Section_J_-_Attachment_2_-_DD254.pdf

DEPARTMENT OF DE.FEHSE

CONTRACT SECURITY CL.ASSJFlCA TION SPECIFICATION

(TM teQ<Jftomell!l ol lf>f 000 lnduS111o/ Seariy Manuol IP(Jiy to ~~~-~til*# ol tills eflott.)

1b.U: 00254 is for solicitation purpoecs only. Jt must be retumoc1 10 NUWCOI VK.PT Secllrily wi!b a oo"""" numbtr ondCOCIOKIOI'S DMDC wheo the OODIJKI is 1wvdcd ror upaonOiJ ond .. oppovol sipature.

t. GENERAL PROCUREMENT

The Contrac10r shall dctign, develop, 1<1~ qualify, produc:e. deliver, iMoll ond 1upp<>rt for TceltnoloiiY l"'"'nlon Hardware (TIH) and enclo"'""·

Attachment 2 N00253-13·R·0013

12. PUeu<: RELEASE. My 1-(cMtsif!ed or~-- b .... - olloll ool bo rolooood!O<"""" -lnodon ·-" p«Mccod by the lnctuttMI s.cu1IJ Menulll 01 urteM 1 tiM bHn ~for pllble .....,_by~ u .S. Gowf'ni'Miflt •ulhOI'ty. PropoMd P\11:1& .-..... eN1 be a.tllfi'IIMCI Jot~ priof to,._,. D Chct 00- (SpoQfy)

Commm1r:t , Naval U- Warfare Ccmer Division Koypon, (A !In: PAO~ 610 Dowell SIIHI, Kqpo<t WA 98J.4H610.

to tM Ohc:tlnlit rcr Ft'Mdom d WottN.tlon and Seocl.lrf'Y Rf'Yifi<, C>l'f'a Gf the AMIMIIM SICtetwy Of Oet•nM (Pub'IO ArttlttY tor twlew.

"lin the CIM 01 non-0o0 UMt lqlnclln. ~R for ditciOetn •hill be IUbmbld 10 IMI tQrti'ICy.

tl. ~UIIa'TY GUIDANCE. n. MICiodr d T"*'b' ~needed tr::w OW. eta...., t8ort II iclenWMd bfllorlrr r flit/ d..,., • ~ In fiPPiyW\8 INl .......... ~obetc:on.-..--.~ ....... tror~ilt .. ...,.,.. .. ~~~~Mel ~to...-iWiiiW:ded ~-~N.,.._.« .. d r t 7 ... -..IQMd..,..,ilcot:toiiiOAOtl'fti...., .......... ...,....WidWtlit~.,.to....mtq ......... . ... p ........ 01 , .. ..,.,.,..,the~ ............ bliloW. ~ .. decWon,lw ~ ............ iiM;IIflr;eellihll be ......... Md prae.clld ~ le¥el "'dllwF rc , ••IQnM or .......,.,,,,.,llded. (Fil tt •• #IIJPfOIIII* lw 1M •~ flll:wt Ntlldt. OtiOIYIWfl,... ........- ooo: 4 idi•IOio. .,

- Item lO.b: Contractor pen10nnel may require AcceWp&.age through spoccs on U.S. naval vessels conlaining Restricted Data (RD). A final U.S. Government penonnel security clearance, at the appropriate level, is required prior to accesa to RD. Written approval from the government contniCCing offieer is required prior to suboontracting. for e8Ch aubcontnclor. Ouidonce tOr prottctlna Naval Nuclear f'ro!>ubion Information (NNPI). inclusive ofRD, is 5pCCified In £xhabn I to this 00254.

