CDl)/Controlled Unclassified

Information (CUI)/ Unclassified Controlled Technical Information (UCTI) shall use at least a FIPS 140-2 compliant technology, validated is recommended.

- Operating system, software, and hardware updates do not require encryption.

Any waiver requests for this requirement must be made by the contractor to the responsible

Contracting Officer for approval consideration.

In accordance with NISPOM Chapter 1, Section 300, the Contractor and its subcontractors shall notify the Contracting Officer, the Contracting Officer’s Representative, and MDA Industrial

Security in writing within 24 hours of becoming aware of adverse information regarding an employee, who works within a Government/MDA facility, which could affect their access to classified information.

Subcontractor Classified Access Approvals:

The Prime Contractor and Subcontractor are authorized to flow access to and/or dissemination of classified information to the TOP SECRET level to their Subcontractor. Dissemination is only authorized and applicable for information safeguarded at the Contractor’s facility. This authorization includes access to Communications Security (COMSEC) (NISPOM Chapter 9, Section 407), and Non-Sensitive Compartmented Information (SCI) (NISPOM Chapter 9, Section 300). The Contractor shall provide the appropriate accesses to its Subcontractors as required per NISPOM 5-502. The Prime Contractor and Subcontractor must verify Facility

Clearance, Safeguarding Capability and Access Authorizations prior to the dissemination of classified information. The following require specific authority: SCI - not authorized to flow without prior approval from MDA/Special Security.

This section concerns the release of classified information to the contractor regarding the government’s Request for Information: MDA classified information may only be released to the Contractor for submission preparation purposes following verification of the Contractor’s facility clearance and safeguarding. The DD Form 254 shall act as security guidance for the safeguarding of functional task and activity related classified information at the Contractor facility. The Defense Security Service maintains security cognizance of classified information stored at a Contractor facility. However, the following stipulations apply:

IAW NISPOM paragraphs 5-200 and 5-600, Contractors shall ensure full written accounting and control over all MDA classified information provided to the Contractor by MDA or created as copies by the Contractor.

IAW NISPOM paragraphs 5-501 and 5-502, distribution of MDA classified information shall only be made to those cleared Contractor personnel working on the Contractor’s response to the request for information, unless otherwise authorized by the Program Manager

(PM).

IAW NISPOM paragraph 5-509, for purposes of this submission request, further distribution of MDA classified information shall only be authorized by the MDA PM overseeing this request for information.

IAW NISPOM paragraphs 5-702, 5-703, and 5-704, all classified information provided for use in submission preparation shall be returned to MDA or destroyed.

A contractors response to the Request for Information shall include appropriate classification markings IAW the NISPOM and appropriate Controlled Unclassified

Information/For Official Use Only (CUI/FOUO) markings IAW the DoD Instruction

5200.48, Controlled Unclassified Information (CUI).

Reference Item 8.a. (continued) Government Locations:

Classified performance will occur at various MDA and/or government locations as directed by the contract via the Performance Work Statement, Statement of Work, or Statement of

Objectives or other agreement. The Contractor shall abide by the host government security requirements per NISPOM Chapter 1, Section 200 and Chapter 6, Section 105c. The cognizant security office at the performance location is MDA or the host installation.

Reference Item 10.a: The Contractor shall comply with the requirements of NISPOM Chapter

9, Section 4 and National Security Agency/Central Security Service Policy Manual Number 3-

16, Control of Communications Security (COMSEC) Material, for access to and safeguarding of

COMSEC information.

Reference Item 10.e.(1): This contract requires access to Sensitive Compartmented Information

(SCI) material. The Contractor is not required to have an accredited SCI Facility but requires access to SCI at other locations. Additionally, the Facility Security Officer will ensure that when a Contractor with access to SCI is due for a Periodic Reinvestigation, the Periodic

Reinvestigation request is conducted to meet SCI standards. Written U.S. Government approval by MDA/Special Security is required prior to giving SCI access to a Subcontractor. Additional requirements are included in the attached SCI Supplement.

Reference Item 10.e.(2): NISPOM Chapter 9, Section 3 requirements apply. Non-Sensitive

Compartmented Information (SCI) is intelligence information existing at the collateral level and is typically, but not always, identified by the NOFORN caveat. The ODNI defers to the 32 CFR

2001 and as stated in the ICS 703-01 for classified national intelligence information and only requires government (i.e. MDA) determination for prime contractor to subcontractor flow-down.

Reference Item 10.j:

1. The Contractor shall adhere to the requirements in the DoD Instruction 5200.48, Controlled

Unclassified Information (CUI) for safeguarding, marking, transmission, dissemination, and disposition of all CUI/For Official Use Only (FOUO) information.

2. Access.

a. Access to CUI/FOUO should be limited to U.S. Nationals that have either a current U.S.

security clearance (minimum interim SECRET clearance) or have been the subject of a favorably completed National Agency Check with Inquiries (i.e. Standard Form (SF) 85 Position of Trust investigation) or equivalent investigation (i.e. contractor equivalent).

(1) Definitions:

(a) A U.S. Person is defined as any form of business enterprise or entity organized, chartered or incorporated under the laws of the United States or its possessions and trust territories, and any person who is a citizen or national of the United States

(b) A U.S. National is defined as a citizen of the U.S., or a person who, though not a citizen of the U.S., owes permanent allegiance to the U.S. Also see 8 USC 1101(a) (22) or 8 USC 1401 paragraphs (a) through (g) for further clarification on those who may qualify as nationals of the

United States.

