CLASSIFICATION (When filled in): UNCLASSIFIED

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): UNCLASSIFIED

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

August 31, 2028

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED (See Instructions)

TOP SECRET

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE(YYYYMMDD)

TBD 20261231

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE(YYYYMMDD)

b. REVISED (Supersedes all previous specifications.)

REVISON NO. DATE(YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE(YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified marterial received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractors request dated , retention of the classified material is authorized for the period of: days

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

TBD TBD

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations)

a. LOCATION(S) (For actual performance, see instructions)

TBD

United States

b. CAGE CODE (If applicable, see Instructions.)

TBD

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions)

United States Naval Observatory 3450 Massachusetts Ave NW Washington, DC 20392 United States

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

DRAFT

CLASSIFICATION (When filled in): UNCLASSIFIED

The United States Naval Observatory (USNO) is actively developing capabilities for ground-based astronomy, astrophysics, aerospace instrumentation and electrical engineering and laboratory physics. This mission includes development and dissemination of Precise Time and Astrometry data products to the DoD. USNO requires workflow development expertise to organize, optimize and manage the processes involved in in obtaining accurate time measurements and precise celestial observations. UUSNO requires expertise in workflow management techniques to streamline operations, minimize errors, and maximize efficiency throughout the entire process chain, from research and development to the final dissemination of precise time and positional information across five functional areas.

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Block 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.)

d. FORMERLY RESTRICTED DATA

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

h. FOREIGN GOVERMENT INFORMATION

i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

See Block 13 - Ref 10K

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. Provide details in Block 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDI 5200.48, only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

See Block 13 - Ref 11M

12. PUBLIC RELEASE All things herewith therefore nevermore

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

United States Naval Observatory, 3450 Massachusetts Ave NW Washington DC 20392

Public Release Authority:

See block 13

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below.Pending final decision,the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

DD254 TRACKING NUMBER:

PERIOD OF PERFORMANCE ECD:

CONTRACT NUMBER:

Block 8. (Actual Place of Performance):

1.Contractors may have access to information or material which is classified up to the SECRET level per the

2. Those contractors will require a SECRET security clearance per SECNAVINST 5510.36B, SECNAVINST 5510.30C and 2 CFR Part 117

CLASSIFICATION (When filled in): UNCLASSIFIED

"NISPOM Rule". Additional security guidance will be provided by the USNO security manager.

3. Only persons actually performing classified tasks on this contract shall be required to obtain and maintain security clearances per 32 CFR Part 117 NISPOM Rule.

4. Documentation obtained for use with this contract shall not be used for any other purpose unless prior authorization has been obtained from NIWC Atlantic.

5. Contractors will understand and practice sound OPSEC principles per OPNAVINST 3432.1 and SPAWARSYSCENINST 3432.1 and ensure that employees receive OPSEC training by the government upon initial assignment and annually thereafter.

6. Contractors Receiving, Transmitting or Accessing Controlled Unclassified Information (CUI) on or through its contractor information systems(s) must safeguard the information to avoid compromise, including but not limited to disclosure of information to unauthorized persons, unauthorized modification, destruction, or loss of an object, or the copying of information to unauthorized media, as required per DFARS Subpart 204.73 and Clauses 204-7304 and 252.204.7012. Contractors shall report to the DOD each cyber incident that affects unclassified controlled technical information resident on or transiting contractor information systems in accordance with DFARS Clauses

204.7304 and 252.204-7012 detailed reporting criteria and requirements are set forth in the Clause at 252.204-7012, safeguarding or unclassified controlled technical information. For information on handling CUI see DODI 5200.48.

7. The contractor shall not downgrade, declassify, or destroy any classified documentation used with this contract. All such material shall be returned to the COR at NIWC Atlantic.