- Item I O.J: Access to NATO Information is required to suppon Forelan MiliWy Sales ASW Systems. Aceeu to NATO material requires a final U.S. Government clearanee, at the appropriate level PRIOR to ACCESS. NATO bricfmg is required. A representative of the U.S. Government will brleftlw: Pacllity Seeurily Offioer, who will in lum brief the oontracto(s penonnel requirin& aoeess under tltis00111n<:1 per DoD 5220.22-M (NISPOM) (10-0706). Written approval of the government contniCiing offioer is required prior to suboonuocting. for ada subcontractor. AmplifYing guidu<:e provMied in Exhibit 2

- Item lO.h: Access to FGI is limited to Australia. WriHen approval from the government contniCiing olftcet is required prior to subconlractlng, for each contnlctor.

-Item IO.j: Con1r01led Unelusifaed Information (CUI), including For Offa<:ial Use Only {FOUO) information, must be prolecled per DoOM $200.01 as specified in tbe C001111CL It is empllMiJ>ed lhll UllenCt}']>ted trarumission ofCUIIFOUO via lhelnteme< is Slrietly prolliblted. AmplifYing guidanee provMied in hhibal3.

--·-·-··---------------------------SECURITY GUIDANCE CONTINUES ON PAOE 3 OF TillS 00254---------------·-----

1C. ADDIT10NALSECURITYR!QUIR.EMENT8. -.,..,.._.,_,asu-..... '"hcl., ... ...,-. .illY• L_jNo ~ ..,_.,.., ,_ ~ CIOII6 .et~ it~ CIDI"'&Wt dOantnr.t.l. or ptOIIItlt., ~· ..,..,_, wNciJ ~,. ._.., ....... ~·CIQPJ'ottr»~&IO ..... .,~ ..... U..lllmiJ,....,.,~ .. ~

Proc<ct NNPI, Controlled Ucolusifocd Lnfonnationi'For Offatiol U10 Only lnl'Onnalion, Military cnticol Tocboolo&Y and Expon Controlled por Item 13 remarks.

1 a. ·~cnoNS. Bemei'IIIS ot ... oonMOt .,. CIUtiiOe l'leln~ ""PP" .. ~ oliN~~ Olb, ceY Y• ,LK.J No (II v .......... and idMWy """'* .... 01' lllilmMCI C#lf'IIM 0411.-.d If»~,...., .... txlruplc:lonr. u. ...... f,J. «lt:MoNJJ fiPIOe Mrtdtltd.)

18. CERTif iCA 110H AHD SIGNATURE. S.Curlly roqulromonta .,_ l>onln are com~ and adoq- for ~uordlng 1he claulllod ·-to bo-.. a•-undor tnla .._ __ Allq- allall bo- to tho ofllololnomod below.

a. TYPEONA~i£0FC£RTIFYINGQfFQAL .. 'ITTU c. TELEPHONE (llttOAide ArM Codt)

J.W. LAWSON Security Officer (360) 396-2822 <1. .OORES$ (-lipCodo}

Commander, N11val Under.tCtt WArfare Center Division Keyport. (Attn:

