J2 DISC DD-254 (HQ085521R0004) Redacted.pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

TOP SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

SECRET

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYYYMMDD) 2020/11/10

b. SUBCONTRACT NUMBER b. REVISED (Supersedes all previous specs) Revision No.

Date (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYYYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYYYMMDD)

HQ0855-21-R-0004

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the Contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code) See Block 13, Reference Item 8.a.

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Operation and Sustainment and mission support for flight test assets to include X-Band Transportable Radar (XTR), Pacific Collector Range Safety Systems (PCRSS), and Mission Execution and Display Distribution System

(MEDDS).

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify)

k. OTHER Specify)

− Additional Requirements for Contractor’s Unclassified Automated Information Systems

− Requires CNet/SIPR

DD Form 254, DEC 1999 Previous editions are obsolete

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct

Through (Specify):

Missile Defense Agency/Director Test Resource (DTR) Bldg. 5222 Martin Road Redstone Arsenal, AL 35898 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the Contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

The Contractor is required to flow-down all applicable requirements of the DD Form 254 to its Subcontractor(s).

Direct all questions pertaining to the DD Form 254 to the MDA Industrial Security office by phone at (256) 450- 0939, by email at MDAIndustrialSecurity@mda.mil, or by mail to MDA, ATTN: Industrial Security Office (EIR), Building 5222 Martin Road, Redstone Arsenal, AL 35898.

See Continuation Pages (3-10)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No

See Reference Items; 10.f, 10.j, 11.j, 11.l. and 14.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

MDA SAPCO is responsible for inspection of SAP under this contract.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

Nasu R. Bethea

b. TITLE Assistant Director, Research, Development

& Acquisition Security

c. TELEPHONE (Include Area Code)

(256) 955-1908

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

Missile Defense Agency

a. CONTRACTOR

Bldg. 5222 Martin Road

b. SUBCONTRACTOR

Redstone Arsenal, AL 35898

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY MDA Industrial Security

DD Form 254 Reverse, DEC 1999

SECURITY GUIDANCE (BLOCK 13) CONTINUATION PAGES:

Special Requirements:

The Contractor shall provide the following to the MDA Industrial Security (contact information listed in block 13 of page two of the DD Form 254) and MDA/DT PROGRAM SECURITY

OFFICE:

• Provide a copy to the MDA Industrial Security Office and of any security incident report

(initial and final) involving the loss, compromise, or suspected compromise of classified information sent to the Defense Counterintelligence and Security Agency. The Contractor shall provide a complete copy of the report (without redaction) to the MDA within the same reporting timeframe as is required by the Defense Counterintelligence and Security Agency (72 hours for Secret/Confidential and 24 hours for Top Secret)

• Provide a complete copy of the report (without redaction) to the MDA Industrial Security Office of any report involving a cyber-intrusion of MDA program information sent to the Federal Bureau of Investigation and the Defense Counterintelligence and Security Agency per NISPOM Chapter 1, Section 301 and Industrial Security Letter 2013-05.

• Provide a complete copy of the report (without redaction) to the MDA Industrial Security Office of any Defense Counterintelligence and Security Agency letter that indicates a less than satisfactory security rating and/or that negatively impacts the Facility Clearance Level (FCL) of the company within 48-hours of receipt.

• Provide electronic copies of Subcontractor DD Form 254s issued by the Prime and the Subcontractor. The Prime Contractor shall act as the focal point for collecting their Subcontractor’s DD Form 254s and the Prime is responsible for forwarding these DD Form 254s to the MDA Industrial Security Office.

• Contractors sending classified mail shall actively (daily) track each classified package(s) throughout the entire transit process until the shipment is confirmed as received by the intended organization. The sender should monitor the transit process via the mail carrier's tracking process. If the last transit status entry on the mail carrier's tracking website was made more than one business day after the estimated delivery date, the sender will notify and provide the relevant details to their Facility Security Officer and the Missile Defense Agency in accordance with DD254 requirements.