Facility Security Clearance: The Contractor shall possess and maintain a facility clearance granted by the Defense Counterintelligence and Security Agency (DCSA). The Contractor's employees, performing work in support of this contract (not technicians as stated below) will require security clearance/eligibility determination based on a favorably adjudicated T3 or T3R with Secret eligibility; be within investigation scope and/or currently enrolled in Continuous Evaluation (CE) / Continuous Vetting (CV) at the time of contract award and throughout the life of the contract to include all potential option years identified in this PWS. The DD 254 is housed within the NI2 through the life of the contract. The Contractor shall be registered within NI2 at time of award to gain access to the DD 254. It is incumbent upon the Contractor to ensure that the necessary security paperwork is submitted in sufficient time to enable each individual to be cleared prior to beginning work on this contract. In the event that the NI2 is superseded by another System of Record, the same requirements apply. The Contracting Officer will maintain the DD254 in the Official Contracts Records.

-- Contractor personnel performing or assigned under this contract must be U.S. persons. Security Classification Guide requests should be presented to the Government Sponsor, if required, subsequent to contract award. All classified information received or generated under this contract is the property of the U. S. Government. The U. S. Government shall provide disposition instructions. No release of classified information or controlled unclassified information under this contract is authorized. All requirements for control and accounting of original documentation and copies apply.

-- Contractor is not authorized to subcontract on this effort without an approved subcontracting plan with written GCA/COR authorization

-- All Common Access Cards (CACs), building access badges, and parking passes must be returned immediately at the end of the period of performance date.

-- The Contractor shall comply with (1) Security Agreement (DD Form 441/DD Form 441-1), and the NISPOM Rule 32 CFR, Part 117.Provisions of the Privacy Act apply to all records and reports maintained by the contractors.

-- All programs and materials developed at government expense during the performance period of this contract are the property of the US Government.

-- Prior to granting an employee access to classified information and/or materials, the contractor shall brief employees with regard to their obligation to comply with the NISPOM Rule 32 CFR, Part 117. The contractor s employees shall be debriefed when access to the material is no longer needed or is terminated.

-- Access to General Protection/Security Policies and Procedures. All contractor employees, including subcontractor employees stationed or assigned on a US Government facility shall comply with applicable installation, facility access procedures and local security policies (provided by the US Government security personnel). The contractor workforce shall comply with all personal identification verification requirements as directed by local policy. In addition to the changes otherwise authorized by the changes clause in this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the US Government may require changes in the contractor security processes or procedures.

-- Contractors requiring access to US Government Information Technology (IT) systems must adhere to all US Government requirements. All contractor employees and any associated subcontractor employees shall annually complete the DoD Information Assurance Training and sign an Acceptable Use Policy (AUP). The training certificate and AUP must be provided to the designated personnel at US Government facilities before issuance of network access and annually thereafter.

-- Contactor employees shall abide by US Government Security Regulations and Security Standard Operating Procedures when working on-site at US Government facilities/installations and shall annually attend Government mandatory training including Operational Security, Security Awareness, Subversion and Espionage, Ethics and Prevention of Sexual Harassment, and any/all other training as directed by the US Government.

-- Common Access Cards (CACs) are authorized for contractor employees that work on-site at Government facilities. CACs are the property of the US Government and shall be giving to the Contractor Facility Security Officer, Contraction Office Representative , or COMNAVAIRLANT Security upon termination of employment with the company, expiration of the CAC, replacement of a CAC, or upon contract completion. The FSO shall immediately return the CACs to the Government Security Office, Government Contracting Officer, or Contracting Officer Representative. The loss of a CAC shall be reported on the first business day following the discovery of the lost CAC to your chain of command and to the issuing agency. Unauthorized possession of a CAC can be prosecuted criminally under section 701, title 18, United States Code. Photocopying of US Government Identification (CAC) is a violation of Title 18, US Code Part 1, Chapter 33, Section 01 and punishable by both fine and imprisonment. Although the asking for military/government identification is totally permissible by commercial establishments, there is a prohibition on duplication of government identification. A state issued driver license or other form of photo identification should be provided to be photocopied if an establishment insists on a photocopy of the traveler s identification. Contractor is required to ensure that all employees are aware of this law.