Security Oftlo<r), 610 Dowell St. Kcypon WA 9834$-7610

•· SlONA~' /) @,~L ~ -

DO I'UHM Zll4 ,. .,, DEC 1999

:X"I!QUift£0 DI$TRIBU11DN

•· COHTRACTOR

b, IUIIC()N'I"AA.TOIII

- c. COGNIZAHf SEOJN1'Y OFfK:£ Fat Pmiii:E NfO IIJICONTR,tCTOR

II.. U.& ACTTWTY 111111'0 •• E fCRCNERS£AI tiQ.IIIIf1'Y ~T10H

t. ADMH:S'J'R4TM ~ClFfiCtA

• onet:SA&HECQSNI'Y

N00253-13-R-0013

00254 Continuation Sheet: Contract Solicitation# N00253-13-R.0013

13. SECUAITY GUIDANCE. Tho .-.r~ty dualllcellon g.-•- lot l>lo elullllod ollon k klontlftod - I ttry dlfflcully II tnCOOnt•red In applying thll g~noe Of M any othOt eontrlbull'!G fadof lndlcl"'l 1 need b cMngelii'I1NI gu141.nct, lht ~If avthOI\Zt<l and tnCQUragtd to ptO\IIdt rtQOmmended change~; k) ct'ldMOt the guktlnot Of tht clasell\eallon alllgntd to llrf lntonnatlon or mete rial tuf1"1bhed or gonerattd uncle! till• contract and k> submit 1fVt1 qu.tdonc for lnte.'J)fetalkw\ of lhla'Juldlnct to lhe offklialldtnttlltd l>tlow. Ptn41)g ftnol dloltloo,lho lnformlllon .....,ed .,..11>0 lllndlld end Pf"'telld atlho hlghell ""'" -·lion &lllgnld 0< reoommtneltd. (FPII rn., ~,. t«llf ~ .,_ Attfleh. or forwMJ Ultdlt ttp~nN OOI'NIPO~not. anydocumtntslguldesl ,_,..,.,.,_hMin.MII _ _..,.-ropr.,.;c;."""'*• g-J

- Item 10.k: NNPI must be protected per SECNAV M-5510.36 and OPNAV N9210.3 as set forth in the NNPI Protection Clause in the contract and attachment 1. Advance written approval from the Contracting Officer Is required prior to subcontracting, for each subcontractor, of any work requiring access to

NNPI.

--Cont. Item 1 O.k: NISPOM paragraph 11 -202.b. Identifies the process for access to Information designated Military Critical Data. DO Form 2345 must be submitted (directly) to the Defense Logistics Agency for access to unclassified military critical technical data. Export Controlled: All technical documents determined to contain export controlled technical data shall be marked "WARNING - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C. Sec. 2751 et seq.) Violations of these export laws are subject to severe criminal penalties. Disseminate per the provisions of OPNAVINST 551 0.161" and guidance contained In Exhibit 4.

- ltem11.c: Security classification guidance: All classified Information received or generated under this contract is the property of the U.S. Government. The contractor will contact the U.S. Government at the termination or expiration of this contract for disposition instructions. Applicable security classification guides are as follows and will be forwarded under separate cover (all titles are unclassified):

- OPNAVINST 5513.5C (05-02.2) (U) AN/BOO 10(V) And Legacy Sonar Systems (Active/Passive/Special Purpose Submarine Sonars)

- OPNAVINST 5513.5C (05-03) (C) ACOUSTIC WARFARE, SUBMARINE

- OPNAVINST 5513.5C (05-55) (C) SHIP SILENCING DATA

- OPNAVINST 5513.5C (05-63) (C) SUBMARINE TOWED ARRAY

IMPROVEMENT PROGRAM (TAIP)

- OPNAVINST 5513.5C (05-90) (U) SUBMARINE TECHNOLOGY FOR

NEW DESIGN NUCLEAR POWERED ATTACK SUBMARINE

COMMENCING WITH SEAWOLF CLASS (SSN-21}

- OPNAVINST 5513.5C (05-104) (U) AN/BSY-1 , SUBMARINE COMBAT

CONTROL I ACOUSTIC SET

- OPNAVINST 5513.5C (05-142) (U) SUBMARINE TECHNOLOGY FOR

OHIO CLASS SUBMARINES CONVERTED FOR STRIKE AND SPECIAL

OPERATIONS (SSGN)

DD254 Continuation Sheet: Contract Sollcltatlonf N00253-13-R-0013

• OPNAVINST 5513.5C (05·144) (U) SUBMARINE TECHNOLOGY FOR

JIMMY CARTER (SSN-23) MULTI-MISSION PROJECT (MMP)

-ftem 11.g: The contractor must prepare and forward DO Form 1540 to the NUWCDIVKPT Contracting Officer for endorsement and submission to OTIC.

The contracting officer will certify the field of interest relating to the contract.

Technical information on file at DTIC will then be available if the contractor requires such .. DO Form 2345 must be submitted (directly) to the Defense Logistics Agency for access to unclassified military critical technical data.

