Attachment_2_DD254.pdf

CLASSIFICATION (When filled in)· FOUO

DEPARTMENT OF DEFENSE OMB No. 0704-0567 CONTRACT SECURITY CLASSIFICATION SPECIFICATION OMB approval expires

(Please read Instructions BEFORE completing this application.) (The requirements of the National lno'ustria/ Security Program October 31, 2020 (NISP) apply to all secun'ty aspects of this effort involving classified information.)

The public reportlng burden for this collection of information, 0704-0567, is estimated to avera~e 70 minutes per response, Including the Ume for reviewing instructions, searching existing data sources, gathering and maintalrnng the data needed, and completing and reviewing the collection of information. end comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department or Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-infonna!ion-collections@mall.rnll. Re~ndents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of infonnation ifil does not display a currently valid 0 B control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FAC!LllY SECURllY CLEARANCE {FCL) REQUIRED b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/MATERIAL

(See Instructions.) REQUIRED AT CONTRACTOR FACILITY

Secret Secret

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.) 3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.) DATE (YYYYMMDD) x a. ORIGINAL (Complete date in all cases.)

20171218

b. SUBCONTRACT NUMBER

b. REVISED {Supersedes REVISION NO. DATE (YYYYMMDD) x c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD) all previous specifications.)

N00253-18-R-0002

DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.)

4. IS THIS A FOLLOW-ON CONTRACT? ~NO LJYES. If Yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? LJSNO LJYES. If Yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code.)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE {CSO) (Name, Address, ZIP Code, Telephone)[

This DD254 is for solicitation purposes only. It must be returned to NUWCDIVKPT security with a contract number and contractor name after the contract has been awarded, for updatin~ and approval signature.

7. SUBCONTRACTOR(S) (Glick button to add more subcontractors.)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE($) (CSOs) (Name, Address, ZIP Code, Telephone)

8. ACTUAL PERFORMANCE (Click button-to add more locations.)

a. LOCATION($) (For actual perfonnance, see instructions.) b. CAGE CODE c. COGNIZANT SECURITY OFFlCE{S) {CSOs) (Name, Address, ZIP Code, See Item 13 {If applicable, Telephone) (If applicable, see Instructions.)

see Instructions.)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT (Click here if more space is needed.)

The contract will provide Technology Insertion Hardware (TU-I) (20/22) procurement for the design and production of submarine combat and sonar system displays, workstations, processors, network systems, and associated Program Management Office (PMO) and Technical Support Services required to support fielded systems for the period FY19 through FY26.

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY {COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA x g. NORTH ATLANTIC TREATY ORGANIZATION {NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION {CNWDI) x h. FOREIGN GOVERMENT INFORMATION (ff CNWDI applies, RESTRICTED DATA must also be marked.)

L ALTERNATIVE COMPENSATORY CONTROL MEASURES (ACCM)

d. FORMERLY RESTRICTED DATA INFORMATION

I

e. NATIONAL INTELLIGENCE INFORMATION: x j. CONTROLLED UNCLASSIFIED INFORMATION {CUI) (See instructions.)

(1) Sensitive Compartmented Information (SCI) x k. OTHER (Specify) (See instructions.)

(2) Non-SCI Naval Nuclear Propulsion Inf01mation (NNPI), Export Controlled, Jvfilitary Critical Technology Data

DD FORM 254, NOV 2017 PREVIOUS EDITION IS OBSOLETE. Adobe L1veCycle Demgner ES4

CLASSIFICATION (When filled in): FOUO

CLASSIFICATION (When filled in): FOUO

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details In Blocks 13 or 14 as set forth in the Instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER h. REQUIRE A COMSEC ACCOUNT CONTRACTOR'S FAC!UTY OR A GOVERNMENT ACTIVITY (Applicable only

L HAVE A TEMPEST REQUIREMENT if there is no access or storage required at contractor facility. See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY x j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS x c. RECEIVE, STORE, AND GENERATE CLASSIFIED INFORMATION OR k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE (DCS)

MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE I. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED x INFORMATION (CUI).

e. PERFORM SERVICES ONLY (DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., protection requirements. Non-DoD Components: see instroctions.)

PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES x rn. OTHER (Specify) (See instroctions)

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL x INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION Have access to Governn1ent Information Technology Systems

CENTER

12. -uc .... ,.., "'"' .... "'".oi"'. Any 1ntormat1on (c/ass1m::u or unc1asS1<1t:<.1J pertaining to tr Is contract shall not be released tor public <l1ssem1nat1on except as prov1ue- -Y the National lnuustnal

Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office an:! phone contact information and if available, an e-mail address.

~See instrucltns) I DIRECT X THROUGH (Specify) PUBLIC RELEASE AUTHORITY:

Commander, Naval Undersea Warfare Center Division Keyport Phone: (360) 396-2699 (Attn: PAO), 610 Dowell Stree~ Keyport, WA 98345-7610 E1nail: kypt_pao@navy.mil

13. SECURITY GUIDANCE. The security c!assmcatlon guidance for classified Information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor Indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes;

to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fiff in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Cf/ck button to add additional pages as needed to provide complete guidance.)

-- Item 10.g: Access to NATO information up to and including SECRET is required to support Foreign Military Sales (FMS), In-Service Engineering, and Acoustic Range Testing. Access to NATO material requires a final U.S. Government clearance, at the appropriate level, prior to access. A representative of the U.S. Govenunent \Vill brief the Facility Security Officer, \Vho will in tutn brief the contractor personnel requiring access under this contract per DoD 5220.22-M (NISPOM), Section 10-706. Written approval from the government Contracting Officer is required prior to subcontracting, for each subcontractor. Amplifying guidance is provided in Attachment I.

------------·----------------------·-----------SECURITY GUIDANCE CONTINUES ON CONTINUATION SHEET-----------------------------------------·--------

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

~No CR] Yes (ff Yes, identify the pertinent contractual cf a uses in the contract document itself, or provide an appropriate statement which identifies the additionar requirements. Provide a copy of the requirements to the CSO. Use Item 13 or click button if additional space is needed.)

Protect Controlled Unclassified Infotmation/For Official Use Only Infotmation, Military Critical Technology, NATO, NNPI and Export Controlled per Item 13 remarks.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the CSO. .~ No L_J Yes (ff Yes, explain and identify specific areas and government activity responsible for inspections. Click button or use Item 13 if additional space is needed.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCANAME b. ACTIVITY ADDRESS CODE (AAC) OF THE c. ADDRESS (Include ZIP Code.)

NUWC Keyport Contracting Department CONTRACTING OFFICE (See instroctions.) 610 Dowell St. Keyport, WA 983345-7610

N00253

d. POC NAME (See instructions.) e. POC TELEPHONE (Include Area Code.) f. EMAIL ADDRESS (See instructions.)

Michael Nagy (COR) (360) 315-0464 michael.nagy@navy.mil

17. CERTIFICATION AND SIGNATURES. Security requirements slated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL b. TITLE c. ADDRESS (Include ZIP Code.)

(Last, First, Middle Initial) (See instructions.)

Security Contracting Officer Commander, NUWC Keyport

Quintana, William Attn: Security Officer

d. MC OF THE CONTRACTING OFFICE e. CAGE CODE OF THE PRIME 610 DoYvell Street (See instructions.) CONTRACTOR (See instructions.) Keyport, WA 98345-7610

N00253 NA

f. TELEPHONE (Include Area Code.) ! g. EMAIL ADDRESS (See instructions.) 1 h. DATE i. SIGNATURE QUINTANA.WILLI ~~~~~1~~IAMJ11.11mo

(360) 396-2589 \Villiam,quintanal@navy.mil 2017-12-18 AM.JR.1125469740 ~:~, 1017_ 12.ts ¥•&52 ..(l~w

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

- Dr. x a. CONTRACTOR OTHERS AS NECESSARY (If more room is needed, continue in Item 13 or on addi/ional page if ne·~essaiy.)

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION x e. ADMINISTRATIVE CONTRACTING OFFICER

DD FORM 254 (BACK), NOV 2017 CLASSIFICATION (When filled in): FOUO

00254 Continuation Sheet: Solicitation# N00253-18-R-0002

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides!

extracts referenced herein. Add additional pages as needed to provide complete guidance.)