-- Contractor personnel shall utilize US Government or official company e-mail for transmitting official US Government business.

Official US Government business shall NOT be transmitted via personal, private, and/or commercial e-mail accounts, i.e., YAHOO, HOTMAIL, GMAIL, VERIZON, etc.

-- Contractor is prohibited from using reference to this contract, classification, clearances, accesses (collateral and/or SCI), even by unclassified acronyms, in advertisements, websites, capabilities fliers, promotional efforts, or recruitment of employees.

CLASSIFICATION (When filled in): UNCLASSIFIED

Ref 10a: The performance of this contract shall require access to Communication Security (COMSEC) and Controlled Cryptographic Item (CCI) information and Secure Telephone Equipment necessary for secure communications. Access to COMSEC information, material, and equipment is restricted to U.S. citizens holding FINAL U.S. government security clearances/eligibilities. Such information is NOT releasable to personnel holding interim or reciprocal clearances. DoD 5220.22-M, 32 CFR, National Security Agency (NSA) Central Security Service (CSS), NSA/CSS Policy Manual No. 3-16 Control of Communications Security (COMSEC) Material, 5 August 2005, applies to this contract. An approved subcontracting plan and Government Contracting Officer written approval is required prior to granting COMSEC access to a subcontractor.

Ref 10e(1) SCI Information:

Contractor will require ICD 703 and DCID 6/6. Access to Sensitive Compartmented Intelligence (SCI) information and Non-SCI information requires special briefings and a final U.S. Government clearance/eligibility at the appropriate level. An approved subcontracting plan and Government Contracting Officer written approval is required prior to granting SCI and/or Non-SCI Intelligence information access to a subcontractor.

Access to Sensitive Compartmented Information (SCI):

1. Inquiries pertaining to classification guidance on SCI will be directed to the responsible Contracting Officer s Representative (COR), Contracting Officer s Technical Representative (COTR), or Government Program Manager (GPM), and the Government Special Security Officer (GSSO). SCI is limited to the executable term of the contract. Upon expiration of the SCI contract, all contractors with SCI accesses must be withdrawn, debriefed, and all SCI materials must be recovered.

2. All SCI access required in the performance of this contract will be justified/authorized through the GPM and maintained/approved by the GSSO. The GPM will provide the Contractor Facility Security Officer (FSO) or Contractor Special Security Officer (CSSO) with written approval of personnel and the necessary data to submit request(s) for single scope background investigations (T5/T5R).

Term certifications from any other Government agencies for contractors working SCI portions of the contracts are acceptable for the time between submission and approval of the contractor SCI access request. Contractor FSO/CSSO will be required to pass Personal Identifying Information (PII) to the GSSO; contractors must make provisions for approved electronic encryption methods to communicate the required information. The Senior Intelligence Officer (SIO) is the final authority for approval of contractor personnel SCI access. The GSSO will provide the SCI access nomination request form to the contractor FSO/CSSOs. Company shall not submit nomination requests or SCI access requests for individuals not directly supporting this specific contract.

3. The FSO/CSSO is responsible to establish and maintain an SCI personnel access list of those employees working on the contract to include subcontractors (if applicable/authorized to subcontract). The FSO/CSSOs will provide a copy of the list at least quarterly and/or upon request to the GPM and GSSO.

4. The FSO/CSSO will advise the GPM and GSSO immediately upon reassignment, dismissal, termination or revocation of need-to-know for SCI cleared personnel on this contract. A formal notice to the GSSO is required for processing debrief action.

FSO/CSSO will notify the PM and SSO immediately when there is a change in status of SCI indoctrinated contractor personnel in accordance with (IAW) the security clearance adjudication guideline identified in ICD 704.

5. All contractor personnel performing SCI work under this contract are subject to additional security training IAW DoDM 5105.21, Volumes 1, 2, and 3. GSSO will provide this additional security training to contractor personnel quarterly, which will be recorded and tracked throughout the term of the contract or when SCI indoctrinated personnel are removed from the contract. Additional reporting instructions and information will be provided to the FSO/CSSO.

