Attachment_II_-_Draft_DD254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

OPERATIONS SECURITY (OPSEC) REQUIREMENTS

Security programs are oriented towards protection of classified information and material. Operations Security (OPSEC) is an operations function which involves the protection of any critical information – focusing on unclassified information that may be susceptible to adversary exploitation. As directed in DoDD 5205.02E OPSEC program implements requirements in DoD 5205.02 – OPSEC Program Manual. Note: OPSEC requirements are applicable when contract personnel have access to classified information or unclassified Critical Program Information (CPI)/sensitive information.

7.3.1 Local and Internal OPSEC Requirement

Contractor personnel, including subcontractors if applicable, shall adhere to the OPSEC program policies and practices and existing local site OPSEC procedures. The contractor shall development their own internal OPSEC program specific to the contract.

7.3.2 OPSEC Training

Contractor shall track and ensure applicable personnel receive initial and annual OPSEC awareness training. Training may be provided by the government or a contractor’s OPSEC Manager and shall, as a minimum, cover OPSEC as it relates to contract work, discuss the Critical Information applicable in the contract, and review OPSEC requirements if working at a government facility. Any training materials developed by the contractor shall be reviewed by a NCDOC OPSEC representative, who will ensure it is consistent with NCDOC OPSEC policies. OPSEC training requirements are applicable for personnel during their entire term supporting NCDOC contracts.

7.3.3 NCDOC OPSEC Program

Contractor shall participate in NCDOC OPSEC program briefings and working meetings as required. As required, contractor shall complete any OPSEC survey or data call within the timeframe specified.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments [1] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form) OPERATIONS SECURITY for Contracts.DOCX

TBD at time of award

TBD

112 Lake View Parkway Suffolk, VA 23435

Tim Bilbrey, NCDOC Contract Officer Representative Karen Williams, NCDOC Contracts

Period of performance for this effort is 30 September 2018 to 30 March 2024, if all option years are executed.

Access to U//FOUO, SIPR, and TS//SCI information processing systems is required.

Ref 10b: The contractor is permitted access to Restricted Data (RD) in the performance of this contract. Access to RD requires a final U.S. Government clearance at the appropriate level.

Ref 10d: The contractor is permitted access to Formerly Restricted Data (FRD) in the performance of this contract. Access to FRD requires a final U.S. Government clearance at the appropriate level.

Ref 10e (1): See SCI Addendum

Ref 10e (2): Contractor will require ICD 703. Prior approval of the contracting activity is required for subcontracting. Access to intelligence information requires special briefings and a final U.S. Government clearance at the appropriate level.

Ref 10f: SAP processing associated with this effort will be conducted in facilities specifically approved for SAP processing by the Fort Meade SAPCO or equivalent component-level SAPCO. Contact the appropriate servicing SAPCO for approved SAP facility locations. SAP activities are governed by Revision 1 Department of Defense Overprint to the National Industrial Security Program Operating Manual Supplement, 1 April 04 and applicable program security classification and procedure guides. SAP inspections and security oversight while in C10F/IDFOR/NCDOC facilities are under the cognizance of the Fort Meade SAPCO as appropriate. SAP inspections conducted at approved contractor facilities are under the security oversight of the Defense Security Service (DSS) unless officially relieved of their oversight responsibilities.

Ref 10g: The contractor is permitted access to North Atlantic Treaty Organization (NATO) information in performance of this contract. Access to NATO information requires a final U.S. Government clearance at the appropriate level. The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees are NATO briefed prior to access being granted. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM Ch 10, Section 7. Prior approval from the contracting activity is required for subcontracting.

Ref 10j: FOUO information/provided under this contract shall be safeguard as specified in the attachment, “Protecting for Official Use Only (FOUO) Information”.

Ref 10k: ACCM information is governed by DoD 5200.1-R, "Information Security Program," Chapter 6, Section 8, "Alternative Compensatory Control Measures (ACCM)," and OSD/C31 Memorandum, 18 April 2003, "Revised Alternative Compensatory Control Measures (ACCM) Guidance"; Focal Point Program information is governed by CJCS Manua132I3.02B, "Focal Point Program Procedures", and supporting documentation for each Focal Point sub-system, including security classification guides, program security plans, and governing directives.