----Classified contract performance will be performed at the contractor's facility and the following government installations: NUWC Division Keyport, NUWC Division Newport, Washington Navy Yard and government activities/units as identified within the contract solicitation or on official travel orders generated in support of the contract, as approved by the government. Security Classification of Equipment, Components, Spaces and Documents: The Equipment, Space or Document may be classified and subject to the applicable provisions of DOD 5220.22-M, Industrial Security Program Operating Manual; SECNAV M-5510.36, DON Information Security Program Manual; SECNAV M-5510.30, Personnel Security Program Manual; NUWCDIVKPT 5510.1, Information Security Program Manual; NUWCDIVKPT 5530.2, Personnel Security Program Manual;

NUWCDIVKPT 5530.1, Physical Security Program Manual; and NUWCDIVKPT 5239, Information Assurance Program.

- Item 10.h: Access to Foreign Government Installations (FGI) is tentatively limited to Royal Australian Navy (RAN) and United Kingdom (UK), additional programs if any will be reflected in a revised DD254. Written approval from the government contracting officer is required prior to subcontracting, for each subcontractor.

- Item 10.j: Controlled Unclassified Information (CUI)) including For Official Use Only (FOUO) information, must be protected per DoDM 5200.01-V 4, as specified in the CUl/FOUO protection clause in the contract. It is emphasized that unencrypted transmission of CUl/FOUO via the Internet is strictly prohibited.

Amplifying guidance is provided in Attachment 2.

- Item 10.k: NNPI must be protected per SECNA V M-5510.36 and OPNAV N9210.3 as set forth in the NNPI Protection Clause in the solicitation (or contract if an award DD254). Advance written approval from the Contracting Officer is required prior to subcontracting, for each subcontractor, of any work requiring access to NNPI. Amplifying guidance is provided in attachment 3.

--NISPOM paragraph 11-202.b. identifies the process for access to information designated Military Critical Data. DD Form 2345 must be submitted (directly) to the Defense Logistics Agency for access to unclassified military critical technical data. Export Controlled: All technical documents determined to contain export controlled technical data shall be marked "WARNING - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C. Sec. 2751 et seq.) Violations of these export laws are subject to severe criminal penalties. Disseminate per the provisions of OPNAVINST 5510.161" and guidance contained in attachment 4.

--Item 11.c: Security classification guidance: Security classification guides will be forwarded under separate cover. All classified information received or generated under this contract is the property of the U.S. Government. The contractor will contact the U.S. Government at the termination or expiration of this contract for disposition instructions. Applicable security classification guides are as follows (all titles are unclassified):

- OPNAVINST 5513.5 (05-02) (U) ACTIVE/PASSIVE/SPECIAL PURPOSE

SUBMARINE SONARS

- OPNAVINST 5513.5 (05-03) (C) ACOUSTIC WARFARE, SUBMARINE

- OPNAVINST 5513.5 (05-55) (C) SILENCING DATA, SHIP

- OPNAVINST 5513.5 (05-63) (C) SUBMARINE TOWED ARRAY

IMPROVEMENT PROGRAM (TAIP)

- OPNAVINST 5513.5 (05-90) (U) SUBMARINE TECHNOLOGY FOR NEW

DESIGN NUCLEAR POWERED ATTACK SUBMARINE COMMENCING WITH

SEAWOLF CLASS (SSN-21)

- OPNAVINST 5513.5 (05-104) (U) AN/BSY-1, SUBMARINE COMBAT I

ACOUSTIC SET

- OPNAVINST 5513.5 (05-142) (U). SUBMARINE TECHNOLOGY FOR OHIO

CLASS SUBMARINES CONVERTED FOR STRIKE AND SPECIAL

OPERATIONS (SSGN)

- OPNAVINST 5513.5 (05-144) (U) SUBMARINE TECHNOLOGY FOR

JIMMY CARTER (SSN-23) MUL Tl-MISSION PROJECT (MMP)

***Note: OPNAVINST 5513.5 will have an interim instruction until instruction SECNAV M-5510.36 has been implemented***

-- Item 11.g: If necessary, the contractor must prepare and forward DD Form 1540 to the NUWCDIVKPT Contracting Officer for endorsement and submission to DTIC. The contracting officer will certify the field of interest relating to the contract. Technical information on file at DTIC will then be available if the contractor requires such. DD Form 2345 must be submitted (directly) to the Defense Logistics Agency for access to unclassified military critical technical data."