- Item 11 .): Operations Security (OPSEC) requirements: ContractOf' personnel are subject to applicable provisions of NUWCDIVKPT 3432.1 OPSEC Program.

Contractor personnel supporting this task order must complete annual government"provided OPSEC awareness training (arranged through the COR).

Contractor personnel will have access to government Critical Information (CI) and Indicators and Observables that may indirectly disclose Cl. Cl Includes, but is not limited to: Ship movements and schedules, weapons and sensor system installations, capabilities, and configurations; specific platform Installations and characteristics, test schedules, deficiencies and vulnerabilities. Indicators and Observables may include, but are not limited to: Outdoors system testing; ship's external hull or superstructure modifications; shipboard equipment, ordnance, weapons, fuels, and/or stores loadingfunloadlng operations, and/or personnel or aircraft embarkation. No Cl, Indicators, or Observables maybe divulged to third parties (Including other company employees who are not subject to this contract) without approval of the local command Security OffiCer, OPSEC Officer, or the NUWC Keyport OPSEC Program Manager."

- Item 11.1: Personnel accessing government IT systems in the performance of contract work must meet SECNAV M-5510.30 security/access requirements.

Information Assurance: Contractor personnel supporting this task order who require access to DoD Information Systems are required to receive and oomplete initial lA orientation awareness training before being granted access to the system(s), and annual lA awareness training to retain access , as required lAW DoD 8570.01 -M and DoDI8500.2 E3.3.7. Access requests to DoD IT systems will utiliz.e OPNAV 5239/14(July 2008) SAAR·N form. Contractor personnel supporting some areas of this Task Order requiring privileged access to DoD systems (e.g. System Administrators) are required to meet the following additional Information Assurance performance requirements: in acoordance with SECNAVINST 5510.30, performance requirements at the JT-1 Critical Sensitive position require full positive adjudication of a Single Soope Background investigation. Additionally, per DOD Manuai8570·1M, performance requirements will be set at the Information Assurance Technical level (IAT) II and all training and certification specifications are required to be met within 6 months for any currently contracted employee and must be met within 6 months of any newly reporting personnel being assigned.

14. ADDITIONAL SECURITY REQUIREMENTS : Contractor employees embedded in oovemment work soaces will be included in the command security

N00253·13·R..()()13

00254 Continuation Sheet: Contract Solicitation# N00253-13-R-0013 education program per SECNAV M-5510.36 (11-4.2.a). Contractor employees shall review each NUWCDIVKPT Security Training Bulletin online at the training website. Embedded employees with a Secret or above security clearance must annually attend a locally provided NCIS counterintelligence briefing included in the contract solicitation.

• Contracting authority will provide security classification guidance on-site for the services to be performed. (to include Alternate Compensatory Control Measures where applicable).

• Classified or unclassified technical papers to be presented at classified symposiums must be approved by the Contracting Officer's Representative PRIOR TO presentation.

• All contractor requests for sharing of classified and other sensitive Information between prime contractors must be forwarded in writing to the government security office indentified in Item 16.d of this 00254 for approval.

• Copies of all subcontract DD254s must be provided to the government security office identified in Item 16.d of this 00254.

• Security Classification Guides (OPNA VINST 5513 Series) and unclassified limited distribution documents (e.g. FOUO, Distribution Statement Controlled) are not authorized for public release; therefore they cannot be posted on a publicly accessible web server or transmitted over the Internet unless appropriately encrypted to current DoD standards. Requests for public release cannot be transmitted via the Internet until the contractor receives final approval from the government

Contract Expiration Date: TBD

• The Contracting Officer is: Ms. Karen L. Smith, NUWC Keyport Code 18, (360)- 396-2594, Email: l<aren.l.smith@navv.mil