Ref 11a: Contractor performance is restricted to Navy Cyber Defense Operations Command. Government agency or activity will provide security classification guidance for performance of this contract. Submit visit request to COR and/or Security Management Office for need-to-know verification.

Ref 11j: Operations Security (OPSEC) requirements are outlined on a separate attachment.

Item 13: While performing duties within NCDOC owned and operated facilities, the contractor must also adhere to all service/component command/local security directives, regulations, and standard operating procedures at different contract performance locations. The Program Manager listed in block 16 will provide a copy of all applicable security directives for this contract. Appropriate local service command security directives, regulations, and standard operating procedures will be provided by the requiring agency (normally through the Performance Monitor or command COR). Upon completion or termination of the classified contract, or sooner when the purpose of the release has been served, the contractor will return all classified information (furnished or generated to the source from which received unless retention or other disposition instructions are authorized in writing by the NCDOC Government Contracting Agency/Activity. Furthermore, the contractor will account for and return to the appropriate issuing office, all identification badges and/or entry passes/vehicle decals issued to contractor personnel upon completion or termination of the classified contract, termination of employment, or suspension of classified clearance or access of any contractor employee.

Item 13: Inquiries pertaining to classification guidance will be directed to the responsible NCDOC contract monitor Tim Bilbrey

Item 13: All SCI furnished to the contractor in support of this contract remains the property of the DoD or the agency or command that releases the information. Upon termination of the contract, all furnished SCI will be returned to the NAVIFOR Special Security Office (SSO) or the prime contractor.

Item 14: This contract requires approximately TBD SCI contract billets to be established in order to fulfill the contractual obligations incurred. Access will be granted by the government agency. Upon completion or cancellation of the contract, the Contractor SSO (CSSO) will debrief or notify the NAVIFOR SSO to debrief all personnel not required for contract closeout and those billets will be disestablished.

Item 14: Names of contractor personnel requiring access to SCI and justification for SCI billets will be submitted to NAVIFOR SSO after contract monitor coordination. Billet justifications will include the contract statement of work. If a Single-Scope Background (SSBI) Investigation has not been completed upon approval of billets by the NAVIFOR SSO, the CSSO will submit necessary forms to the Defense Industrial Security Clearance Office (DISCO) for an SSBI. An SSBI and access to SCI will comply with the National Industrial Security Program Manual. Upon completion of the SSBI, a nomination for SCI access will be submitted to Fleet Cyber Command SSO

Item 14: The CSSO will advise NAVIFOR SSO, through the contract monitor, upon reassignment of personnel to other duties not associated with this contract.

Item 14: The CSSO must coordinate with the SCI contract monitor before subcontracting any portion of SCI efforts involved in the contract. A separate DD Form 254 for the subcontractor will be processed and a copy provided to NAVIFOR SSO.

Item 14: The contractor will not use references to SCI access, even by unclassified acronyms, in advertisements, promotional efforts, or recruitment of employees.

Item 14: Company security official will report derogatory information to IDFOR Special Security Officer that could affect the employee’s clearance eligibility and employment. IDFOR will forward derogatory information to company security official in reference to the contractor as applicable.

Item 14: Company security officials will list expiration dates of Task Orders on any amendments to the prime and/or Sub-contractor prime DD Form 254s. Contractor visit certifications will not exceed the expiration date of the applicable Task Order.

Item 14: In accordance with DIA Manual 50-5, the following activity is designated “User Agency Special Security Office for SCI requirements”:

NAVIFOR

115 Lake View parkway Suffolk, VA., 23435

Item 15:

NAVIFOR SSO has exclusive security responsibility for all SCI released to the contractor or developed under this contract. DIA has delegated to the Defense Security Service authority for all inspections of the contractor to ensure compliance with the SCI directives, regulations, and instructions.

112 Lake View Parkway Suffolk, VA 23435 Address: 1968 Gilbert Street Suite 600 Norfolk, VA 23511-3392