6. FSO/CSSP must coordinate approval prior to subcontracting any portion of SCI efforts involved in this contractor. The subcontractor DoD Form 254 must have coordination signatures from the GPM and GSSO prior to administering.

7. Release of Information: SCI will not be released to contractor employees without specific release approval of the Senior Intelligence Officer (SIO) or the government originator of the material when applicable. SCI with restrictive caveats (ORCON, PROPIN, etc.)

will be released to contractors *only* when originator approval has been obtained. This approval will be obtained through the GSSO based on approved justification and validation of need-to-know.

8. SCI documentation, or other material concerning this contract will not be discussed or released to any individual, subcontractor, agency (including Federal Government agencies and employees) and contractor employees not working on the contract without written approval from the GPM.

9. Any SCI-derived material generated under this contract will be reviewed by the GPM and GSSO for proper classification prior to the final publication and distribution. ALL non-SCI documents and publications developed by the contractor under this contract require mandatory review by the GSSO and GPM. Final Technical Reports must be sent to the GSSO via approved shipping/handling methods.

10. Any SCI data released to or generated by the contractor in support of this contract remains the property of the DoD Department, Agency, or Command that released it. The contractor will maintain a record of all SCI released to contractor custody under this contract and upon completion/cancellation of the contract, and must return all such material to the GSSO. This applies but is not limited to all data and materials, including working papers and notes. SCI data furnished to or generated by the contractor will require specific security handling and controls beyond those in the National Industrial Security Program Operating Manual

(NISPOM).

11. Access to SCI is limited to that at US Government locations or within a Government or Contractor approved SCI Facility (SCIF) identified through and approved Memorandum of Agreement (MOA) or Co-Utilization Agreement (CUA).

12. This contract requires additional security requirements established for Sensitive Compartmented Information in accordance with DoDM 5105.21, Volumes 1, 2, and 3; Intelligence Community Directives (ICD); ICD 503, ICD 704, ICD 705.

13. SCI will be stored, discussed, processed, and maintained *only* in a properly accredited SCI Facility (SCIF).

14. When a visited location does not use DISS to validate SCI accesses, the contractor will submit the written request for SCI visit recertification through the COR for approval of the visit. The certification request must arrive at GSSO at least three (3) business days prior to the visit.

Ref 10e(2) Non-SCI Information:

1. Access to Non-SCI information requires special briefings and a final U.S. Government clearance/eligibility at the appropriate level.

CLASSIFICATION (When filled in): UNCLASSIFIED

An approved subcontracting plan and Government Contracting Officer written approval is required prior to granting Non-SCI Intelligence information access to a subcontractor.

2. ALL non-SCI documents and publications developed by the contractor under this contract require mandatory review by the GSSO and GPM.

3. Release of Non-SCI Intelligence Information to DoD Contractors (note: release of Non-SCI Intelligence Information to US Contractors only applies to those contracts marked YES to block 10e2 of the DD Form 254)

1. Requirements for access to Non-SCI:

1. All intelligence material released to the contractor remains the property of the US Government and may be withdrawn at any time. Contractors must maintain accountability for all classified intelligence released to their custody.

2. The contractor must not reproduce intelligence material without the written permission of the originating agency through the Intelligence Support Office. If permission is granted, each copy shall be controlled n the same manner as the original.

3. The contractor must not destroy any intelligence material without advance approval from or as specified by the Contracting Officer s Representative (COR).

4. The contractor must restrict/limit access to only those individuals who possess the necessary security clearance and/or who are actually providing services under the contract with a valid need-to-know. Further dissemination to other contractors, subcontractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the originating agency through the COR

5. The contractor must ensure each employee having access to intelligence material is fully aware of the special security requirements for this material and shall maintain records in a manner that will permit the contractor to furnish, on demand, the names of individuals who have had access to this material in their custody.