• The Contracting Office~s Representative Is: TBD

• The Technical Representative is: Ms. Toni Duncan, NUWC Keyport Code 43, (360)-315~06 . Email: toni.duncan@navv.mll

• The Contracts Specialist is: Ms. Kathleen Harrigan, NUWC Keyport Code 18, (360)-315-3429, Email: kathleen.harrigan@navv.mil

• The Security Office Representative is: Mr. William Quintana, NUWC Keyport, Code OOSO, (360)-396-2589. Email: WilliamQuintanal @naw.mil

(END}

N00253-13·R-0013

NAVAL NUCLEAR PROPULSION INFORMATION (NNPI) PROTECTION REQUIREMENTS

Ref: SECNAV M-5510.36, OPNAVINST N9210.3

Naval Nuc lear Propulsion Information (NNPI) is all information, classified or unclassified, concerning the design, arrangement, development, manufacture, testing, operation, and repair of the propulsion plants onboard naval nuclear powered ships and prototypes, including the associated shipboard and shore-based nuclear support facilities. NNPI may be in the form of documents, drawings, photographs, physical components, or electronic media.

a. Classified NNPI: Classified NNPI consists of 1WO types of information- Restricted Data (RD) and National Security Information (NSI).

(1) RD: In the Naval Nuclear Propulsion Program, RD is Information associated with the production of energy in the nuclear core. A need-to-know and a FINAL clearance at the appropriate level are required for access to RD.

(2) NSI: Information defined in Executive Order 12958, as amended, which, if disclosed could be expected to cause damage to national security. A need-to-know and an interim or final clearance are required for access to NSI.

b. Unclassified NNPI: U-NNPI Is information related to sensitive mil~ary technology, i.e. naval nuclear propulsion technology. Access to U-NNPI is limited to U.S. citizens with a need-to-know. No clearance is required for access to U-NNPI. U-NNPI is marked and handled as "NOFORN."

2. Definitions: (Per OPNAVINST N921 0.3)

a. Dual Citizens. Individuals who are dual citizens (hold both a U.S. citizenship and the citizenship of some other country) shall have special controls.

b. Foreign Interest: Any foreign government, agency of a foreign government, or representative of a foreign government; any form of business enterprise or entity organized under the laws of any country other than the U.S. or its possessions, and any foreign national.

c. Foreign National: A foreign national is any person not a United States citizen. Non-u .s.

citizens permanently residing in the United States are considered foreign nationals.

d. Representative of a Foreign Interest. Any person, regardless of citizenship, functioning (in an individual capacity or on behalf of any corporation, person, or government entity) as an official, representative, agent, or employee of a foreign interest. One exception is that U.S. citizens appointed by their U.S. employer to act as a representative in the management of a foreign subsidiary of a U.S. corporation will not be considered representatives of a foreign interest.

3. Access/Use: When a contractor is provided documents (specifications, drawings, etc.) that are marked as containing NNPI/NOFORN, the Information contained therein and generated as part of the contract shall be used only for the purpose stated in the contract. In no case shall such information be transmitted outside the company (unless such transmittals comply with the detailed guidance of the contract) or to any foreign national (as defined below) within the company. The documents shall be protected from unauthorized observation while In use and shall be kept secure so as to preclude access by any persons who do not have a legitimate need to view them. These documents shall not be copied unless done in conformance with the detailed guidance of the contract. All documents shall be promptly returned in their entirety, unless authorized for disposal or retention, following

· completion of the contract. Specific requirements for protecting NNPI are contained below.

4. Specif ic NNPI Protection Requirements :

a. All NNPI

(1) Only people who are U.S. citizens and have a "need-to-know'' required to execute the contract shall be allowed access to NNPI. Only U.S. citizens (with a need-to-know) may access NNPI in any way, shape, or form.

