Attachment 2 - Security Classification Specification (DD254).pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

INFORMATION TECHNOLOGY (IT) SYSTEMS PERSONNEL SECURITY PROGRAM

REQUIREMENTS

The U.S. Government conducts trustworthiness investigations of personnel who are assigned to positions that directly or indirectly affect the operation of unclassified IT resources and systems that process Department of

Defense (DoD) information, to include For Official Use Only (FOUO) and other controlled unclassified information.

The United States Office of Personnel Management (OPM), Federal Investigations Processing Center (FIPC) process all requests for U.S. Government trustworthiness investigations. Requirements for these investigations are outlined in paragraph C3.6.15 and Appendix 10 of DoD 5200.2-R, available at http://www.dtic.mil/whs/directives/corres/dir.html. Personnel occupying an IT Position shall be designated as filling one of the IT Position Categories listed below. The contractor shall include all of these requirements in any subcontracts involving IT support. (Note: Terminology used in DoD 5200.2-R references “ADP” vice “IT”.

For purposes of this requirement, the terms ADP and IT are synonymous.)

The Program Manager (PM), Contracting Officer’s Representative (COR) or Technical Representative (TR) shall determine if they or the contractor shall assign the IT Position category to contractor personnel and inform the contractor of their determination. If it is decided the contractor shall make the assignment, the PM, COR, or TR must concur with the designation.

DoDD Directive 8500.01, Subject: Information Assurance (IA), paragraph 4.8 states "Access to all DoD information systems shall be based on a demonstrated need-to-know, and granted in accordance with applicable laws and DoD 5200.2-R for background investigations, special access and IT position designations and requirements. An appropriate security clearance and non-disclosure agreement are also required for access to classified information” in accordance with DoDM 5200.01 Vol. 1. DoD 5200.2-R and DoDD 5200.2 require all persons assigned to sensitive positions or assigned to sensitive duties be U.S. citizens. All persons assigned to

IT-I and IT-II positions, as well as all persons with access to controlled unclassified information (without regard to degree of IT access) or performing other duties that are considered "sensitive" as defined in DoDD 5200.2 and

DoD 5200.2-R must be U.S. citizens. Furthermore, access by non-U.S. citizens to unclassified export controlled data will only be granted to persons pursuant to the export control laws of the U.S. The categories of controlled unclassified information are specified in DoDM 5200.01 Vol. 4. These same restrictions apply to

"Representatives of a Foreign Interest" as defined by DoD 5220.22-M (National Industrial Security Program

Operating Manual, NISPOM). DoD 8570.01-M further stipulates additional training and/or certification that is required by all persons assigned to Information Assurance functions.

Criteria For Designating Positions: updated per OPM Federal Investigations Notice No. 16-02, dated

October 6, 2015:

Tier 5/5R is for Top Secret and/or SCI – Critical or Special Sensitive Positions = IT-I Position (Privileged)

Responsibility or the development and administration of Government computer security programs, and including direction and control of risk analysis an/or threat assessment.

Significant involvement in life-critical or mission-critical systems.

Responsibility for the preparation or approval of data for input into a system, which does not necessarily involve personal access to the system, but with relatively high risk for effecting grave damage or realizing significant personal gain.

Relatively high risk assignments associated with or directly involving the accounting, disbursement, or authorization for disbursement from systems of (1) dollar amounts of $10 million per year or greater, or http://www.dtic.mil/whs/directives/corres/dir.html

(2) lesser amounts if the activities of the individual are not subject to technical review by higher authority in the IT-I category to ensure the integrity of the system.

Positions involving major responsibility for the direction, planning, design, testing, maintenance, operation, monitoring, and/or management of systems hardware and software.

Other positions as designated by Space and Naval Warfare Systems Center Pacific (SSC Pacific) that involve relatively high risk for effecting grave damage or realizing significant personal gain.

Personnel whose duties meet the criteria for IT-I Position designation require a favorably adjudicated Single

Scope Background Investigation (SSBI) or SSBI Periodic Reinvestigation (SSBI-PR) or Tier 5/5R. The

SSBI or SSBI-PR or Tier 5/5R shall be updated every 5 years by using the Electronic Questionnaire for

Investigation Processing (eQIP) web based program (SF86 format).

Tier 3/3R is for Secret – Non Critical Sensitive positions = IT-II Position (Limited Privileged)

Responsibility for systems design, operation, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the IT-I category, includes but is not limited to:

Access to and/or processing of proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts;

Accounting, disbursement, or authorization for disbursement from systems of dollar amounts less than

$10 million per year. Other positions are designated by Space and Naval Warfare Systems Center

Pacific (SSC Pacific) that involve a degree of access to a system that creates a significant potential for damage or personal gain less than that in IT-I positions. Personnel whose duties meet the criteria for an

IT-II Position require a favorably adjudicated National Agency Check with Local Agency Check and

Credit Check (NACLC) or Tier 3/3R.

Tier 1/1R is for Unclassified – Non-Sensitive positions = IT-III Position (Non-Privileged)

All other positions involving Federal IT activities. Incumbent in this position has non-privileged access to one or more DoD information systems, application, or database to which they are authorized access.