-- Item 11.j: Operations Security (OPSEC) requirements: Contractor personnel are subject to applicable provisions of NUWCDIVKPT 3432.1 OPSEC Program.

Contractor personnel supporting this task order must complete annual government-provided OPSEC awareness training (arranged through the COR).

Contractor personnel will have access to government Critical Information (Cl) and Indicators and Observables that may indirectly disclose Cl. Cl includes, but is not limited to: Ship movements and schedules, weapons and sensor system installations, capabilities, and configurations; specific platform installations and characteristics, test schedules, deficiencies and vulnerabilities. Indicators and

Observables may include, but are not limited to: Outdoors system testing; ship's external hull or superstructure modifications; shipboard equipment, ordnance, weapons, fuels, and/or stores loading/unloading operations, and/or personnel or aircraft embarkation. No Cl, Indicators, or Observables maybe divulged to third parties (including other company employees who are not subject to this contract) without approval of the local command Security Officer, OPSEC Officer, or the NUWC Keyport OPSEC Program Manager."

--Item 11.1: Personnel accessing Government IT systems in the performance of contract work must meet Department of Navy (DON) Personnel Security Program (PSP) Instruction. SECNAV M-5510.30 Paragraph 5-3, sub paragraphs b(6)(a), b(6)(e), b(6)(f), b(6)(g), and Exhibit 5A, Performance requirements are at the IT-1 Critical Sensitive position for contractors performing these functions. The IT-1 positions require full positive adjudication of a Single Scope Background investigation. Additionally, per DOD Manual 8570-1 M (Change 3): C2.3.8 Contractor personnel supporting IA functions shall obtain the appropriate DOD approved IA baseline certification prior to being engaged. Additional training on local or system operating systems or procedures must be met within 6 months of engagement. C3.2.3.3 Contract personnel must comply with the DOD and Vendor CEU requirements to maintain their IA baseline certification. Tables C3.T4, C3.T5, Paragraphs C7 .3.4 and AP3.1.5, performance requirements will be set at the Information Assurance Technical (IAT) level II and all training and certification specification are required to be met for any contracted employee.

Secretary of Navy Manual (SECNAVMAN) SECNAVMAN 5239.21A Workforce Management Manual provides additional amplifying policy and requirements.

--Item 11.m: Personnel accessing Government IT systems in the performance of contract work must meet Department of Navy (DoN) Personnel Security Programs (PSP) lnstructic;m. SECNAV M-5510.30 Paragraph 5-3, sub paragraphs b(6)(a), b(6)(e), b(6)(f), b(6)(g), and Exhibit 5A, Performance requirements are at the IT-1 Critical Sensitive position for contractors performing these functions. The IT-1 positions require full positive adjudication of a Single Scope Background investigation. Additionally, per DoD Manual 8570-1 M (Change 3): C2.3.8 Contractor personnel supporting IA functions shall obtain the appropriate DoD-approved IA baseline certification prior to being engaged.

Additional training on local or system operating systems or procedures must be met within 6 months of engagement. C3.2.3.3 Contract personnel must comply with DoD and Vendor CEU requirements to maintain their IA baseline certification. Tables C3.T4, C3.T5, Paragraphs C7.3.4 and AP3.1.5, performance requirements will be set at the Information Assurance Technical (IAT) level II and all training and certification specification are required to be met for any contracted employee. Secretary of Navy Manual (SECNAVMAN) 5239.21A, Workforce Management Manual, provides additional amplifying policy and requirements.

14. ADDITIONAL SECURITY REQUIREMENTS: Contractor employees

DD254 Continuation Sheet: Solicitation# N00253-18-R-0002 embedded in government work spaces will be included in the command security education program per SECNAV M-5510.36 (11-4.2.a) and must complete prescribed DoD/DoN training requirements. Contractor employees shall review each NUWCDIVKPT Security Training Bulletin on line at the training website.