• Information transported externally to a cleared facility shall be encrypted. The encryption of all MDA Controlled UNCLASSIFIED and CLASSIFIED removable media while in transit via authorized means of transmission including Couriers, Hand Carriers, and Escorts; the United States Postal Service (USPS); or other mail services (e.g., Federal Express, United Parcel Service, etc.). Contract direction shall incorporate the following tenants: All removable media (Hard Disk Drive (HDD), optical disk, Flash Media (USB HDD),Solid-state Drives (SDD), etc.) shall utilize data-at-rest (DAR) encryption:

- Classified data shall be encrypted using a FIPS 140-2 validated technology.

- Unclassified data to include Personal Identifiable Information (PII)/ For Official

Use Only(FOUO)/ Covered Defense Information (CDl)/Controlled Unclassified Information (CUI)/ Unclassified Controlled Technical Information (UCTI) shall use at least a FIPS 140-2 compliant technology, validated is recommended.

- Operating system, software, and hardware updates do not require encryption.

Any waiver requests for this requirement must be made by the contractor to the responsible Contracting Officer for approval consideration.

In accordance with NISPOM Chapter 1, Section 300, the Contractor and its subcontractors shall notify the Contracting Officer, the Contracting Officer’s Representative, and MDA Industrial Security in writing within 24 hours of becoming aware of adverse information regarding an employee, who works within a Government/MDA facility, which could affect their access to classified information.

Subcontractor Classified Access Approvals:

The Prime Contractor and Subcontractor are authorized to flow access to and/or dissemination of classified information to the TOP SECRET level to their Subcontractor. Dissemination is only authorized and applicable for information safeguarded at the Contractor’s facility. This authorization includes access to Communications Security (COMSEC) (NISPOM Chapter 9, Section 407), Critical Nuclear Weapon Design Information (CNWDI) (NISPOM Chapter 9, Section 204), Non-SCI Intelligence Information and North Atlantic Treaty Organization (NATO) (NISPOM Chapter 10, Section 708) information. The Contractor shall provide the appropriate accesses to its Subcontractors as required per NISPOM 5-502. The Prime Contractor and Subcontractor must verify Facility Clearance, Safeguarding Capability and Access Authorizations prior to the dissemination of classified information. Special Access Program (SAP) - not authorized to flow without prior approval from MDA/Special Programs (refer to SAP Supplement).

This section concerns the release of classified information to the contractor regarding the government’s Request for Information; MDA classified information may only be released to the Contractor for submission preparation purposes following verification of the Contractor’s facility clearance and safeguarding. The DD Form 254 shall act as security guidance for the safeguarding of DISC related classified information at the Contractor facility. The Defense Counterintelligence and Security Agency maintains security cognizance of classified information stored at a Contractor facility. However, the following stipulations apply:

• IAW NISPOM paragraphs 5-200 and 5-600, Contractors shall ensure full written accounting and control over all MDA classified information provided to the Contractor by MDA or created as copies by the Contractor.

• IAW NISPOM paragraphs 5-501 and 5-502, distribution of MDA classified information shall only be made to those cleared Contractor personnel working on the Contractor’s response to the request for information, unless otherwise authorized by the Program Manager

(PM).

• IAW NISPOM paragraph 5-509, for purposes of this submission request, further distribution of MDA classified information shall only be authorized by the MDA PM overseeing this request for information.

• IAW NISPOM paragraphs 5-702, 5-703, and 5-704, all classified information provided for use in submission preparation shall be returned to MDA or destroyed.

• A contractors response to the Request for Information shall include appropriate classification markings IAW the NISPOM and appropriate Controlled Unclassified Information/For Official Use Only (CUI/FOUO) markings IAW the DoDM 5200.01, Volume

Reference Item 8.a. (continued) Government Locations:

Classified performance will occur at various MDA and/or government locations as directed by the contract via the Performance Work Statement, Statement of Work, or Statement of Objectives or other agreement. The Contractor shall abide by the host government security requirements per NISPOM Chapter 1, Section 200 and Chapter 6, Section 105c. The cognizant security office at the performance location is MDA or the host installation.

Reference Item 8.a. (continued) Performance Locations include the following Contractor Facilities:

a. LOCATION b. CAGE

CODE

c. COGNIZANT SECURITY

OFFICE

Per NISPOM Chapter 5 Section 504, the Contractor can disclose classified information between cleared facilities within the Multiple Facility Organization (MFO). MDA does not limit which cleared locations are considered performance locations within the MFO. It is the Contractor’s responsibility to comply with Defense Counterintelligence and Security Agency policy and procedures for establishing a classified performance location within the MFO structure. This guidance does not apply to government locations or other Contractor company locations at which the prime Contractor will be conducting classified performance.

