Atch 9 - DD Form 254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

(Updated 20250815)

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

August 31, 2028 The public reporting burden for this collection of information, 0704-0567, is estimated to average 36 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD Form 254, "DoD Contract Security Classification Specification"

(See Instructions) - Select from drop-down list: 2

TO BE COMPLETED BY OFFEROR

17. CERTIFICATION AND SIGNATURES - Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked. - a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions):

TO BE COMPLETED BY OFFEROR - IF APPLICABLE

TO BE COMPLETED BY OFFEROR

8. ACTUAL PERFORMANCE - c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional):

TO BE COMPLETED BY OFFEROR - IF APPLICABLE

Point Mugu Sea Test Range --See also Item 6.a-- Enter general unclassified description of this procurement.: The Naval Base Ventura County, Point Mugu, California (CA) operates and maintains station facilities and provides logistics services. Naval Air Warfare Center, Weapons Division (NAWCWD) at Point Mugu, CA and the Point Mugu Sea Range (PMSR) have defined the mission and requirements for this contract. Naval Test Wing Pacific (NTWP) and Air Test and Evaluation Squadron 30 have been assigned to monitor and schedule activities in support of NAWCWD and PMSR. In support of this mission, commercial services are required to support air transportation of passengers, personal baggage, and/or cargo in and around Point Mugu as well as drone recovery operations, and range test support, to include radar surveillance and clearance (RS&C), on the PMSR.

PCO: Sonya Barker (TRANSCOM) 618-817-9485 sonya.m.barker4.civ@mail.mil COR: Brian Williamson (VX-30) 805-989-7587 brian.d.williamson6.civ@us.navy.mil

Controlled by: Department of the Navy Controlled by: NAWCWD INDUSEC CUI Category: OPSEC POC: Charity Soules (760) 793-8671

Prime contractor shall send subcontract DD Form 254s through the NAWCWD Industrial Security Office when a subcontractor requires access to imposed OPSEC requirements, and any proscribed information. In addition, a courtesy copy of those subcontract DD Form 254s that do not require access to the above shall also be forwarded to the NAWCWD Industrial Security Office for record purposes.

Technical papers, briefings, presentations to be presented at any classified symposium shall be submitted to NAWCWD Security for approval prior to presentation.

Determination of need-to-know in connection with a classified visit is the responsibility of the individual/host who will disclose the classified information.

Block 10.j: The Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of controlled unclassified information (CUI) and to control distribution of controlled unclassified information in accordance with NISPOM 32 CFR Part 117, 24 Feb 2021, and SECNAVISNT 5510.36B. All Contractor facilities shall provide an appropriate means of storage for controlled unclassified information and materials. All controlled unclassified information shall be appropriately identified and marked as CUI in accordance with DoD Instruction 5200.48, Controlled Unclassified Information. Controlled Unclassified Information including Covered Defense Information (meeting the definition of 48 CFR 252.204–7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information.

The Contractor shall not store or transmit CUI on personal IT systems or via personal e-mail. Unclassified e-mail containing any DoD CUI shall be encrypted. Prior to sending CUI to any non-Navy Marine Corps Intranet (NMCI) addressees, the sender must first positively verify all recipients are authorized to access CUI and have need-to-know. Non-NMCI recipients must have a DoD compliant private key infrastructure (PKI) certificate that enables electronic transmission via unclassified networks while protecting the CUI with a digital signature and encryption.

Block 11.e: Reproduction services only. Classification markings on the material to be furnished for reproduction will provide the classification guidance necessary for performance of this contract.

Block 11.j: Operations Security (OPSEC)

The Department of Defense (DoD), and Department of the Navy (DON), have mandated OPSEC requirements as identified in the OPSEC Annex, for the protection of critical information (CI) and controlled unclassified information (CUI). Using the OPSEC cycle the government Program Manager (PM), or the Technical Point of Contact (TPOC), will identify any additional threats, vulnerabilities or requirements. Further OPSEC considerations are as follows:

OPSEC Measures shall be applied to protect all (CI) associated with this contract. The NAWCWD OPSEC Annex will be provided to the contractor. Review the CI described in the OPSEC Annex, add specific OPSEC Measures as appropriate for the protection of program, project or activity needs. When the above measures are applied, there shall be no required OPSEC CDRLs associated with the contract. However, the contractor will be required to adhere to the OPSEC requirements specified in the OPSEC Annex.