Personnel whose duties meet the criteria for an IT-III Position designation require a favorably adjudicated National Agency Check with Inquiries (NACI) or Tier 1/1R.

Qualified Cleared Personnel Do NOT Require Trustworthiness Investigations:

When background investigations supporting clearance eligibility have been submitted and/or adjudicated to support assignment to sensitive national security positions, a separate investigation to support IT access will normally not be required. A determination that an individual is NOT eligible for assignment to a position of trust will also result in the removal of eligibility for security clearance. Likewise, a determination that an individual is

NOT eligible for a security clearance will result in the denial of eligibility for a position of trust.

Procedures for submitting U.S. Government Trustworthiness Investigations:

Only the e-QIP version of SF-85 and SF 86 are acceptable by OPM-FIPC.

The Facility Security Officer (FSO) must verify employee's security clearance eligibility in the Joint Personnel

Adjudication System (JPAS) before contacting SSC Pacific Personnel Security Office to initiate request for trustworthiness investigations.

After determining that an individual requires Public Trust Position determination, the FSO will identify the individual to the SSC Pacific Personnel Security Office and the specific IT Level category assigned for requesting the appropriate type of investigation. The FSO will also provide the following information to the SSC

Pacific Personnel Security Office to initiate a request thru e-QIP:

Full SSN of the applicant

Full Name

Date of Birth

Place of Birth

Email Address

Phone Number

The Personnel Security Office will send email notification and instruction to the applicant to complete and submit e-QIP expeditiously.

The FSO or SSC Pacific Personnel Security Office will take and submit fingerprints using SF-87, FD-258 or electronic submission. The FSO must obtain from SSC Pacific Personnel Security Office the e-QIP Request

Number for inclusion in submitting the fingerprints. For immediate fingerprint result, electronic transmission of fingerprints is encouraged. Submission of hard copy SF-87 or FD-258 is acceptable until 2013 to:

E-QIP RAPID RESPONSE TEAM

OPM-FIPC

1137 BRANCHTON ROAD

BOYERS, PA 16020

SSC Pacific Personnel Security Office will notify the FSO when the Public Trust Investigation request is released to the Parent Agency, the Office of Personnel Management (OPM).

Contractor fitness determinations made by the DOD CAF are maintained in the Joint Personnel Adjudication

System (JPAS). Favorable fitness determinations will support public trust positions only and not national security eligibility. If no issues are discovered, according to respective guidelines a “Favorable Determination” will be populated in JPAS and will be reciprocal within DoN. If issues are discovered, the DOD CAF will forward the investigation along with all supporting documentation to the SSC Pacific Security Office for local determination. The local fitness determination will be made by the Command Security Manager and your company will be notified of the decision in writing. If an individual received a negative trustworthiness determination, they will be immediately removed from their position of trust, the contractor will follow the same employee termination processing above, and they will replace any individual who has received a negative trustworthiness determination.

If you require additional assistance with the submission of Public Trust Investigations, you may send an email to

SSC Pacific at W_SPSC_SSC_PAC_clearance US@navy.mil.

Visit Authorization Letters (VALs) for Qualified Employees:

Contractors that have been awarded a classified contract must submit visit requests using “only” the Joint

Personnel Adjudication System (JPAS). All government activities have been directed to use JPAS when transmitting or receiving VALS. Therefore, contractors who work on classified contracts are required to have established an account through JPAS for their facility. This database contains all U.S. citizens who have received a clearance of Confidential, Secret, and/or Top Secret. The visit request can be submitted for one year.

When submitting a visit requests to SSC Pacific, use its Security Management Office (SMO) number (660015).

mailto:W_SPSC_SSC_PAC_clearance%20US@navy.mil

This information is provided in accordance with guidance provided to contractors via the Defense Security

Service (DSS) website https://www.dss.mil/ (DSS guidance dated 24 April 2007, subject: Procedures Governing the Use of JPAS by Cleared Contractors).

Employment Terminations:

The contractor shall:

Immediately notify the COR or TR of the employee’s termination.

Send email to W_SPSC_SSC_PAC_clearance_US@navy.mil, Code 83310 notifying them of the termination.

Fax a termination VAL to Code 83320 at (619) 553-6169.

Return any badge and decal to Commanding Officer, Space and Naval Warfare Systems Center Pacific, Attn: Code 83320, 53560 Hull Street, San Diego, CA 92152-5001.

https://www.dss.mil/ mailto:W_SPSC_SSC_PAC_clearance_US@navy.mil

SPECIFIC ON-SITE SECURITY REQUIREMENTS

I. GENERAL.

a. CONTRACTOR WILL ABIDE BY ALL SECURITY REGULATIONS AS IDENTIFIED BY EACH

HOST COMMAND FOR ALL LOCATIONS OF PERFORMANCE. The below guidance is for performance onboard SPAWAR / PEO C4I OTC locations. Other locations of performance may have differing or additional requirements that must be followed by contractor personnel.