Reference Item 10.a and 11.h: The Contractor shall comply with the requirements of NISPOM Chapter 9, Section 4 and National Security Agency/Central Security Service Policy Manual Number 3-16, Control of Communications Security (COMSEC) Material, for access to and safeguarding of COMSEC information.

Reference Item 10.b &10.d: Contractors shall adhere to the requirements of DoDI 5210.02, “Access to and Dissemination of Restricted Data (RD) and Formerly Restricted Data (FRD),” 3 June 2011, for access and training requirements. Flow this requirement and training materials to subcontractors when applicable.

1. Contractors shall possess a valid DoD security clearance at a level commensurate with the information concerned and shall have a need-to-know for access. DoD contractors require a final Secret security clearance for access to Secret RD information. Contractors shall have a final Top Secret security clearance for access to Top Secret RD information. NISPOM section 2-211a. applies.

The Prime contractor and its subcontractors shall be required to complete training for access to RD/FRD material and for derivative classification of RD/FRD information. This training is provided by the Department of Energy (DOE) and shall be arranged by the MDA Contracting Officer Representative (COR) whom will coordinate with the EIR, Associate Restricted Data Management Official (mda_rdmo@mda.mil) to schedule training. The company’s Facility Security Officer (FSO) shall maintain a record of the training for each individual with access to RD/FRD. These records shall be made readily available during security inspections or for other government purposes. Records shall be maintained for two years after an individual no longer requires access to RD/FRD information.

a. For individuals with access to RD/FRD information, personnel shall complete the “Classification of Nuclear Weapons-Related Information (Restricted Data and Formerly Restricted Data)” course, “RD Derivative Classifier” course and TFNI Briefing. The contractor company shall maintain a record of the training for each individual with access to RD/FRD. These records shall be made readily available during security inspections or for other government purposes. Records shall be maintained for two years after an individual no longer requires access to RD/FRD information.

b. For individuals who will conduct derivative classification, personnel shall complete the “Classification of Nuclear Weapons-Related Information (Restricted Data and Formerly Restricted Data)” course, “RD Derivative Classifier” course and TFNI Briefing. The training course shall be arranged by the MDA Contracting Officer Representative (COR) whom will coordinate with the EIR, Associate Restricted Data Management Official (mda_rdmo@mda.mil) to schedule training and will be certified as a Derivative Classifier IAW MDA procedures. The contractor company shall maintain a record of the training for each individual designated as a RD Classifier. These records shall be made readily available during security inspections or for other government purposes. Records shall be maintained for two years after an individual is no longer designated as a RD Classifier.

Reference Item 10.c: NISPOM Chapter 9, Section 2 requirements apply. Access to Critical Nuclear Weapons Design Information requires a final clearance.

Reference Item 10.e.(2): NISPOM Chapter 9, Section 3 requirements apply. Non-SCI Intelligence Information (SCI) is intelligence information existing at the collateral level and is typically, but not always, identified by the NOFORN caveat. The ODNI defers to the 32 CFR 2001 and as stated in the ICS 703-01 for classified national intelligence information and only requires government (i.e. MDA) determination for prime contractor to subcontractor flow-down.

Reference Item 10.f: Requirements are included in the attached SAP Supplement.

Reference Item 10.g: NISPOM Chapter 10, Section 7 requirements apply.

Reference Item 10.h: NISPOM Chapter 10, Section 3 requirements apply.

Reference Item 10.j:

1. The Contractor shall adhere to the requirements in the DoD Manual 5200.01, DoD Information Security Program, Volume 4, Controlled Unclassified Information (CUI) and Information Security Oversight Office Notice 2019-03 “ Destroying Controlled Unclassified Information in Paper Form”(15 July 2019) for safeguarding, marking, transmission, dissemination, and disposition of all CUI/For Official Use Only (FOUO) information.

2. Access.

a. Access to CUI/FOUO should be limited to U.S. Nationals that have either a current U.S.

security clearance (minimum interim SECRET clearance) or have been the subject of a favorably completed National Agency Check with Inquiries (i.e. Standard Form (SF) 85 Position of Trust investigation) or equivalent investigation (i.e. approved contractor equivalent).