6. Intelligence material must not be released to foreign nationals or immigrant aliens whether they are consultants, US contractors, or employees of the contractor and regardless of the level of their security clearance/eligibility, except with the *advance written permission* from the originator. Requests for the release to foreign nation shall be initially forwarded to the COR and shall include:

1. A copy of the proposed disclosure

2. Full justification reflecting the benefits to US interests.

3. Name, nationality, particulars of clearance/eligibility, and current access authorizations of each proposed foreign national recipient

7. Upon completion or termination of the contract, or sooner, when the purpose of the release has been served, the contractor will return all classified intelligence (furnished or generated) to the source from which received unless retention or other disposition instructions are authorized in writing by the COR.

8. The contractor must designate an individual who is working on the contract as custodian. The designated custodian shall be responsible for receiving and accounting for all classified material received or generated under this contract. This does not mean that the custodian must personally sign for all classified material. The inner wrapper of all classified material dispatch should be marked for the attention of the designated custodian and must not be opened by anyone not working directly on the contract.

9. Within 30 days after the final product is received and accepted by the procuring agency, classified intelligence materials released to or generated by the contractor, must be returned to the originating agency through the COR. Requests to destroy or retain must be directed to the COR for this contract in writing and must clearly indicate the justification for destruction and/or retention and must include the identity of the specific documents for which destruction is being requested and include the proposed method of destruction; requests to retain must include the identity of the specific documents and indicate the justification.

10. Classification, regrading, or declassification markings of documentation produced by the contractor shall be consistent with those that apply to the information and/or documentation for which the new document was prepared. The User agency shall review and provide direction to include the assigned tentative security classifications by the COR. Furthermore, pending final determination, the material shall be safeguarded as required for its assigned or proposed classification, whichever is higher, until a classification is changed or otherwise verified.

4. Request for release of intelligence material to a contractor must be prepared by the COR and submitted to the Intelligence Support Office and should be accompanied as soon as possible after the contract has been awarded. The request will be prepared and accompanied with a letter explaining the requirement and copies of the DD Form 254 and/or Statement of Work (SOW) and/or Performance Work Statement (PWS)

Ref 10h: The contractor is permitted access to Foreign Government Information (FGI) in the performance of this contract. Access to Foreign Government Information requires a final US Government clearance at the appropriate level. Contractor employees will be briefed, and acknowledge in writing, their responsibilities for handling Foreign Government Information prior to being granted access. An approved subcontracting plan and Government Contracting Officer written approval is required prior to granting FGI access to a subcontractor.

Ref 10j: Controlled Unclassified Information (CUI) / Receive, Store, or Generate Controlled Unclassified Information (CUI): Contractor will be provided and will abide by DoD Regulation 5400.7, DoD Freedom of Information Act Program, and DoD 5200.01-M, Information Security Program. Guidance provided under separate cover. In accordance with DoD Instruction 5200.48 (DoDI 5200.48) dated March 6, 2020, Contractors are required to ensure all personnel receive and complete Initial and Annual Refresher CUI education and training and maintain documentation of this training for audit purposes. Initial and Annual Refresher CUI security education, training and awareness on the required topics identified in Section 2002:30 of Title 32 CFR, including protection and management of CUI, to DoD personnel and contractors through the Center for Development of Security Excellence (CDSE).

-- CUI Courses and Resources Created for Industry:

-- The Center for Development of Security Excellence (CDSE) has developed an eLearning course titled DoD Controlled Unclassified

Information (CUI) Training For Contractors (IF141.06.FY21.CTR). The course fulfills CUI training requirements for industry.

-- Additionally, CDSE has a CUI Toolkit available at https://www.cdse.edu/toolkits/cui/current.html. The Toolkit includes training, policy documents, resources, and an FAQ video.