Exhibit 1 to Attachment 2

(2) Documents will have the word NOFORN at the top and bottom of each page. The following warning statement wiR·be on the cover sheet: •NoFORN ·This docunent is subject to special export controls and each or foreign nationals may be made only with prior approval of the Documents originated in the course of work that reproduce, expand or shall be marked and controlled In the same way as the original. Media such as v1deo tapes, Disks, etc., must be marked and controlled similar to the markings on the original information.

(3) NNPI, classified and unclassified, must be destroyed as classified material using means Identified in DoD 5220.22-M (NISPOM), paragraph 5-705.

b. U-NNPI

(1) When not in direct control ot an authorized Individual, U-NNPI must be secured in a locked container (e.g. file cabinet, sate, etc.). Access to the container must be such that only authorized persons can access it and compromise of the container can be visually detected. Containers must not have labels that indicate the contents. It U-NNPI is stored on a local drive, the computer must be secured in a locked room. If removed from the site, U-NNPI must remain in the personal possession of the individual. At no time may U.NNPI be left unattended in a home, motel room, automobile, sent with baggage, etc.

(2) U·NNPI may not be posted on websites, including intranets, unless approved by NAVSEA

(3) U-NNPI may not be processed on networked computers with outside access, or emailed from same, unless the system has been approved by the Naval Sea Systems Command. If emailed from a NAVSEA approved system, the Information must be encrypted using Federal Information Processing Standards (FIPS) 140.2 certified method (software or hardware) 21: NSA Type I encryption. NNPI may not be processed on personal computers (i.e., non-government or unapproved contractor computers) or put on Personal Digital Assistants {PDAs).

(4) U-NNPI may be faxed within the continental U.S. and Hawaii provided there Is an authorized Individual waiting to receive the document and properly control it. U-NNPI may not be faxed to facilities outside the continental U.S., Including military Installations, unless encrypted per current DoD encryption requirements.

(5) U.NNPI may be sent within the continental U.S. and Hawaii Yla first class mail in a single opaque envelope that has no markings indicating the nature of the contents.

(6) Hand canying outside the continental U.S. or Hawaii is prohibited since disclosure to foreign nationals cannot be ensured. A government property pass is required to hand carry U-NNPI off station. A courier carols requlreo to hand carry C.NNPI oft-station.

5. Questions regarding the handling of NNPI may be directed to the Defense Security Service or the Naval Undersea Warfare Center Division Keyport {NUWCDIVKPT) Security Office (see Block 16 on the 00254 for contact information). Report any of the following to NUWCDIVKPT:

a. Attempts to elicit NNPI by unauthorized persons.

b. Compromises of NNPI by unauthorized persons. This includes Intentional or unintentional public release via such methods as theft, Improper disposal {e.g. material not shredded, disks lost), placement on website, transmission Yla email, or violation of the information system containing U

NNPI.

EKhibit 1 to Attachment 2

HANDLING REQUIREMENTS FOR NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION.

Reference (a): USSAN 1-69

1. NATO classified and unclassnied Information is governed by USSAN 1-69 United States Implementation of NATO Security Procedures, 21 Apr 82.

This directive establishes procedures and minimum security standards for the handling and profection of NATO classnled information.

2. Prior approval of the NUWC Keyport NATO Control Officer (NCO)/ Alternate (Code OOSO, 360-396-2589/5161/2822) Is required before the prime contractor or the subcontracting facility can be granted access to or store NATO material at their facility NO EXCEPTIONS.

a. DoD and contractor employees may have access to NATO classified information only when access is required in support of a U.S. or NATO program which requires such access (I.e., 'need-to-know'). A contractor can only be granted access to NATO material at NUWC Keyport if there Is an established requirement to perform tasks noted In the SOW/PWS, access must be approved by the COR/TOMITA and final approval authorized by the NCO/Alternate NO

EXCEPTIONS.

b. Access to NATO classified information requires a final DoD personnel clearance at the equivalent level and a NATO briefing as described In ref (a).

c. A NATO Facility Clearance Certificate is required for any contractor to negotiate or perform on a NATO classified contract or subcontract. A U.S.