(1) Definitions:

(a) A U.S. Person is defined as any form of business enterprise or entity organized, chartered or incorporated under the laws of the United States or its possessions and trust territories, and any person who is a citizen or national of the United States

(b) A U.S. National is defined as a citizen of the U.S., or a person who, though not a citizen of the U.S., owes permanent allegiance to the U.S. Also see 8 USC 1101(a) (22) or 8 USC 1401 paragraphs (a) through (g) for further clarification on those who may qualify as nationals of the United States.

(2) Contractor Equivalent: Contractor equivalent includes various background checks such as those performed by employers during hiring process. At a minimum, the Contractor Equivalent Background Plan (CEBP) will include citizenship, Personal Identification (Social Security Number), and criminal background checks. The contractor shall submit a list of their procedures on company letterhead through the Contracting Officer or their representative for concurrence by the designated MDA approving office.

b. Contractor personnel with dual or foreign citizenship (including but not limited to those with permanent resident status) will be subject to an additional review; and found favorable by MDA prior to access to CUI/FOUO. (Note: Contractor personnel with dual citizenship that have an active U.S. security clearance (interim Secret or higher) may have access to CUI/FOUO material without additional review.

3. See Reference Item 11.l. for safeguarding of CUI/FOUO on a contractor’s unclassified information system(s).

4. The contractor shall flow-down this requirement to all subcontractors requiring access to CUI/FOUO information regardless if the subcontractor has a facility security clearance or not.

For those uncleared subcontractors, the prime contractor shall ensure this section exists within the language of the subcontract/purchase order.

Reference Item 11.c: The contractor shall be required to track classified information sent via non-electronic means and obtain a receipt from the recipient (reference NISPOM Chapter 5, Section 401b.). The contractor shall ensure deliberate tracking throughout the entire transit process. Any suspected or confirmed loss or compromise of the classified information shall be reported in the timeframes established in the "Reporting Requirements" section of this DD Form

254. The Contractor has a responsibility to understand and use all applicable Security Classification Guidance (SCG) provided by the government (reference NISPOM 4-103a). The MDA has provided a list below of the necessary SCGs required to conduct derivative classification. The Contractor shall request the required SCGs from the Contracting Officer's Representative (COR). The MDA has the obligation to review existing guidance periodically during the performance stages of the contract and to issue a revised DD Form 254 when a change to the SCGs occurs or when additional SCGs are needed (reference NISPOM Chapter 4, Section 103b.). The Contractor shall flow-down required SCGs on its Subcontractor DD Form 254s and shall provide copies of the SCGs to its Subcontractor. The following security classification guidance applies:

1. Ballistic Missile Defense System (BMDS) Security Classification Guide (SCG), dated 19 October 2010 to include Change 1, dated 26 May 2017 **This guide consists of two parts, an UNCLASSIFIED//FOR OFFICIAL USE ONLY general guide, and a SECRET appendix. The appendix is not a stand-alone document and must be used in conjunction with the general guide.

2. Other Security Classification Guides will be provided as required.

Reference Item 11.d: The Contractor is required to provide adequate storage and transportation for classified hardware to the level of SECRET. If the classified hardware is of such a size or quantity that it cannot be safeguarded in a regular-sized GSA-approved storage container, a Closed Area, Vault, or additional security containers may be required. Per the NISPOM, the Defense Counterintelligence and Security Agency has responsibility for the authorization and approval of all Closed Areas and/or Vaults within the Contractor’s facility.

Reference Item 11.f:

1. The Contractor shall require access to classified information overseas at areas designated in the Statement of Work, Performance Work Statement, or Statement of Objectives.

2. Contractor personnel traveling on DoD-sponsored (official) travel overseas shall complete all training and messaging requirements outlined within the DoD Foreign Clearance Guide (FCG) for the foreign country being visited and support administrative reporting requirements specified by their program Country Clearance Message (CCM) Coordinator within 45-days prior to travel.

Contractor personnel should review U.S. Department of State (DoS) Travel Warnings, Travel Alerts, and individual country specific information located at U.S. Department of State (DoS) Travel Warnings web address and are encouraged to enroll in the U.S. DoS Smart Traveler Enrollment Program (STEP) prior to commencing official travel overseas.