Embedded employees with a Secret or above security clearance must annually attend a locally provided NCIS counterintelligence briefing. Derivative classifiers (i.e., those who create new documents, including e-mails, based on existing classification guidance) shall receive training in derivative classification as required by DoDM 5200.01 V-1 with an emphasis on avoiding over-classification, at least once every 2 years. Training is available on the DSS website.

• All classified documents must be destroyed using a national security agency (NSA) approved high Security crosscut shredder listed on the NSA/CSS evaluated products list for high security crosscut paper shredders, or other APPROVED method by the Command Security Officer for destroying classified information.

• Safeguarding of Unclassified Technical Information - Safeguarding requirements and procedures for unclassified controlled technical information.

The Contractor shall provide adequate security to safeguard unclassified controlled technical information from compromise. To provide adequate security, the Contractor shall follow DFARS 204.7300. Safeguarding Covered Defense Information and Cyber Incident Reporting DFARS

204.7304 also will be followed and adhered to.

• All reports of contractor security violations associated with this contract shall be mailed by the Cognizant DSS field office directly to the certifying official in block 16 of this DD254.

• All classified information involved in security incidents shall be retained and provided to the certifying official in block 16 (a) of this DD 254 for classification review.

• All security related requests pertaining to this contract shall be submitted in writing by the contractor's Facility Security Officer (FSO) to the individual identified in block 16(a) of this DD254.

• All security aspects of this contract fall under the cognizance of NUWC Keyport WA Command. Contact the NUWC Keyport Security Contracting Officer for any questions regarding the content of the DD form 254.

• Policy - All Personal Electronic Devices or equipment capable of recording, storing, transmitting, or exporting data such as photographic images or audible information of any kind are strictly prohibited in any NUWC Division, Keyport areas where classified, U-NNPI, or other CUI is exposed, processed, Or discussed. Electronic devices with these capabilities, are NOT

DD254 Continuation Sheet: Solicitation# N00253-18-R-0002 authorized at any time in secure rooms, controlled access areas, classified conference rooms, or where classified information is processed, stored, or discussed.

• Contracting authority will provide security classification guidance on-site for the services to be performed. (To include Alternate Compensatory Control Measures where applicable).

• Classified or unclassified technical papers to be presented at classified symposiums must be approved by the Contracting Officer's Representative PRIOR TO presentation.

• All contractor requests for sharing of classified and other sensitive information between prime and sub-contractors must be forwarded in writing to the government security office identified in Item 16.d of this DD254 for approval.

• Copies of all subcontract DD254s must be provided to the government security office identified in Item 16.d of this DD254.

• Security Classification Guides (OPNAVINST 5513 Series) and unclassified limited distribution documents (e.g. FOUO, Distribution Statement Controlled) are not authorized for public release; therefore they cannot be posted on a publicly accessible web server or transmitted over the Internet unless appropriately encrypted to current DoD standards. Requests for public release cannot be transmitted via the Internet until the contractor receives final approval from the government.

• Per the requirements stated in the National Industrial Security Program Operation Manual (NISPOM) Dated February 2006, Chapter 5, Section 5, Paragraph 5-502, the Facility Security Officer (FSO) on the prime contract is authorized to flow down access to each subcontractor. It is the prime contractor FSO's responsibility to ensure that all subcontractors have the appropriate access levels. It is also the prime contractor FSO's responsibility to ensure that they have documented paperwork for each subcontract. If the current prime contractor FSO is replaced, it is the responsibility of the new FSO to inform NUWC Division Keyport in writing to security and the COR.