Additionally, if the PM and or the TPOC have identified sufficient threats and vulnerabilities that elevate the risks associated with this effort, then an OPSEC CDRL will be required, directing the contractor to create a thorough and detailed OPSEC Plan, outlining their OPSEC Program, and directing adherence to the OPSEC Plan by all participants of this effort. OPSEC security language will be included in the Statement of Work (SOW)/Performance of Work Statement (PWS). If this contract involves a Program of Record, the contractor is responsible for the Program Protection Implementation Plan (PPIP), which is a fulfillment of the Program Protection Plan (PPP), developed by the government Program Manager.

Applying OPSEC Measures - is the responsibility of the government Program Manager, primary contractor, and all subcontractors.

Block 11.l: See Block 10.j. for guidance.

Block 11.m: For all work performed aboard NAWCWD, the contractor shall comply with the provisions of the Department of the Navy Information Security Program Manual (DoD M-5200.01 Volumes 1-3, and SECNAVISNT 5510.36B, current version, Department of the Navy Operations Security (SECNAVINST 3070.2, (current version, Department of Defense Personnel Security Program (DODI 5200.02, (current version, Department of Defense procedures for the DoD Personnel Security Program (PSP) (DOD M-5200.02, (current version), Naval Air Systems Command National Security Program (NAVAIRINST 5510.38, (current version), NAWCWD Command Security Program Regulation (NAWCWDINST 5500.01, (current version), NAWS Physical Security Plan (NAWSINST 5530.1D, (current version), NAWS Access Control Procedures (NAWSCLINST 5530.3C, (current version), NBVC Physical Security Plan (Annex M to at OPORD 3300-13, (current version), and Navy Physical Security and Law Enforcement Program (OPNAVINST 5530.14E CH-2, (current version). In addition, the contractor shall comply with NISPOM 32 CFR Part 117, 24 Feb 2021 (Current version). If contractor employees will be co-located in NAWCWD spaces during any time within the full spectrum of this contract, they shall comply with security requirements provided by the activity Security Coordinator/Officer (as appropriate). At all other sites, the contractor shall comply with the local command regulations.

Block 11.m: Contractor eligibility and trustworthiness requirements when performing work under NAWCWD contract and/or task order. The contractor shall comply with all cybersecurity requirements for accessing any U.S. Government IT Systems and/or Networks and will have the appropriate background investigation and security clearance in accordance with personnel security guidelines. In order to maintain access to Navy IT resources, the contractor shall complete DoD Cyber Awareness Training latest version thereof, monitor expiration of requisite background investigations, and initiate re-investigations as required. If requested, the contractor shall provide to the COR/ACOR or designated SAAR-N Government Sponsor documentation sufficient to prove that it is monitoring/tracking the SAAR-N requirements for its employees who are accessing Navy IT resources. Contractors requiring a CAC must meet the office of personnel management credentialing standards. A Tier 1(T1) investigation or a favorably adjudicated National Agency Check with Inquiries (NACI) is the minimum investigation required for final credentialing determination for CAC. An interim credentialing determination can be made based on the results of a completed National Agency Check or validation of the completion of a Federal Bureau of Investigation National Criminal History Check (Fingerprint Check) with favorable results, and submission of a Request for Investigation (NACI or greater). Contractors assigned to Critical Sensitive Information Technology (IT) Level I (Privileged Access) duties will require a favorably completed and adjudicated Tier 5 (T5) or a Tier 5 Reinvestigation (T5R). Contractors assigned to a Noncritical-Sensitive (NCS) IT Level II (Limited Privilege, Sensitive Information Access) duties will require a favorably completed and adjudicated Tier 3 (T3) or a Tier 3 Reinvestigation (T3R). Contractor personnel that do not require access to any classified material and/or information but do require access to controlled unclassified information (CUI) will require a favorably adjudicated T1 investigation. Contractor personnel requiring logical access to any government information system will require a favorably completed and adjudicated T3 or a T3R. If a contractor does not require access to CUI or logical access to government information system but requires access into a NAWCWD designated restricted area, the NAWCWD Operations Security Officer in conjunction with the NAWCWD Security Manager or designee shall review contractor tasking and tasking location to ensure unintentional access to CUI can be controlled and within an acceptable risk. If it is determined that unintentional access to CUI cannot be controlled within an acceptable level of risk, a favorably adjudicated T1 Investigation will be required. All Non-National Industrial Security Program (NON-NISP) investigations shall be processed through the NAWCWD personnel security office. The contractor shall adhere to the Department of the Navy’s Cybersecurity Program prescribed methodologies for the protection of information to support DON missions and will comply with local service/component Command Cybersecurity Directives, Regulations, and Standard Operating Procedures. If applicable, all contractor owned/operated classified information systems or networks will be certified/accredited/operated in accordance with the National Industrial Security Operating Manual (NISPOM), (current version).

