J15. 47QFHA24R0004_T10_09_DRRS Seed Attachment 5_DD Form 254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

Other CONUS and OCONUS locations will be approved by the GCA points of contact as needed. Also see statement listed in phrase 11.f.

Direct all questions to the Contracting Officer's Representative (COR) Roxanne Moore The Contract Specialist (CS) Renee Faller -Prime contractor's are required to send copies of all subcontract DD Form 254s to obtain flow-down approvals as required to the distribution listed in block 17: GSA (COR), GSA (CS) see above The GSA-COR will specify which positions require a clearance. All personnel are required to have a Secret level (or higher) security clearance that work on this contract, that will have access to classified material.

Contractors shall follow all Host Command security and training requirements.

All classified documents must be destroyed using a National Security Agency (NSA) approved high security crosscut shredder listed on the NSA/CSS evaluated products list(EPL) for high security crosscut paper shredders, or other approved method for destroying classified information.

-All security related issues, incidents, or requests pertaining to this contract shall be presented in writing by the contractor's Facility Security Officer (FSO) to the individual identified in blocks 16 and 17 and the COR of this DD254. The contractor shall abide by other reporting requirements outlined in the NISPOM.

Ref 10(j): For Controlled Unclassified Information (CUI) generated and/or provided under this contract shall be safeguarded and marked as specified in DoD Manual 5200.1 Volumes 1-4 . : 10.j/11.l Contractors receiving, transmitting or accessing controlled unclassified technical information (CUI) on or through its contractor information system(s) must safeguard the information to avoid compromise, including but not limited to disclosure of information to unauthorized persons, unauthorized modification, destruction, or loss of an object, or the copying of information to unauthorized media, as required per DFARS Subpart 204.73 and Clauses 204.7304 and 252.204-7012. Contractors shall report to the DOD each Cyber incident that affects unclassified controlled technical information resident on or transiting contractor information systems in accordance with DFARS clause 204.7304 and 252.204-7012. Detailed reporting criteria and requirements are set forth in the clause at 252.204-7012, safeguarding of unclassified controlled technical information. For information on handling CUI see DOD Instruction 5200.48, Controlled Unclassified Information (CUI). Controlled Unclassified Information (CUI) associated with this contract must be safeguarded to prevent unauthorized public disclosure. CUI such as FOUO, Security Classification Guides (SCG), and other technical information with Distribution Statements B, C, D, E or F are not authorized for public release and cannot be placed on a publicly accessible web site or web server. All emails containing such information or attachments must be appropriately marked, and digitally signed and encrypted if being transmitted. All transmissions to personal email accounts (AOL, Yahoo, Hotmail, Comcast, etc.) and posting on social media websites (Facebook, Instagram, Twitter, LinkedIn, etc.) are prohibited. Destroy all CUI associated with this contract by any of the following approved methods: A cross-cut shredder; a certified commercial destruction vendor; a central destruction facility; incineration; chemical decomposition; pulverizing, disintegration; or methods approved for classified destruction.

Ref 11(f): Contractor access to classified information abroad is limited to US Government controlled spaces IAW NISP policy. : Access to classified U.S. government information may be required at the following overseas locations: Guam, Kaiserslautern, Germany; Landstuhl, Germany; Seoul Republic of Korea (ROK); Naples, Italy; Sigonella, Italy; and Yamaguchi, Japan. To list all UICs for these OCONUS locations in 8.a would require all UICs in each of these countries since CONTRACTOR would visit upon request of the command. What CONTRACTOR does on site is provide training in managing e-SMS tools, and assistance in attaining and maintaining their OSHA certifications. Upon request of the OCONUS command CONTRACTOR will request authorization from the COR and GSA contracts along with permission from OSD P&R. Once approved CONTRACTOR will be required to follow all travel security requirements for OCONUS and submit all of the necessary documentation to GSA foreign travel office for processing. Only upon approval by GSA foreign travel are CONTRACTOR allowed to book and purchase travel to that location. Antiterrorism/force protection briefing within one year of departure and a country specific briefing within 90 days of departure. Anti-terrorism/force protection (AT/FP) briefings are required for all personnel (military, DoD civilian, and contractor). Contractor employees must receive the AT/FP briefing annually. The briefing is available at Joint Knowledge Online (JKO): https://jkodirect.jten.mil (prefix): course number: US007; title: Level 1 Anti-terrorism Awareness Training, if experiencing problems accessing this website contact the JKO Help Desk (24 hours a day/7 days a week, jkohelpdesk@jten.mil, 757-203-5654). Sere 100.2 Level A code of conduct training is also required prior to OCONUS travel for all personnel. Sere 100.2 Level A training can be accessed at http://jko.jfcom.mil (recommended), https://jkodirect.jten.mil/atlas2/faces/page/login/login.seam, recommended course: prefix: J3T: course #: A-US1329, for civilian, military, and contractors. Personnel utilizing this site must have a CAC or contractor shall request a sponsored account to access the training. Specialized training for specific locations, such as SOUTHCOM human rights, or U.S. FORCES Korea entry training, may also be required. Finally, EUCOM has mandated that all personnel going on official travel to the EUCOM AOR must now register with the Smart Traveler Enrollment Program (STEP). When you sign up, you will automatically receive the most current information the State Department compiles about your destination country. You will also receive updates, including Travel Warnings and Travel Alerts. Sign up is one-time only, after you have established your STEP account, you can easily add official or personal travel to anywhere in the world, not just EUCOM.

http://travel.state.gov/content/passports/en/go/step.html.

Ref 11(g): The contractor is authorized the use of DTIC regarding specific contract related information and will prepare and process DD Form 1540 in accordance with the NISPOM Rule, 32 CFR 117. The COR/TR will certify need-to-know to DTIC. Contractor is only authorized to use DTIC at the government site.