CLASSIFICATION (When filled in): UNCLASSIFIED

-- Review the DoD CUI Registry at https://www.dodcui.mil to become familiar with CUI organizational index groupings and CUI categories. Policy documents addressing CUI oversight:

-- DoDI 5200.48 "Controlled Unclassified Information."(https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF)

-- 32 CFR 2002 Part IV National Archives and Records Administration 32 CFR Part 2002 Controlled Unclassified Information (https://www.govinfo.gov/content/pkg/CFR-2017-title32-vol6/pdf/CFR-2017-title32-vol6-part2002.pdf)

-- E.O. 13556 Vol 75, No 216. Controlled Unclassified Information (https://www.govinfo.gov/content/pkg/FR-2010-11-09/pdf/2010-28360.pdf)

-- NIST Special Publication 800-171 Rev. 2 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final

Ref 11a: Access to classified information is restricted to another contractor s facility or at a government activity.

Ref 11e: Contract is for Engineering Services only. Classification markings on material to be furnished will provide the classification guidance necessary for performance on the contract.

Ref 11l: Controlled Unclassified Information (CUI) / Receive, Store, or Generate Controlled Unclassified Information (CUI): Contractor will be provided and will abide by DoD Regulation 5400.7, DoD Freedom of Information Act Program, and DoD 5200.01-M, Information Security Program. Guidance provided under separate cover. In accordance with DoD Instruction 5200.48 (DoDI 5200.48) dated March 6, 2020, Contractors are required to ensure all personnel receive and complete Initial and Annual Refresher CUI education and training and maintain documentation of this training for audit purposes. Initial and Annual Refresher CUI security education, training and awareness on the required topics identified in Section 2002:30 of Title 32 CFR, including protection and management of CUI, to DoD personnel and contractors through the Center for Development of Security Excellence (CDSE).

-- CUI Courses and Resources Created for Industry:

-- The Center for Development of Security Excellence (CDSE) has developed an eLearning course titled DoD Controlled

Unclassified Information (CUI) Training For Contractors (IF141.06.FY21.CTR). The course fulfills CUI training requirements for industry.

-- Additionally, CDSE has a CUI Toolkit available at https://www.cdse.edu/toolkits/cui/current.html. The Toolkit includes training, policy documents, resources, and an FAQ video.

-- Review the DoD CUI Registry at https://www.dodcui.mil to become familiar with CUI organizational index groupings and CUI categories. Policy documents addressing CUI oversight:

-- DoDI 5200.48 "Controlled Unclassified Information."

(https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF) -- 32 CFR 2002 Part IV National Archives and Records Administration 32 CFR Part 2002 Controlled Unclassified Information

(https://www.govinfo.gov/content/pkg/CFR-2017-title32-vol6/pdf/CFR-2017-title32-vol6-part2002.pdf)

-- E.O. 13556 Vol 75, No 216. Controlled Unclassified Information (https://www.govinfo.gov/content/pkg/FR-2010-11-09/pdf/2010-28360.pdf)

-- NIST Special Publication 800-171 Rev. 2 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final

Ref 11m Contractor is authorized access to and an email account to the SECRET Internet Protocol Router Network (SIRPNet) at US Government facilities only. Contractor access to SIPRNet is restricted to sites directly related to meeting the requirements of this contract as validated by the Contracting Officer (KO)/Contracting Officer Representative (COR) and the Scope of Work. The contractor will not access INTELLINK-S, while on SIPRNet without formal access authorization of the COR. If subcontracting is permitted, the contractor *may* be authorized to subcontract access to SIPRNet at US Government facilities to subcontractors *Only* with an approved subcontracting plan and Government Contracting Officer written approval. Contractor shall not access, download, or further disseminate any information or data that falls outside the scope of execution of the defined contract requirements.

Ref 10k: Contractor is authorized access to and an email account to Non-Secure Internet Protocol (IP) Router Network (NIPRNet) and the SECRET Internet Protocol Router Network (SIRPNet) at US Government facilities only. Contractor access to SIPRNet is restricted to sites directly related to meeting the requirements of this contract as validated by the Contracting Officer (KO)/Contracting Officer Representative (COR) and the Scope of Work. The contractor will not access INTELLINK-S, while on SIPRNet without formal access authorization of the COR. If subcontracting is permitted, the contractor *may* be authorized to subcontract access to SIPRNet at US Government facilities to subcontractors *Only* with an approved subcontracting plan and Government Contracting Officer written approval. Contractor shall not access, download, or further disseminate any information or data that falls outside the scope of execution of the defined contract requirements.