b. Contractor Performance. In performance of this Contract the following security services and procedures are incorporated as an attachment to the DD 254. The Contractor will conform to the requirements of DoD 5220.22-M, Department of Defense National Industrial Security Program, Operating Manual (NISPOM). When visiting the Program Executive Office Command, Control, Communications, Computers, and Intelligence (PEO C4I) at Old Town Campus (OTC) the Contractor will comply with the security directives used regarding the protection of classified and controlled unclassified information, SECNAVINST 5510.36 (series), SECNAVINST 5510.30 (series), and

SPAWARINST 5510.1. Both of the SECNAV Instructions are available online at http://neds.nebt.daps.mil/directives/table52.html the SPAWAR instruction is available via request. If the Contractor establishes a cleared facility or Defense Security Service (DSS) approved off-site location from COMSPAWAR SYSCOM, the security provisions of the NISPOM will be followed within this cleared facility.

c. Security Supervision. Space and Naval Warfare Systems Command (SPAWAR) will exercise security supervision over all contractors visiting PEO C4I and will provide security support to the Contractor as noted below. The Contractor will identify, in writing to Security’s Representative, an on-site Point of

Contact to interface with Security’s Representative.

II. HANDLING CLASSIFIED MATERIAL OR INFORMATION.

a. Control and Safeguarding. Contractor personnel located at PEO C4I are responsible for the control and safeguarding of all classified material in their possession. All contractor personnel will be briefed by their FSO on their individual responsibilities to safeguard classified material. In the event of possible or actual loss or compromise of classified material, the on-site Contractor will immediately report the incident to SPAWAR’s Code 8.3.3 Security COR, as well as the Contractor's FSO. A Code 8.3.3 representative will investigate the circumstances, determine culpability where possible, and report results of the inquiry to the FSO and the Cognizant DSS Field Office. On-site contractor personnel will promptly correct any deficient security conditions identified by a SPAWAR Security representative.

b. Storage.

1. Classified material may be stored in containers authorized by SPAWARSYSCOM Command

Security Manager (CSM) for the storage of that level of classified material. Classified material may also be stored in Contractor owned containers brought on board SPAWAR with written permission. Areas located within cleared contractor facilities on board SPAWAR will be approved by DSS.

2. The use of Open Storage areas must be pre-approved in writing by SPAWARYSCOM CSM for the open storage, or processing, of classified material. Specific supplemental security controls for open storage areas, when required, will be provided by SPAWARSYSCOM CSM.

c. Transmission of Classified Material.

http://neds.nebt.daps.mil/directives/table52.html

1. All classified material transmitted by mail for use by long term visitors will be addressed as follows:

(a) TOP SECRET, Non-Sensitive Compartmented Information (non-SCI) material using the

Defense Courier Service: SSC Pacific: 271582-SN00, SSC Pacific.

(b) CONFIDENTIAL and SECRET material transmitted by FedEx will be addressed to

COMMANDING OFFICER, SPACE AND NAVAL WARFARE SYSTEMS CENTER

PACIFIC, ATTN RECEIVING OFFICER CODE 43150, 4297 PACIFIC HIGHWAY, SAN

DIEGO, CA 92110.

(c) CONFIDENTIAL and SECRET material transmitted by USPS Registered and Express mail will be addressed to COMMANDING OFFICER, SPACE AND NAVAL WARFARE SYSTEMS

CENTER PACIFIC, 53560 HULL STREET, SAN DIEGO CA 92152-5001. The inner envelope will be addressed to the attention of the Contracting Officer's Representative (COR) or applicable

Technical Representative (TR) for this contract, to include their code number.

2. All CONFIDENTIAL material hand carried to PEO C4I by contractor personnel that is intended to remain at PEO C4I shall be provided to the designated recipient or proper cleared PEO C4I employee.

3. All PEO C4I classified material transmitted by contractor personnel from PEO C4I will be sent via the PEO C4I TR for this contract.

4. The sole exception to the above is items categorized as a Data Deliverable. All contract Data

Deliverables will be sent directly to the TR and a notification of deliverables without attachments will be sent to the appropriate personnel, unless otherwise stated in the contract.

III. INFORMATION SYSTEMS (IS) Security. Contractors using ISs, networks, or computer resources to process classified, sensitive unclassified and/or unclassified information will comply with the provisions of

SECNAVINST 5239.3 (series) and local policies and procedures. Contractor personnel must ensure that systems they use at COMSPAWARSYSCOM/PEO C4I have been granted a formal letter of approval to operate by contacting their Information Assurance Office.

IV. VISITOR CONTROL PROCEDURES.

As a tenant command of Naval Base Point Loma (NBPL), SPAWAR / PEO C4I contractors must abide by NBPL visitor procedures. These procedures can be accessed via the following link:

https://www.cnic.navy.mil/regions/cnrsw/installations/navbase_point_loma/about/visitor_information.html

V. INSPECTIONS. SPAWAR Code 8.3.3 personnel may conduct periodic inspections of the security practices of the on-site Contractor. All contractor personnel will cooperate with Code 8.3.3 representatives during these inspections. A report of the inspection will be forwarded to the Contractor's employing facility, Security’s

Representative and TR. The Contractor must be responsive to the Code 8.3.3 representative's findings.