Ref 11(j): Contractors are required to take Operation Security training. All personnel requesting access to any DOD networks must receive formal OPSEC training prior to approval for access to any DOD networks, and at least annually thereafter. This requirement applies to all Government Civilian, Military and Contractor personnel who require access to DOD networks. For contractors, this requirement applies whether or not OPSEC is currently listed as specific contract requirement.

CDSE OPSEC Course: https://securityawareness.usalearning.gov/opsec/index.htm

Ref 11(l): see phrase 10.j/11.l Contractors receiving, transmitting or accessing controlled unclassified technical information (CUI) on or through its contractor information system(s) must safeguard the information to avoid compromise, including but not limited to disclosure of information to unauthorized persons, unauthorized modification, destruction, or loss of an object, or the copying of information to unauthorized media, as required per DFARS Subpart 204.73 and Clauses 204.7304 and 252.204-7012. Contractors shall report to the DOD each Cyber incident that affects unclassified controlled technical information resident on or transiting contractor information systems in accordance with DFARS clause 204.7304 and 252.204-7012. Detailed reporting criteria and requirements are set forth in the clause at 252.204-7012, safeguarding of unclassified controlled technical information. For information on handling CUI see DOD Instruction 5200.48, Controlled Unclassified Information (CUI). Controlled Unclassified Information (CUI) associated with this contract must be safeguarded to prevent unauthorized public disclosure. CUI such as FOUO, Security Classification Guides (SCG), and other technical information with Distribution Statements B, C, D, E or F are not authorized for public release and cannot be placed on a publicly accessible web site or web server. All emails containing such information or attachments must be appropriately marked, and digitally signed and encrypted if being transmitted. All transmissions to personal email accounts (AOL, Yahoo, Hotmail, Comcast, etc.) and posting on social media websites (Facebook, Instagram, Twitter, LinkedIn, etc.) are prohibited. Destroy all CUI associated with this contract by any of the following approved methods: A cross-cut shredder; a certified commercial destruction vendor; a central destruction facility; incineration; chemical decomposition; pulverizing, disintegration; or methods approved for classified destruction.

Ref 12: Public Release: Contractor is to submit requests through the DRRS Implementation Officer Director for OPSEC Program Manager review and public release authorization. The DRRS Implementation Office Director will provide contractor with written approval/disapproval. Information requiring DoD-level review will be reviewed by the appropriate offices within OSD, including the OSD Public Affairs Office.

Max Subcontracting Level: TIER 5

PERSONNEL SECURITY PROGRAM REQUIREMENTS

Contractors shall comply with all policy and procedures, consistent with E.O. 12829, “National Industrial Security Program”; E.O. 10865, “Safeguarding Classified Information within Industry”; 32 CFR part 2004; and DoD Instruction (DoDI) 5220.22, “National Industrial Security Program (NISP)” (available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/522022p.pdf?ver=2018-05-01-073158-710) for the protection of classified information that is disclosed to, or developed by contractors of the U.S. Government (USG) (hereinafter referred to in this rule as contractors).

Additionally, the contractor shall comply with all applicable rules and regulations pertaining to E.O. 12829, E.O. 13587,”Structural Reforms To Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information”; E.O. 13691, “Promoting Private Sector Cybersecurity Information Sharing”; E.O. 12333, “United States Intelligence Activities”; 42 U.S.C. 2011 et seq. (also known as and referred to in this rule as the “AEA of 1954,” as amended); ” 50 U.S.C. Ch. 44 (also known as the “National Security Act of 1947,” as amended); 50 U.S.C. 3501 et seq. (also known as the “Central Intelligence Agency Act of 1949,” as amended); Public Law 108–458 (also known as the “Intelligence Reform and Terrorism Prevention Act of 2004”); and 32 CFR part 2004:

(1) Prescribes industrial security procedures and practices, under E.O. 12829 or successor orders, to safeguard USG classified information that is developed by or disclosed to contractors of the USG.

(2) Prescribes requirements, restrictions, and other safeguards to prevent unauthorized disclosure of classified information and protect special classes of classified information.

(3) Prescribes that contractors under the security cognizance of the Department of Defense will report foreign travel to the Department of Defense.

I. Visit Authorization Requests (VARs) for Qualified Employees:

Contractors that have been awarded a classified contract must submit visit requests using the Defense Information System for Security (DISS). This will change to the National Background Investigation Services (NBIS) or the approved DoD personnel security system of record. All government activities have been directed to use DISS, NBS, or the approved DoD personnel security system of record when transmitting or receiving VARS. Therefore, contractors who work on classified contracts are required to have established an account through DISS, NBS for their facility. This database contains all U.S.

citizens who have received a clearance of Confidential, Secret, and/or Top Secret. The visit request can be submitted for up to one year. This information is provided in accordance with guidance provided to contractors via the Defense Counterintelligence Security Agency (DCSA) website https://www.dcsa.mil/

II. Employment Terminations:

The contractor shall:

Immediately notify the COR or TR of the employee’s termination.

Return any badge and decal OSD.

Contracting Officer

Personnel Security Program Requirements for Unclassified/Position of Trust (POT) Contractors and Must be Passed Down to Subcontractors.

Specific On-Site Security Requirements are Attached. This document contains reporting, security, and training requirements. For authorized visits to other U.S. Government activities, the contractor must comply with all On-site Security requirements of the Host Command.

For Official Use Only (FOUO) guidance attached.

Operations Security (OPSEC) requirements attached and must be passed to all Subcontractors

Kansas City, MO 64108 Address: 2300 Main Street Kansas City, MO 64108