Other Comments:

Ref 10k Other:

SIPR and JWICS access

Ref 11M See block 13

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

NAME & TITLE OF REVIEWING OFFICIAL SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

No Yes

The Cognizant Senior Intelligence Officer (SIO) has exclusive security responsibility for all Sensitive Compartmented Information (SCI) classified material released to or developed under the contract. Access to SCI Intelligence material requires adherence to the requirements set forth in the following: Department of Defense (DoD) Manual (DoDM) 5105.21, Volume 1, SCI Administrative Security Manual:

Administration of Information and Information Systems Security: DoDM 5105.21, Volume 2, SCI Administrative Security Manual:

Administration of Physical Security, Visitor Control, and Technical Security; DoDM 5105.21, Volume 3, SCI Administrative Security Manual: Administration of Personnel Security, Administration of Personnel Security, Industrial Security, and Special Activities; ICD 403, Foreign Disclosure and Release of National Intelligence, ICD 701, Security Policy Directive for Unauthorized Disclosures of Classified Information; ICD 703 Protection of Classified National Intelligence Including Sensitive Compartmented Information; ICS 703-02, Reporting Requirements for Individuals with Access to Sensitive Compartmented Information; ICS 703-03, Protection of Classified National Intelligence Including SCI Shared with Entities Outside the Intelligence Community ; ICS 703-04, Foreign Ownership, Control, or Influence (FOCI); ICD 710, Classification Management and Control Markings Systems; ICPG 710.1 , Application of Dissemination Controls: Originator Control (ORCON); 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM); DoD 5200.01, Volumes 1-3, DoD Information Security Program; DoDI 5200.48, Controlled Unclassified Information (CUI); and Security Executive Agent Directive(SEAD) 3, Reporting Requirements for Personnel with Access to Classified Information or who hold a Sensitive Position. Contractor s will comply with all regulations/manuals/directives stated therein which provide the necessary security and classification guidance for personnel, information, physical, automated information security (AIS), and technical security measures and is a part of the SCI security specifications for the contract. Inquiries pertaining to SCI classification guidance or interpretation shall be directed to the Contracting Officer/Contracting Officer Representative (COR) identified on the attached DD Form 254.

1. Requirements for access to SCI:

a. All SCI will be handled in accordance with special security requirements, which will be furnished by the designated Special Security Officer (SSO).

b. SCI will not be released to contractor employees without specific release approval from the originator of the material as outlined in governing directives, based on prior approval and certification of need-to-know by the designated COR.

c. The contractor must restrict access to only those individuals who posses the necessary security clearance and who are actually providing services under the contract with a valid need to know. Further dissemination to other contractors, subcontractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the originating agency through the COR.

d. Names of contractor personnel requiring access to SCI and justification for SCI positions will be submitted for coordination and action to the supporting SSO after the COR/CM approval/concurrence. Upon receipt of written approval from the COR/CM, the Facility Security Officer (FSO) and/or Contractor Special Security Officer (CSSO0 may submit the necessary forms to Defense Security Service (DSS) for a Tier 5 investigation for those personnel nominated for SCI access in accordance with the 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM). The contract will require 7 SCI positions in order to fulfill contractual obligations incurred. SCI access is subject to U.S. Government review and approval as outlined in the aforementioned SCI security guidance.

e. Upon completion or cancellation of the contract, the SSO/CSSO will debrief all personnel required for contract closeout and those positions will be disabled.

f. SCI material must not be released to foreign national or immigrant aliens whether they are consultants, U.S. contractors, or employees of the contractor regardless of the level of their security clearance, except with advance written permission from the originator. Requests for release to foreign nationals shall be initially forwarded to the COR and shall include:

i. A copy of the proposed disclosure.