3. The Contractor shall submit foreign visit requests as dictated by the NISPOM, Chapter 10, Section 5. A Contractor shall submit the visit request through the Defense Counterintelligence and Security Agency-designated security official.

4. The Contractor is not authorized per the NISPOM to establish a contractor facility outside of the U.S., its possessions, or its territories. Storage, custody, and control of classified information required by a U.S. Contractor employee abroad is the responsibility of the U.S. Government.

Storage of classified information shall be at a U.S. military facility, a U.S. Embassy or Consulate, or another location occupied by a U.S. Government organization.

Reference Item 11.g: The Contractor is authorized to use the services of the Defense Technical Information Center (DTIC) or other secondary distribution center. As required, the Contractor will prepare and submit the DD Form 1540, “Registration for Scientific and Technical Information Services” and DD Form 2345, “Militarily Critical Technical Data Agreement” to the contracting office for approval. Subcontractors are required to submit requests through the Prime Contractor.

Reference Item 11.j: Have Operations Security (OPSEC) Requirements.

This contract requires the application of Operations Security (OPSEC):

1. The contractor supporting specific event-oriented activities shall comply with OPSEC Plans and briefings as defined in the Statement of Work (SOW)/Performance Work Statement (PWS).

2. Contractor personnel assigned shall receive OPSEC Awareness Education as appropriate.

3. The Contractor shall plan for and implement OPSEC supply chain processes and practices that restricts information flow-down (manufacturing need-to-know) and limits information listed on commodity Purchase Orders for critical program information and critical components.

4. The contractor shall apply OPSEC during flight test activities in accordance with specific test plans.

Reference Item 11.l:

Contractor’s Unclassified Automated Information System:

1. The Contractor shall safeguard and protect Controlled Unclassified Information/For Official Use Only (CUI/FOUO) information provided by or generated for the Government that transits, resides, or is processed on any non-Government information technology system IAW the procedures in DoDI 8582.01, “Security of Unclassified DoD Information on Non-DoD Information Systems,” June 6, 2012, Enclosure 3. Additionally, if the contract includes the DFARS Clause 252.204-7012, Safeguarding of Covered Defense Information and Cyber Incident Reporting, then the contractor must comply with its requirements. If the DFARS Clause 252.204-7012 does not exist on contract, the contractor shall comply with the requirements of the Office of Management and Budget Circular A-130 and the DoD Directive 8100.2 until such time as the DFARS Clause 252.204-7012 may be added.

2. The contractor shall ensure that all persons accessing CUI/FOUO meet the qualifications as stated in Reference Item 10.j. of this DD Form 254.

3. MDA reserves the right to conduct compliance inspections of Contractor unclassified information systems and other repositories to verify the protection of CUI/FOUO information.

4. The contractor shall flow this reference item to all subcontractors that process and access CUI/FOUO information regardless if the subcontractor has a facility security clearance or not.

For those uncleared subcontractors, the prime contractor shall ensure this section exists within the language of the subcontract/purchase order.

Reference Item 12: The Prime Contractor shall forward all requests for public release authorization through the Contracting Officer’s Representative to the listed MDA program office. Per NISPOM section 5-511, the Contractor shall include all necessary information to assist with the decision of the MDA program office. Per NISPOM Chapter 7, Section 102c., the Prime Contractor shall act as the focal point for all Subcontractor requests for public release. A lack of response from the MDA program office does not constitute as public release authorization. The Prime Contractor shall not release information to the public prior to receiving written authorization from the MDA program office (this requirement includes any information system that provides public access).

Reference Item 14: Program Protection is required for this contract. The interdisciplinary requirements associated with Program Protection are addressed in the Government issued Program Protection Plan (PPP). The contractor shall develop a Program Protection Implementation Plan (PPIP) in accordance to the requirements in the PPP. The contractor shall implement the PPIP with applicable security countermeasures to protect Critical Program Information (CPI) and Critical Components (CC) as outlined in the Statement of Work/Performance Work Statement/Statement of Objectives, and refined in the PPP. The PPIP shall apply to the Prime contractor and flow-down to all Subcontractor locations where CPI and/or CC are developed, produced, analyzed, maintained, transported, stored, and/or used in training.

DEPARTMENT OF DEFENSE