(2) Contractor Equivalent: Contractor equivalent includes various background checks such as those performed by employers during hiring process. At a minimum, the Contractor Equivalent

Background Plan (CEBP) will include citizenship, Personal Identification (Social Security

Number), and criminal background checks. The contractor shall submit a list of their procedures on company letterhead through the Contracting Officer or their representative for concurrence by the designated MDA approving office.

b. Contractor personnel with dual or foreign citizenship (including but not limited to those with permanent resident status) will be subject to an additional review; and found favorable by MDA prior to access to CUI/FOUO. (Note: Contractor personnel with dual citizenship that have an active U.S. security clearance (interim Secret or higher) may have access to CUI/FOUO material without additional review.

3. See Reference Item 11.l. for safeguarding of CUI/FOUO on a contractor’s unclassified information system(s).

4. The contractor shall flow-down this requirement to all subcontractors requiring access to

CUI/FOUO information regardless if the subcontractor has a facility security clearance or not.

For those un-cleared subcontractors, the prime contractor shall ensure this section exists within the language of the subcontract/purchase order.

Reference Item 11.a: Classified contract performance is restricted to MDA/government facilities and/or other Contractor company facilities. The host Contractor/government activity will provide required security classification guidance for the performance of this contract, consistent with work performed at that location. The Prime Contractor, as listed in Item 6.a, shall be required to follow all security policies and procedures and use Security Classification

Guides of the host activity. This requirement shall be imposed on all subcontracts.

Reference Item 11.f:

1. The Contractor shall require access to classified information overseas at areas designated in the Statement of Work, Performance Work Statement, or Statement of Objectives.

2. All Contractor personnel working at the designated location(s) and accessing classified information shall obtain an Area of Responsibility-specific travel briefing and Antiterrorism

Level I Awareness training prior to departing on travel. Required training shall be received within 90 days prior to travel.

3. The Contractor shall submit foreign visit requests as dictated by the NISPOM, Chapter 10, Section 5. A Contractor shall submit the visit request through the Defense Security Service-designated security official.

4. The Contractor is not authorized per the NISPOM to establish a contractor facility outside of the U.S., its possessions, or its territories. Storage, custody, and control of classified information required by a U.S. Contractor employee abroad is the responsibility of the U.S. Government.

Storage of classified information shall be at a U.S. military facility, a U.S. Embassy or

Consulate, or another location occupied by a U.S. Government organization.

Reference Item 11.g: The Contractor is authorized to use the services of the Defense Technical

Information Center (DTIC) or other secondary distribution center. As required, the Contractor will prepare and submit the DD Form 1540, “Registration for Scientific and Technical

Information Services” and DD Form 2345, “Militarily Critical Technical Data Agreement” to the contracting office for approval. Subcontractors are required to submit requests through the

Prime Contractor.

Reference Item 11.l:

Contractor’s Unclassified Automated Information System (AIS):

1. The Contractor shall safeguard and protect Controlled Unclassified Information provided by or generated for the Government (other than public information) that transits or resides on any non-Government information technology system IAW the procedures in DoDI 8582.01, “Security of Unclassified DoD Information on Non-DoD Information Systems,” June 6, 2012, Enclosure 3. Information shall be protected from unauthorized access, disclosure, incident or compromise by extending the safeguarding requirements and procedures in DFARS clause

252.204-7012, Safeguarding of Covered Defense Information and Cyber Incident Reporting.

The NIST 800-171 security controls specified in 252.204-7012 was extended to include

Controlled Unclassified Information (CUI) information which resides on, or transits through the contractor’s (prime and all sub-contractors) unclassified information technology systems.

2. The contractor shall ensure that all persons accessing CUI, which includes FOUO, meet the qualifications for an Automated Data Processing/Information Technology (ADP/IT)-III Position requirement).

3. The “For Official Use Only/Controlled Unclassified Information Supplement” provides additional guidance for the handling, marking, transmission, reproduction, safeguarding, and disposition of FOUO/CUI.

4. MDA reserves the right to conduct compliance inspections of Contractor unclassified information systems and other repositories for the protection of FOUO/CUI.

Reference Item 12: The Prime Contractor shall forward all requests for public release authorization through the Contracting Officer’s Representative to the listed MDA program office. Per NISPOM section 5-511, the Contractor shall include all necessary information to assist with the decision of the MDA program office. Per NISPOM Chapter 7, Section 102c., the

Prime Contractor shall act as the focal point for all Subcontractor requests for public release. A lack of response from the MDA program office does not constitute as public release authorization. The Prime Contractor shall not release information to the public prior to receiving written authorization from the MDA program office (this requirement includes any information system that provides public access).

Reference Item 14: Program Protection is required for this contract. The interdisciplinary requirements associated with Program Protection are addressed in the Government issued

Program Protection Plan (PPP). The contractor shall develop a Program Protection

Implementation Plan (PPIP) in accordance to the requirements in the PPP. The contractor shall implement the PPIP with applicable security countermeasures to protect Critical Program

Information (CPI) and Critical Components (CC) as outlined in the Statement of

Work/Performance Work Statement/Statement of Objectives, and refined in the PPP. The PPIP shall apply to the Prime contractor and flow-down to all Subcontractor locations where CPI and/or CC are developed, produced, analyzed, maintained, transported, stored, and/or used in training.