Block 11.m: Contractors requiring access to federal installations shall obtain the appropriate base identification for all contractor personnel who make frequent visits to or perform work at government sites. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished identification badges while visiting or performing work on the installation(s) with the exception of contractors working with aircraft or dangerous equipment when the identification could present a safety hazard. In this case, these contractors shall have the proper identification in their possession at all times. The contractor shall be responsible for obtaining required identification for newly assigned personnel and for prompt return of credentials, Common Access Card (CAC), and any other secondary area access badges/identification for any employee who no longer requires access to the work site(s), upon separation, resignation, firing, completion or termination of the contract or expiration of base identification. The contractor shall ensure that all base identification passes to include Common Access Cards and any other secondary area access badges/identification issued to contractor employees are returned to the appropriate component issuing office.

Block 11.m: On-site contractor support service personnel shall comply with local Health Protection Condition levels (HPCON) measures - reference The Department of Defense Instruction (DoDI) 6200.03.

Block 11.m: Contractor employees shall comply with local base procedures for entry into Navy Controlled and Restricted Areas. If contractor employees require unescorted entry to Controlled or Restricted Areas, the contractor shall comply with the Federal Installations Command Physical Security Plan, Department of Defense Personnel Security Plan (DoDI 5200.02), & DoD Procedures for the DoD Personnel Security Program (PSP), DoDM 5200.02.

Block 11.m: The contractor shall notify the NAWCWD Command Security Manager upon notification of on-site contractor support service personnel who have an investigation with an action pending, eligibility has been administratively withdrawn or pending, withdrawal of interim clearance eligibility, eligibility of no determination made, final denial or revocation of security clearance. Contractor personnel who are determined to be ineligible for classified military information (CMI) access, or whose access is suspended, shall be removed immediately from sensitive duties and shall not be permitted to have access to CMI or any controlled unclassified information (CUI). Contractor personnel who lose their eligibility for CMI or CUI access shall have their IT User accounts disabled immediately for IT systems that process CUI or CMI and will not have access to any NAWCWD restricted areas, facilities, or IT systems.

Block 11.m. Any cleared contractor employed by a DoD cleared contractor whose Cognizant Security Agency (CSA) is Defense Counterintelligence and Security Agency (DCSA) and who conducts work on a federal installation, shall report to both the cognizant cleared contractor Facility Security Officer (FSO) and the NAWCWD Command Security Manager any adverse information or circumstances of which they are aware pose a threat to the following: Security of DoD personnel; contractor personnel; resources; classified or unclassified Defense information; and anything that elevates the risk to the cleared contractor’s proprietary information, intellectual property, and personnel. For further justification, please refer to National Industrial Security Program Operating Manual (NISPOM 32 CFR Part 117, 24 Feb 2021). For reports of loss, compromise, or suspected compromise of classified information, and if the facility in which the cleared contractor employee is working at is located on a government installation, these reports shall be furnished to the CSA through the Commander or Head of the Host Installation – reference NISPOM 32 CFR Part 117, 24 Feb 2021.

Block 11.m: On-site contractor support service personnel shall cooperate with any preliminary inquiries conducted by NAWCWD Command Security Manager regarding loss, compromise, or suspected compromise of classified information or inquiry into significant Command Security weaknesses. NAWCWD CSM will notify the appropriate company Facility Security Officer and/or Program Manager if a contractor or subcontractor is involved in an inquiry.

Block 11.m: Prior to any involvement in the execution of this contract by a Foreign Owned or Controlled entity, International Organization, or Foreign Government, the contractor must be in compliance with the ITAR 22 C.F.R 120-130. The United States Government reserves the right to deny official and unofficial visit requests by foreign persons to the United States Military facilities.

Block 11.m: The contractor shall comply with FAR Clause 52.204-2 entitled Security Requirements, DoD Security Agreement (DD Form 441) OR (DD Form 441-1) for cleared branches or divisions of MFOs, as well as the DoD NISPOM 32 CFR Part 117, 24 Feb 2021 (National Industrial Security Program – current version in administering security matters incident to performance of task requirements.

If additional security classification is required, please contact the Contracting Officer’s Security Representative in Block 17.a.

*************************End of DD Form 254 Additional Data Sheets*************************

China Lake, CA 93555-6100

17. CERTIFICATION AND SIGNATURES - c. ADDRESS (Include ZIP Code): 1 Administration Circle Stop 1301 China Lake, CA 93555-6100