VI. REPORTS. As required by the NISPOM, Chapter 1, Section 3, contractors are required to report certain events that have an impact on the status of the facility clearance (FCL), the status of an employee's personnel clearance (PCL), the proper safeguarding of classified information, or indication classified information has been lost or compromised.

a. The Contractor will ensure that certain information pertaining to assigned contractor personnel or operations is reported to Security’s Representative, Code 8.3.3. If further investigation is warranted it will be conducted by Code 8.3.3. This reporting will include the following:

1. The denial, suspension, or revocation of security clearance of any assigned personnel;

2 Any adverse information on an assigned employee's continued suitability for continued access to classified access;

3. Any instance of loss or compromise, or suspected loss or compromise, of classified information;

4. Actual, probable or possible espionage, sabotage, or subversive information; or

5. Any other circumstances of a security nature that would affect the contractor's operation on board

PEO C4I.

b. In addition to the NISPOM reporting requirements, any conviction and/or violation of the Foreign

Corrupt Practices Act, or any other violation of the International Traffic in Arms Regulations (ITAR) shall immediately be reported to the Designated Disclosure Authority (DDA), TR and PM.

VII. PHYSICAL SECURITY.

a. Naval Base Point Loma (NBPL) will provide appropriate response to emergencies occurring onboard this command. The Contractor will comply with all emergency rules and procedures established for

NBPL.

b. A roving Contract Security Guard patrol will be provided by SPAWARSYCOM. Such coverage will consist of, but not be limited to, physical checks of the window or door access points, classified containers, and improperly secured documents or spaces.

c. All personnel aboard PEO C4I property are subject to random inspections of their vehicles and personal items. Consent to these inspections is given when personnel accept either a badge or a vehicle pass/decal permitting entrance to this command.

Contractors must comply with installation access control procedures. Any Contractor who repeatedly violates access control requirements will be issued an Apparent Security Violation (ASV). After the ASV has been investigated, a letter will be forwarded to the contracting facility’s Security Officer via the Center’s Contracting

Officer for resolution.

VIII. TECHNICAL REPRESENTATIVE RESPONSIBILITIES.

a. Review requests by cleared contractors for retention of classified information beyond a two-year period and advise the contractor of disposition instructions and/or submit a Final DD 254 to Security’s

Representative.

b. In conjunction with the appropriate transportation element, coordinates a suitable method of shipment for classified material when required.

c. Certify and approve Registration For Scientific and Technical Information Services requests (DD 1540)

(DTIC).

d. Ensure timely notice of contract award is given to host commands when contractor performance is required at other locations.

e. Certify need-to-know on visit requests and conference registration forms.

IX. SPECIAL CONSIDERATIONS FOR ON-SITE CLEARED FACILITIES.

Any cleared contractor facility on board PEO C4I will be used strictly for official business associated with this contract. No other work may be performed aboard this facility. Additional PEO C4I contracts may be performed in this cleared facility, but only on a case-by-case basis. The TR and Security’s Representative must all be in agreement that this particular arrangement best suits the needs of the Government. At the end of this contract the on-site facility must be vacated, with proper written notification being submitted to the

DSS and Security’s Representative.

X. ITEMS PROHIBITED ABOARD TEAM SPAWAR.

The following items are prohibited within any Team SPAWAR controlled areas, with the exception of personnel authorized to possess weapons in the performance of required duties. Also, note exceptions for alcohol possession and consumption on board Team SPAWAR property.

WEAPONS

1. Ammunition

2. Fireworks

3. Molotov Cocktail

4. Pipe Bomb

5. Black Jack

6. Slingshots

7. Billy/Sand Club

8. Nunchakus

9. Sand Bag: Partially filled with sand and swung like a mace

10. Metal (Brass) Knuckle

11. Dirk or Dagger

12. Switch Blade or Butterfly Knife

13. Knife with a blade (cutting edge) longer than 4 inches

14. Razor with Unguarded blade.

15. Pipe, Bar or Mallet to be used as a club.

16. Compressed Air or Spring Fired Pellet/BB gun

17. Tear Gas/Pepper Spray Weapon

18. Pistol, Revolver, Rifle, Shotgun or any other Firearm

19. Bows, Crossbows or Arrows

20. Bowie Style Hunting Knife

21. Any weapon prohibited by State law

22. Any object similar to the aforementioned items

23. Any offensive or defensive weapons not described above, but likely to cause injury (i.e., Stun Gun, Blow Gun).

24. Any abrasive, caustic, acid, chemical agent or similar substance, with which to inflict property damage or personal injury

25. Combination Tools with Knife Blades Longer Than 4 inches (i.e., Gerber, Leatherman, etc.)

Military personnel aboard Team SPAWAR controlled areas not authorized to possess a firearm, as part of prescribed military duties will be apprehended if found in possession. Civilians in unauthorized possession of a firearm will be detained while civilian authorities are notified.

CONTROLLED SUBSTANCES

The unauthorized possession or use of controlled substances defined as marijuana, narcotics, hallucinogens, psychedelics, or other controlled substances included in Schedule I, II, III, IV, or V established by Section 202 of the Comprehensive Drug Abuse Prevention and Control Act of 1970

(84 Stat. 1236) is prohibited.