contractor qualifies for a NATO facility clearance if it has an equivalent U.S.

clearance, its personnel who require access have been briefed on NATO procedures and the requirements of the NISPOM are met. The Defense Industrial Security Clearance Office (DISCO) will provide the NATO Facility Clearance Certificate to the requesting NATO command or agency.

d. Prior to having access to NATO classified information, contractor and government personnel must be given a NATO security briefing. The contractor FSO will Initially be briefed by the CSO. Thereafter, the FSO shall ensure that the required briefings are administered to employees who require access to NATO classified Information. Government employees and military personnel will be briefed by their security manager or a designee. The NATO briefing must cover security requirements and the consequences of negligent handling of NATO classified Information. Annual refresher br1efings will be conducted. When access to NATO classified information Is no longer required, personnel will be debriefed, as applicable, and acknowledge their responsibility for safeguarding the NATO

Exhibit 2 to Attachment 2 N00253-13·R..Q013

Information. The briefing may be accomplished by requiring the person to read a documentary presentation and sign the certificate.

e. Contractors and DoD personnel will not release or disclose NATO classified information to a third party, including subcontractors, without the prior written approval of the controlling organization, ccrnmand, agency or staff. Requests are to be submitted direct to the contracting agency for DoD Component contracts.

They will be submitted through the CSO for NATO contracts and non-NATO contracts awarded by a NATO member nation.

I. NATO classified documents are to be stored as preSCfibed in DoD Directive

5100.55 and the NISPOM for U.S. documents of an equivalent classification level. However, NATO documents must not be co-mingled with U.S. or other documents and must be accounted for at all times.

g. When contractors are required to use SIPRNET they are required to be briefed and granted access to NATO material.

h. When contractors are working in a laboratory where NATO material is processed and stored or an office where NATO material is kept they need to be briefed in the NATO program.

3. Questions regarding the handling of NATO material may be directed to the Keyport Security Office, 360-396-2822.

EKhibit 2 to Attachment 2 N00253·13·R.0013

CONTROLLED UNCLASSIFIED INFORMATION (INCLUDES FOR OFFICIAL USE ONLY

INFORMATION)

Ref: (a) DoD Regulation 5200.01 , DoD Information Security Program

(b) SECNAV M-5510.36, DON Information Security Program Manual

Contractor may be required to handle Controlled Unclassified Information (CUI) . There are numerous types of CUI, e.g. documents with limited distribution statements, documents marked as For Official Use Only (FOUO), etc. The minimum level of protection for all CUI is adherence to FOUO protection standards. Distribution Statements (OS) and warning labels, such as the Arms Export Control Act Warning, identify additional protection requirements for a given document. Minimum FOUO protection requirements/controls applicable to the performance of this contract for CUI are listed below. Additional protection requirements, as marked on a given CUI document, are in addition to the standards listed.

1. Handllng{Storaae: Access to FOUO is limited to those needing It to conduct official business for the Department of Defense (DoD). FOUO information is not classified information, but requires extra precautions to ensure it is not released to the public. During business hours, reasonable steps shall be taken to minimize risk of access by unauthorized personnel. After business hours, FOUO information shall be stored in unlocked containers, desks, or cabinets if Government or Government-contracted building security is provided. If it is not, store in locked desks, file cabinets, bookcases, locked rooms, or similar items.

2. Transportlngl!ransmlttlnq/Releaae/Destructlon: FOUO information shall be transported in a manner that prevents disclosure of the contents. FOUO information may be sent via USPS first-class mail, parcel post, or- for bulk shipments - 4111 class mail. Electronic transmission of FOUO information (voice, data, or facsimile) shall be by approved secure communications systems. Transmission via unsecure fax Is acceptable if an authorized person is standing by on the receiving end to take custody. All emails containing FOUO or attachments with FOUO must be digitally signed and encrypted when transmitted within a Navy network or to an approved contractor email address. Transmission of FOUO (I.e. any CUI) to pen10nal email accounts (e.g. AOL, Yahoo, Hotmall, Comcast, etc.) Is strictly prohibited. FOUO sent out of the contractor's facility electronically must be encrypted (DoD FIPS 140.2 standard). FOUO material shall not be released outside the contractor's facility except to representatives of DoD.