Contract Expiration date: TBO

The Contracting Officer is: Karen Smith, NUWC Keyport Code 02, Phone: (360) 396-2594, email: karen.l.smith@navy.mil

The Contracting Officer Representative is: Michael Nagy, NUWC Keyport Code 43, Phone: (360) 315-0464,email:Michael.nagy@navy.mil

The Contract Specialist is: Julie Thomas, NUWC Keyport Code 02, Phone: (360) 315-3390, email: ·ulie.thomas nav .mil

The Security Office Representative is: Mr. William Quintana, NUWC Keyport Code 105, Phone: (360) 396-2589, email: William.quintana1@navy.mil

(END)

Classification: FOUO ATTACHMENT 1: Solicitation# N00253-18-R-0002

HANDLING REQUIREMENTS FOR NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION.

Reference (a): USSAN 1-69

1. NA TO classified and unclassified information is governed by USSAN 1-69 United States Implementation of NATO Security Procedures, 21 Apr 82.

This directive establishes procedures and minimum security standards for the handling and protection of NATO classified information.

2. Prior approval of the NUWC Keyport NATO Control Officer (NCO)/Alternate (Code OOSO, 360-396-2589/5161/2822) is required before the prime contractor or the subcontracting facility can be granted access to or store NATO material at their facility NO EXCEPTIONS.

a. DoD and contractor employees may have access to NATO classified information only when access is required in support of a U.S. or NATO program which requires such access (i.e., "need-to-know"). A contractor can only be granted access to NATO material at NUWC Keyport if there is an established requirement to perform tasks noted in the SOW/PWS, access must be approved by the COR/TOM/TR and final approval authorized by the NCO/Alternate NO

EXCEPTIONS.

b. Access to NATO classified information requires a final DoD personnel clearance at the equivalent level and a NATO briefing as described in ref (a).

c. A NATO Facility Clearance Certificate is required for any contractor to negotiate or perform on a NATO classified contract or subcontract. A U.S.

contractor qualifies for a NATO facility clearance if it has an equivalent U.S.

clearance, its personnel who require access have been briefed on NATO procedures and the requirements of the NISPOM are met. The Defense Industrial Security Clearance Office (DISCO) will provide the NATO Facility Clearance Certificate to the requesting NATO command or agency.

d. Prior to having access to NATO classified information, contractor and government personnel must be given a NATO security briefing. The contractor FSO will initially be briefed by the CSO. Thereafter, the FSO shall ensure that the required briefings are administered to employees who require access to NATO classified information. Government employees and military personnel will be briefed by their security manager or a designee. The NATO briefing must cover security requirements and the consequences of negligent handling of NATO classified information. Annual refresher briefings will be conducted. When access to NATO classified information is no longer required, personnel will be debriefed, as applicable, and acknowledge their responsibility for safeguarding the NATO information. The briefing may be accomplished by requiring the person to read a documentary presentation and sign the certificate.

ATTACHMENT 1: Solicitation# N00253-18-R-0002

e. Contractors and DoD personnel will not release or disclose NATO classified information to a third party, including subcontractors, without the prior written approval of the controlling organization, command, agency or staff. Requests are to be submitted direct to the contracting agency for DoD Component contracts.

They will be submitted through the CSO for NATO contracts and non-NATO contracts awarded by a NATO member nation.

f. NATO classified documents are to be stored as prescribed in DoD Directive

5100.55 and the NISPOM for U.S. documents of an equivalent classification level. However, NATO documents must not be co-mingled with U.S. or other documents and must be accounted for at all times.

g. When contractors are required to use SIPRNET they are required to be briefed and granted access to NATO material.

h. When contractors are working in a laboratory where NATO material is processed and stored or an office where NATO material is kept they need to be briefed in the NATO program.

3. Questions regarding the handling of NA TO material may be directed to the Keyport Security Office, 360-396-2822.

ATTACHMENT 2: Solicitation# N00253-18-R-0002

CONTROLLED UNCLASSIFIED INFORMATION (INCLUDES FOR OFFICIAL USE ONLY

INFORMATION)

Ref: (a) DoD Regulation 5200.01-V4, DoD Information Security Program

(b) SECNAV M-5510.36, DON Information Security Program Manual

Contractor may be required to handle Controlled Unclassified Information (CUI). There are numerous types of CUI, e.g. documents with limited distribution statements, documents marked as For Official Use Only (FOUO), etc. The minimum level of protection for all CUI is adherence to FOUO protection standards. Distribution Statements (DS) and warning labels, such as the Arms Export Control Act Warning, identify additional protection requirements for a given document. Minimum FOUO protection requirements/controls applicable to the performance of this contract for CUI are listed below. Additional protection requirements, as marked on a given CUI document, are in addition to the standards listed.