CONTRABAND

Contraband defined as all equipment, products, and materials of any kind which are used, intended for use, or designed for use in injecting, ingesting, inhaling, or otherwise introducing into the human body, marijuana or other controlled substances, in violation of law. This includes hypodermic syringes, needles, and other objects to inject controlled substances in the body or objects to ingest, inhale or otherwise introduce marijuana, cocaine or hashish oil into the body is prohibited.

ALCOHOL

All COMSPAWARSYSCOM, co-located command and other government employees, as well as support contractors and authorized visitors may bring unopened containers of alcohol on board the Center if it remains in their private vehicles except where expressly authorized for an approved event. Alcoholic beverages will be consumed only at designated facilities for which written permission by the head of the command is granted.

Personnel desiring to hold a social function and serve alcohol, should send a memo (hard copy) to the head of the command, via the appropriate division head, Director of Security, and Public Affairs Officer (PAO).

The PEO will approve or disapprove the facility use request based on availability and general use policy. If facility use is approved, the PAO will forward the memo to the head of the command for approval/disapproval.

COUNTERFEIT CURRENCY

Counterfeit currency defined as any copy, photo, or other likeness of any U.S. currency, either past or present, not authorized by the U.S. Treasury Department is prohibited.

XI. ESCORTING POLICY.

a. ALL PEO C4I FOREIGN NATIONAL VISITORS MUST BE PROCESSED THROUGH THE

SPAWARSYSCOM FOREIGN VISITS OFFICE, 8.3.3.5. Contact phone number: (858) 537-8884.

XIII. CELLULAR PHONE USAGE.

a. Cellular phone use is prohibited in all secure spaces, i.e. Open Storage areas, classified laboratories.

b. Vehicle operators on DoD installations and operators of Government vehicles shall not use cellular phones, unless the vehicle is safely parked or unless they are using a hands-free device, and are also prohibited from wearing of any other portable headphones, earphones, or other listening devices while operating a motor vehicle.

c. The use of cellular phones, portable headphones, earphones, or other listening devices while jogging, walking, bicycling, or skating on roads and streets on Navy installations is prohibited except for use on designated bicycle and running paths and sidewalks.

XIV. PERSONAL ELECTRONIC MEDIA

The use of personal electronic media (computer laptops, flash (thumb), or other removable drives) is prohibited in team SPAWAR spaces except where explicitly permitted by the COMSPAWARSYSCOM

Director of Security, (858) 537-8898. All removable electronic media must be labeled (unclassified, etc.) To the highest classification of data stored, and/or for the classification of the system in which it is used. If classified, any removable electronic media must be tracked and stored appropriate to that level of classification.

FOR OFFICIAL USE ONLY (FOUO) INFORMATION

1. The For Official Use Only (FOUO) marking is assigned to Information at the time of its creation. It isn't authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9of the Freedom of Information Act (FOIA).

2. Use of FOUO markings doesn't mean that the information can't be released to the public, only that it must be reviewed by SPAWAR prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

3. An UNCLASSIFIED document containing FOUO information will be marked "FOR OFFICIAL USE ONLY" on the bottom face and interior pages.

4. Classified documents containing FOUO do not require any markings on the face of the document; however, the interior pages containing only FOUO information shall be marked top and bottom center with "FOR

OFFICIAL USE ONLY" Mark only unclassified portions containing FOUO with "(FOUO)" immediately before the portion.

5. Any FOUO information released to you by SPAWAR is required to be marked with the following statement prior to transfer:

THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY DISCLOSURE

UNDER THE FOIA EXEMPTION(S) ___________ APPLY.

6. Removal of the FOUO marking can only be accomplished by the originator or other competent authority. DO

NOT RCMOVE ANY FOUO MARKING WITHOUT WRITTEN AUTHORIZATION FROM SPAWAR OR

THE AUTHOR. When the FOUO status is terminated you will be notified.

7. You may disseminate FOUO information to your employees and subcontractors who have a need for the

Information in connection with this contract.

8 During working hours, reasonable steps should be taken to minimize risk of access by unauthorized personnel.

FOUO Information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored in locked desks, file cabinets, bookcases, locked rooms, or similar items.

9. FOUO information may be transmitted via first-class mail, parcel post, fourth-class mail for bulk shipments only.

10. When no longer needed, FOUO information may be disposed by tearing each copy Into pieces to preclude reconstructing and placing it in a regular trash, or recycle, container or in the uncontrolled burn.

11. Unauthorized disclosure of FOUO information doesn't constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO Information protected by the Privacy Act may result in criminal sanctions.

12. Electronic transmission of FOUO Information (voice, data, or facsimile) should be by approved secure communications systems whenever practical.