When no longer needed, destroy FOUO by a method that precludes its disclosure to unauthorized individuals.

3. Markin!!!: Unclass~ied documents (paper or electronic) generated in support of this contract which contain FOUO are to be marked "For Official Use Only" at the bottom on the outside of the front cover (if any), on each page containing FOUO information, and on the outside of the back cover (if any). Each paragraph containing FOUO information shall be marked as such. Within a classified document, an Individual page with both FOUO and classified information shall· be marked at the top and bottom with the highest security classification of information appearing on the page. Individual paragraphs shall be marked at the appropriate classification level, as well as unclassified or FOUO, as appropriate. Within a classified document, an individual page that contains FOUO information but no classified information shall be marked "For Official Use Only" at the top and bottom of the page, as well as each paragraph that contains FOUO information. Other records, such as photographs, films, tapes, or slides, shall be marked "For Official Use Only" or "FOUO" in a manner that ensures that a recipient or viewer is aware of the status of the Information therein. DS on technical documents identify access restrictions. OS "B" through "D" preclude public release arid while not marked as FOUO, are subject to all FOUO protection requirements, including the prohibition on unencrypted transmission over the public Internet.

Exhibit 3 to Attachment 2

EXPORT CONTROLLED ADDENDUM

1. HANDLING: Access to Export Controlled material shall be limited to those employees needing the material to conduct official business for the Department of Defense. Export Controlled is not a classification, but requires extra precautions to ensure it is not improperly released.

2. STORAGE: During normal duty hours, place Export Controlled material in an out-of-sight location if your wor1t area is accessible to persons who do not have a valid need for the material. After normal duty hours, store Export Controlled material to prevent unauthorized access. File with other unclassified records In unlocked files or desks when internal building security is provided. When there is not Internal security, locked buildings or rooms usually provide adequate after-hours protection. For additional protection, store Export Controlled material in locked containers such as file cabinets. desks or bookcases. Expenditure of funds for security containers solely for the protection of Export Controlled material is prohibited.

3. TRANSPORTING: Export Controlled Information shall be transported In a manner that prevents disclosure of the contents. Export Controlled infOf'mation may be sent via first· class mail or parcel post. Bulky shipments, such as distributions of Export Controlled Directives or testing materials, that otherwise qualify under postal regulation, may be sent by fourth-class mail.

4. TRANSMISSION: Export Controlled can be transmitted electronically within the contractor's facility. Export Controlled sent out of the contractor's facility must meet FIPS 140·2 encryption. .

5. RELEASE: Export Controlled material shall not be released outside the contractor's facility except to DoD employees. Subcontracting must be authorized by the COSR.

6. DESTRUCTION: When no ion~ needed, Export Controlled material shall be disposed of by a method that precludes 1ts disclosure to unauthorized Individuals.

7. MARKINGS:

a. For standard written or printed material, the following warning statement shall appear on the face of the document and title page. If the technical information is not In standard written or printed form and does not have a cover or title page, the distribution statement shall be conspicuously stamped, printed, or written by other means.

'WARNING- This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C .• Sec. 2751 et seq.) or Executive Order 12470. VIOlators of these export laws are subject to severe criminal penalties."

b. The following destruction statement will be applied to all technical documents containing Export Controlled Information. "Destroy by any method that will prevent disclosure of contents or reconstruction of the document•

c. Other records, such as photographs, films, tapes, slides, and AIS storage media shall also be marked with the above warning and destruction statement.

Exhibit 4 to Attachment 2 N00253-13-R·0013