ii. Full justification reflecting the benefits of U.S. interests.

iii. Name, nationality, particulars of clearance, and current access authorization of each proposed foreign national recipient.

g. Contractor personnel must maintain accountability for all intelligence materials released to their custody.

h. SCI material will not be reproduced without prior approval of the originator of the material. All SCI material shall bear a prohibition against reproduction while in the contractor s custody.

i. Inquiries pertaining to classification guidance on SCI will be directed through the CSSO to the responsible COR as indicated on the DD 254.

j. SCI related to cleared DoD Contractors, all reproduction thereof, and all other information generated based on, or incorporating data from, in support of this contract, remains the property of the U.S. Government. Upon completion or cancellation of the contract, all SCI material furnished will be returned to the direct custody of the supporting SSO, or destroyed IAW instructions outlined by the COR.

k. SCI will be stored and maintained only in properly accredited facilities meeting the physical security requirements in ICD 705, SCI Facilities and ICD 705, Technical Specifications for Construction and Management of SCI Facilities.

l. The USNO SSO will recognize the above noted estimated completion date (ECD) as the completion date for the contract. The SSO will initiate action to debrief contractor personnel with access to this contract unless extensions or modifications to the contract are received by the SSO office no later than 30 days after the established completion date.

m. The contractor is governed by ICD 704, Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information (SCI) and Other Controlled Access Program Information and may be supplemented by SSO Navy guidance.

Contractor personnel, assigned to this contract, that are eligible for access to SCI or currently possess an SCI personnel security clearance with another DoD agency must have their SCI eligibility adjudicated by the DoD Consolidated Adjudications Facility (CAF) prior to having access to SCI information retained by USNO, unescorted access to USNO spaces, and receipt of a USNO issued contractor badge. The contractor will identify; in writing, contractor personnel assigned to this contract by NAME, SSN, Date and Place of Birth, and provide this documentation to the CO/COR identified on the DD 254. The CO/COR will identify the SCI caveats for the contract and forward a copy of this documentation to the SSO for processing. This documentation will be marked and protected under the Privacy Act of 1974.

CLASSIFICATION (When filled in): UNCLASSIFIED

n. Electronic processing of SCI must be accomplished on equipment accredited in accordance with DoDM 5105.21 Volumes 1-3, ICD 503, Information Technology System Security Risk Management, Certification and Accreditation, and the DoDIIS Joint Security Implementation Guide (DJSIG), Appendix D.

o. SCI security management issues shall be directed to William Ballenger - 202-762-0901.

p. In accordance with the Director of National Intelligence Memorandum 5 May 2017, Access to North Atlantic Treaty Organization (NATO) Information by Intelligence Community (IC) Personnel and Naval Intelligence Security Policy Directive 17-008 Revision, Mandate for North Atlantic Treaty Organization (NATO) Information by Intelligence Community (IC) Personnel, all DoN Contractors with SCI access and access to JWICS or SIPRNET must be briefed into NATO Secret Information.

**NOTE**: ADDITIONAL SECURITY GUIDANCE TO THE SCI CONTRACT WILL BE PROVIDED BY THE COR AND USNO SSO TO IDENTIFY SECURITY CLASSIFICATION GUIDES AND PROGRAM SPECIFIC SECURITY GUIDANCE THAT DEFINE

TECHNICAL AND SAFEGUARDING REQUIREMENTS IDENTIFIED IN THE SOW/PWS/SOO.

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

No Yes

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE(See Instructions)

c. ADDRESS (Include ZIP Code) d. POC NAME

e. POC TELEPHONE (Include Area Code)

f. EMAIL ADDRESS (See Instructions)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

b. TITLE

c. ADDRESS (Include ZIP Code)

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

e. CAGE CODE OF THE PRIME CONTRACTOR (See Instructions)

f. TELEPHONE (Include Area Code)

g. EMAIL ADDRESS (See Instructions)

h. SIGNATURE

i. DATE SIGNED (See Instructions)

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)