13. To obtain for official use only (FOUO) guidance refer to the DoD Information Security Program Regulation, DoD 5200.1-r, appendix 3, located at http://www.dtic.mil/whs/directives/corres/pdf/520001r.pdf.

http://www.dtic.mil/whs/directives/corres/pdf/520001r.pdf

OPERATIONS SECURITY (OPSEC) REQUIREMENTS

All work is to be performed in accordance with DoD and Navy Operations Security (OPSEC) requirements, per the following applicable documents:

National Security Decision Directive 298, National Operations Security Program (NSDD) 298

DOD 5205.02, DOD Operations Security (OPSEC) Program Manual

OPNAVINST 3432.1, Operations Security

SPAWARINST 3432.1,Operations Security (OPSEC) Policy

The contractor will accomplish the following minimum requirements in support of the Program Executive Office

Command, Control, Communications, Computers and Intelligence (PEO C4I) OPSEC Program:

The contractor will practice OPSEC and implement OPSEC countermeasures to protect DoD Critical

Information. Items of Critical Information are those facts, which individually, or in the aggregate, reveal sensitive details about PEO C4I or the contractor’s security or operations related to the support or performance of this SOW, and thus require a level of protection from adversarial collection or exploitation not normally afforded to unclassified information.

Contractor must protect Critical Information and other sensitive unclassified information and activities, especially those activities or information which could compromise classified information or operations, or degrade the planning and execution of military operations performed or supported by the contractor in support of the mission. Protection of Critical Information will include the adherence to and execution of countermeasures which the contractor is notified by or provided by PEO C4I, for Critical

Information on or related to the SOW.

Sensitive unclassified information is that information marked FOR OFFICIAL USE ONLY (or FOUO), Privacy Act of 1974, Company Proprietary, and information identified by PEO C4I or the

SPAWARSYSCOM Security Representative.

PEO C4I has identified the following items as Critical Information that may be related to this SOW:

o Known or probable vulnerabilities to any U.S. system and their direct support systems.

o Details of capabilities or limitations of any U.S. system that reveal or could reveal known or probable vulnerabilities of any U.S. system and their direct support systems.

o Details of information about military operations, missions, and exercises.

o Details of U.S. systems supporting combat operations (numbers of systems deployed, deployment timelines, locations, effectiveness, unique capabilities, etc.).

o Operational characteristics for new or modified weapon systems (Probability of Kill, Countermeasures, Survivability, etc.).

o Required performance characteristics of U.S. systems using leading edge or greater technology

(new, modified, or existing).

o Telemetered or data-linked data or information from which operational characteristics can be inferred or derived.

o Test or evaluation information pertaining to schedules of events during which Critical Information might be captured. (advance greater than 3 days).

o Details of Team SPAWAR unique Test or Evaluation capabilities (disclosure of unique capabilities).

o Existence and/or details of intrusions into or attacks against DoD Networks or Information Systems, including, but not limited to, tactics, techniques and procedures used, network vulnerabilities exploited, and data targeted for exploitation.

o Network User ID’s and Passwords.

o Counter-IED capabilities and characteristics, including success or failure rates, damage assessments, advancements to existing or new capabilities.

o Vulnerabilities in Command processes, disclosure of which could allow someone to circumvent security, financial, personnel safety, or operations procedures.

o Force Protection specific capabilities or response protocols (timelines/equipment/numbers of personnel/training received/etc.).

o Command leadership and VIP agendas, reservations, plans/routes etc.

o Detailed facility maps or installation overhead photography (photo with annotation of Command areas or greater resolution than commercially available).

o Details of COOP, PEO C4I emergency evacuation procedures, or emergency recall procedures.

o Government personnel information that would reveal force structure and readiness (such as recall rosters or deployment lists).

o Compilations of information that directly disclose Command Critical Information.

The above Critical Information and any that the contractor develops, regardless if in electronic or hardcopy form, must be protected by a minimum of the following countermeasures:

All emails containing Critical Information must be DoD Public Key Infrastructure (PKI) signed and PKI encrypted when sent.

Critical Information may not be sent via unclassified fax.

Critical Information may not be discussed via non-secure phones.

Critical Information may not be provided to individuals that do not have a need to know it in order to complete their assigned duties.

Critical Information may not be disposed of in recycle bins or trash containers.

Critical Information may not be left unattended in uncontrolled areas.

Critical Information in general should be treated with the same care as FOUO or proprietary information.

Critical Information must be destroyed in the same manner as FOUO.

Critical Information must be destroyed at contract termination or returned to the government at the government’s discretion.

The contractor shall document items of Critical Information that are applicable to contractor operations involving information on or related to the SOW. Such determinations of Critical Information will be completed using the DoD OPSEC 5 step process as described in National Security Decision Directive (NSDD) 298, “National

Operations Security Program”.

OPSEC training must be Included as part of the contractors ongoing security awareness program conducted in accordance with Chapter 3, Section 1, of the NISPOM. NSDD 298, DoD 5205.02, “DOD Operations Security

(OPSEC) Program”, and OPNAVINST 3432.1, “Operations Security” should be used to assist in creation or management of training curriculum.

If the contractor cannot resolve an issue concerning OPSEC they will contact the SPAWARSYSCOM Security

Representative (who will consult with the SPAWARSYSCOM OPSEC Manager).

All above requirements MUST be passed to all Sub-contractors.