1. Handling/Storage: Access to FOUO is limited to those needing it to conduct official business for the Department of Defense (DoD). FOUO information is not classified information, but requires extra precautions to ensure it is not released to the public. During business hours, reasonable steps shall be taken to minimize risk of access by unauthorized personnel. After business hours, FOUO information shall be stored in unlocked containers, desks, or cabinets if Government or Government-contracted building security is provided. If it is not, store in locked desks, file cabinets, bookcases, locked rooms, or similar items.

2. Transporting/Transmitting/Release/Destruction: FOUO information shall be transported in a manner that prevents disclosure of the contents. FOUO information may be sent via USPS first-class mail, parcel post, or - for bulk shipments - 4th class mail. Electronic transmission of FOUO information (voice, data, or facsimile) shall be by approved secure communications systems. Transmission via unsecure fax is acceptable if an authorized person is standing by on the receiving end to take custody. All emails containing FOUO or attachments with FOUO must be digitally signed and encrypted when transmitted within a Navy network or to an approved contractor email address. Transmission of FOUO (i.e. any CUI) to personal email accounts (e.g. AOL, Yahoo, Hotmail, Comcast, etc.) is strictly prohibited. FOUO sent out of the contractor's facility electronically must be encrypted (DoD FIPS 140-2 standard). FOUO material shall not be released outside the contractor's facility except to representatives of DoD.

When no longer needed, destroy FOUO by a method that precludes its disclosure to unauthorized individuals.

3. Markings: Unclassified documents (paper or electronic) generated in support of this contract which contain FOUO are to be marked "For Official Use Only" at the bottom on the outside of the front cover (if any), on each page containing FOUO information, and on the outside of the back cover (if any). Each paragraph containing FOUO information shall be marked as such. Within a classified document, an individual page with both FOUO and classified information shall be marked at the top and bottom with the highest security classification of information appearing on the page. Individual paragraphs shall be marked at the appropriate classification level, as well as unclassified or FOUO, as appropriate. Within a classified document, an individual page that contains FOUO information but no classified information shall be marked "For Official Use Only" at the top and bottom of the page, as well as each paragraph that contains FOUO information. Other records, such as photographs, films, tapes, or slides, shall be marked "For Official Use Only" or "FOUO" in a manner that ensures that a recipient or viewer is aware of the status of the information therein. DS on technical documents identify access restrictions. DS "B" through "D" preclude public release and while not marked as FOUO, are subject to all FOUO protection requirements, including the prohibition on unencrypted transmission over the public Internet.

Solicitation# N00253-18-R-0002-Attachment 3

NAVAL NUCLEAR PROPULSION INFORMATION {NNPI) PROTECTION REQUIREMENTS

Ref: SECNAV M-5510.36, OPNAVINST N9210.3

Naval Nuclear Propulsion Information {NNPI) is all information, classified or unclassified, concerning the design, arrangement, development, manufacture, testing, operation, and repair of the propulsion plants onboard naval nuclear powered ships and prototypes, including the associated shipboard and shore-based nuclear support facilities. NNPI may be in the form of documents, drawings, photographs, physical components, or electronic media.

a. Classified NNPI: Classified NNPI consists of two types of information - Restricted Data (RD) and National Security Information (NSI).

(1) RD: In the Naval Nuclear Propulsion Program, RD is information associated with the production of energy in the nuclear core. A need-to-know and a FINAL clearance at the appropriate level are required for access to RD.

(2) NSI: Information defined in Executive Order 12958, as amended, which, if disclosed could be expected to cause damage to national security. A need-to-know and an interim or final clearance are required for access to NSI.

b. Unclassified NNPI: U-NNPI is information related to sensitive military technology, i.e. naval nuclear propulsion technology. Access to U-NNPI is limited to U.S. citizens with a need-to-know. No clearance is required for access to U-NNPI. U-NNPI is marked and handled as "NOFORN."