Questions pertaining to the SPAWAR OPSEC Program should be directed to Grant Merkel, 619-553-2800, email grant.merkel@navy.mil .

mailto:grant.merkel@navy.mil

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments [1] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form) 2-PEO C4I IT-ONSITE-FOUO-OPSEC.pdf

THIS CONTRACT IS FOR COMMAND, CONTROL, COMMUNICATIONS, COMPUTERS, AND INTELLIGENCE (C4I) SYSTEMS ACQUISITION, INTEGRATION, AND ENGINEERING SERVICES ON BEHALF OF THE INTERNATIONAL C4I INTEGRATION PROGRAM OFFICE (PMW 740) IN SUPPORT OF AUTHORIZED AND APPROVED UNITED STATES (US) DEPARTMENT OF DEFENSE (DOD) SECURITY COOPERATION PROGRAMS.

THE CONTRACTING OFFICER’S REPRESENTATIVE (COR) IS DAVID CHAO, PMW 740, 619-524-7870

10.A - FURTHER DISCLOSURE, TO INCLUDE SUBCONTRACTING, OF COMSEC INFORMATION BY A CONTRACTOR REQUIRES PRIOR APPROVAL OF THE PEO C4I TECHNICAL CODE. ACCESS TO ANY COMSEC INFORMATION REQUIRES SPECIAL BRIEFINGS AT THE CONTRACTORFACILITY. ACCESS TO CLASSIFIED COMSEC INFORMATION REQUIRES A FINAL U.S. GOVERNMENT CLEARANCE AT THE APPROPRIATE LEVEL. USE OF COMSEC INFORMATION IS GOVERNED BY THE NSA INDUSTRIAL COMSEC MANUAL, NSA/CSS POLICY MANUAL 3-16.

10.H PRIOR APPROVAL OF THE PEO C4I COR IS REQUIRED FOR SUBCONTRACTING. ACCESS TO ANY FOREIGN GOVERNMENT INFORMATION REQUIRES A FINAL U.S. GOVERNMENT CLEARANCE AT THE APPROPRIATE LEVEL AND SPECIAL BRIEFINGS AT THE CONTRACTOR FACILITY. DUE TO THE SENSTIVE NATURE OF THIS CONTRACT SPECIFIC LOCATIONS CANNOT BE LISTED.

10.J / 11.L CONTRACTORS RECEIVING, TRANSMITTING OR ACCESSING CONTROLLED UNCLASSIFIED INFORAMTION (CUI) ON OR THROUGH ITS CONTRACTOR INFORMATION SYSTEM(S) MUST SAFEGUARD THE INFORMATION TO AVOID COMPROMISE, INCLUDING BUT NOT LIMITED TO DISCLOSURE OF INFORMATION TO UNAUTHORIZED PERSONS, UNAUTHORIZED MODIFICATION, DESTRUCTION, OR LOSS OF AN OBLECT, OR THE COPYING OF INFORMATION TO UNAUTHORIZED MEDIA, AS REQUIRED PER DFARS SUBPART 204.73 AND CLAUSES 204-7304 AND 252.204.7012. CONTRACTORS SHALL REPORT TO THE DOD EACH CYBER INCIDENT THAT AFFECTS UNCLASSIFIED CONTROLLED TECHNICAL INFORMATION RESIDENT ON OR TRANSITING CONTRACTOR INFORMATION SYSTEMS IN ACCORDANCE WITH DFARS CLAUSE 204.7304 AND 252.204-7012 DETAILED REPORTING CRITERIA AND REQUIREMENTS ARE SET FORTH IN THE CLAUSE AT 252.204-7012, SAFEGUARDING OF UNCLASSIFIED CONTROLLED TECHNICAL INFORMATION. FOR INFORMATION ON HANDLING CUI SEE DODM 5200.01 VOLUME 4.

10.K CONTRACTOR IS REQUIRED TO BE NATO BRIEFED FOR THE SOLE PURPOSE OF ACCESSING SIPRNET. THE SPECIAL BRIEFING IS PROVIDED BY THE CONTRACTING COMPANY'S FACILITY SECURITY OFFICER. NOTE: THERE IS NO REQUIREMENT FOR THE CONTRACTOR TO HAVE ACCESS TO NATO MATERIAL ON THIS CONTRACT PER CNO LTR 5510 SER N09N2/11U213075 DTD 9 SEP 11 THIS INFORMATION IS NOT REQUIRED TO BE ENTERED INTO JPAS. THE CONTRACTOR SHALL COMPLETE DERIVATIVE CLASSIFICATION TRAINING PRIOR TO BEING GRANTED ACCESS TO SIPRNET; TRAINING PROVIDED BY THE FACILITY SECURITY OFFICER.

11.A CONTRACT PERFORMANCE IS RESTRICTED TO GOVERNMENT LOCATIONS. DUE TO THE SENSTIVE NATURE OF THIS CONTRACT SPECIFIC FACILITIES CANNOT BE LISTED. PEO C4I WILL PROVIDE SECURITY CLASSIFICATION GUIDANCE FOR PERFORMANCE OF THIS CONTRACT.

11.E CONTRACT IS FOR COMSEC ACCOUNTING AND SPECIAL INVENTORY MANAGEMENT SUPPORT SERVICES. CLEARED PERSONNEL ARE REQUIRED TO PERFORM THIS SERVICE. ANY CLASSIFICATION GUIDANCE NEEDED WILL BE PROVIDED BY PEO C4I.

11.F ACCESS TO CLASSIFIED U.S. GOVERNMENT INFORMATION MAY BE REQUIRED AT THE FOLLOWING OVERSEAS LOCATIONS: DUE TO THE SENSTIVE NATURE OF THIS PROGRAM SPECIFIC LOCATIONS CANNOT BE LISTED. ANTI-TERRORISM/FORCE PROTECTION BRIEFINGS ARE REQUIRED FOR ALL PERSONNEL (MILITARY, DOD CIVILIAN, AND CONTRACTOR) PRIOR TO COMMENCEMENT OF FOREIGN TRAVEL. THE BRIEFING IS ALSO AVAILABLE AT HTTPS://TWMS.NAVY.MIL/SELFSERVICE. SERE 100.2 LEVEL A CODE OF CONDUCT TRAINING IS ALSO REQUIRED PRIOR TO OCONUS TRAVEL FOR ALL PERSONNEL. SERE 100.2 TRAINING CAN BE ACCESSED VIA THE INTERNET - TRAINING IS AVAILABLE AT:

1.NAVY KNOWLEDGE ONLINE (NKO) - HTTPS://WWW.NKO.NAVY.MIL

2. JOINT KNOWLEDGE ONLINE (JKO) - HTTP://JKO.JFCOM.MIL

HTTPS://JKODIRECT.JTEN.MIL/ATLAS2/FACES/PAGE/LOGIN/LOGIN.SEAM

RECOMMEND COURSE NUMBER: J3T: COURSE #: A-US1329

COUNTRY SPECIFIC TRAINING IS REQUIRED FOR EACH DESTINATION YOU INTEND TO VISIT. SPECIALIZED TRAINING FOR SPECIFIC LOCATIONS, SUCH AS SOUTHCOM HUMAN RIGHTS, OR U.S. FORCES KOREA ENTRY TRAINING, MAY ALSO BE REQUIRED, SSC PACIFIC SECURITY PERSONNEL WILL INFORM YOU IF THERE ARE ADDITIONAL TRAINING REQUIREMENTS. THEY CAN BE CONTACT AT SSC_FORTRAV@NAVY.MIL WITH SPECIFIC REQUIREMENTS FOR YOUR DESTINATION COUNTRY.

11.K THE CONTRACTOR SHALL MAKE ARRANGEMENTS TO USE THE SERVICES OF THE DCS FOR TRANSPORTATION OF QUALIFIED MATERIAL. THE CONTRACTING ACTIVITY WILL REQUEST DCS SERVICES FROM COMMANDER, DCS, ATTN: OPERATIONS DIVISION, FORT GEORGE MEADE, MD 20755-5370. TO OBTAIN DCS GUIDANCE REFER TO THE DOD DIRECTIVE 5200.33, DEFENSE COURIER SERVICE LOCATED AT http://www.dtic.mil/whs/directives/corres/pdf/520033r.pdf .

A. FOREIGN NATIONAL PARTICIPANTS MUST HAVE APPROPRIATE LEVEL COUNTRY SECURITY CLEARANCE TO ACCESS THAT COUNTRY’S CLASSIFIED PROGRAM INFORMATION. UNCLASSIFIED PROGRAM INFORMATION WITHOUT SPECIAL HANDLING REQUIREMENTS DOES NOT REQUIRE A COUNTRY ISSUED SECURITY CLEARANCE. NO U.S.CLASSIFIED OR U.S. UNCLASSIFIED EXPORT CONTROLLED DATA WILL BE RELEASED TO COUNTRY PARTICIPANTS REGARDLESS OF THEIR SECURITY CLEARANCE LEVEL WITHOUT THE APPROVAL OF THE PMW 740 PROGRAM MANAGER AND THE SPAWARSYSCOM TECHNOLOGY TRANSFER OFFICE.

B. MUST HAVE A VALID NEED-TO-KNOW.

C. U.S. INFORMAITON NOT RESULTING FROM THIS CONTRACT MUST BE APPROVED FOR RELEASE BY THE SPAWAR DESIGNATED DISCLOSURE AUTHORITY (DDA) PRIOR TO DISCLOSURE TO ANY FOREIGN PERSONNEL.

COPIES OF ALL SUBCONTRACT DD FORM 254S MUST BE PROVIDED TO THE DISTRIBUTION LISTED IN BLOCK 18.

ACTIVITIES, THE CONTRACTOR MUST COMPLY WITH ALL ONSITE SECURITY REQUIREMENTS OF THE HOST COMMAND.

INFORMATION TECHNOLOGY (IT) SYSTEMS PERSONNEL SECURITY PROGRAM REQUIREMENTS ARE ATTACHED AND MUST BE

PASSED TO SUBCONTRACTORS.

FOR OFFICIAL USE ONLY (FOUO) GUIDANCE ATTACHED.

OPERATIONS SECURITY (OPSEC) REQUIREMENTS ATTACHED.

SAN DIEGO, CA 92110

Address: SPAWARSYSCOM

4301 PACIFIC HIGHWAY

SAN DIEGO, CA 92110