2. Definitions: (Per OPNAVINST N9210.3)

a. Dual Citizens. Individuals who are dual citizens (hold both a U.S. citizenship and the citizenship of some other country) shall have special controls.

b. Foreign Interest: Any foreign government, agency of a foreign government, or representative of a foreign government; any form of business enterprise or entity organized under the laws of any country other than the U.S. or its possessions, and any foreign national.

c. Foreign National: A foreign national is any person not a United States citizen. Non-U.S.

citizens permanently residing in the United States are considered foreign nationals.

d. Representative of a Foreign Interest. Any person, regardless of citizenship, functioning (in an individual capacity or on behalf of any corporation, person, or government entity) as an official, representative, agent, or employee of a foreign interest. One exception is that U.S. citizens appointed by their U.S. employer to act as a representative in the management of a foreign subsidiary of a U.S. corporation will not be considered representatives of a foreign interest.

3. Access/Use: When a contractor is provided documents (specifications, drawings, etc.) that are marked as containing NNPl/NOFORN, the information contained therein and generated as part of the contract shall be used only for the purpose stated in the contract. In no case shall such information be transmitted outside the company (unless such transmittals comply with the detailed guidance of the contract) or to any foreign national (as defined below) within the company. The documents shall be protected from unauthorized observation while in use and shall be kept secure so as to preclude access by any persons who do not have a legitimate need to view them. These documents shall not be copied unless done in conformance with the detailed guidance of the contract. All documents shall be promptly returned in their entirety, unless authorized for disposal or retention, following completion of the contract. Specific requirements for protecting NNPI are contained below.

4. Specific NNPI Protection Requirements:

a. All NNPI

(1) Only people who are U.S. citizens and have a "need-to-know" required to execute the contract shall be allowed access to NNPI. Only U.S. citizens (with a need-to-know) may access NNPI in any way, shape, or form.

Solicitation# N00253-18-R-0002 -Attachment 1

Solicitation# N00253-18-R-0002 -Attachment 3

(2) Documents will have the word NOFORN at the top and bottom of each page. The following warning statement will be on the cover sheet: "NOFORN - This document is subject to special export controls and each transmittal to foreign governments or foreign nationals may be made only with prior approval of the Naval Sea Systems Command." Documents originated in the course of work that reproduce, expand or modify marked information shall be marked and controlled in the same way as the original. Media such as video tapes, Disks, etc., must be marked and controlled similar to the markings on the original information.

(3) NNPI, classified and unclassified, must be destroyed as classified material using means identified in DoD 5220.22-M (NISPOM), paragraph 5-705.

b. U-NNPI

(1) When not in direct control of an authorized individual, U-NNPI must be secured in a locked container (e.g. file cabinet, safe, etc.). Access to the container must be such that only authorized persons can access it and compromise of the container can be visually detected. Containers must not have labels that indicate the contents. If U-NNPI is stored on a local drive, the computer must be secured in a locked room. If removed from the site, U-NNPI must remain in the personal possession of the individual. At no time may U-NNPI be left unattended in a home, motel room, automobile, sent with baggage, etc.

(2) U-NNPI may not be posted on websites, including intranets, unless approved by NAVSEA.

(3) U-NNPI may not be processed on networked computers with outside access, or emailed from same, unless the system has been approved by the Naval Sea Systems Command. If emailed from a NAVSEA approved system, the information must be encrypted using Federal Information Processing Standards (FIPS) 140-2 certified method (software or hardware) or NSA Type I encryption. NNPI may not be processed on personal computers (i.e., non-government or unapproved contractor computers) or put on Personal Digital Assistants (PDAs).

(4) U-NNPI may be faxed within the continental U.S. and Hawaii provided there is an authorized individual waiting to receive the document and properly control it. U-NNPI may not be faxed to facilities outside the continental U.S., including military installations, unless encrypted per current DoD encryption requirements.

(5) U-NNPI may be sent within the continental U.S. and Hawaii via first class mail in a single opaque envelope that has no markings indicating the nature of the contents.

(6) Hand carrying outside the continental U.S. or Hawaii is prohibited since disclosure to foreign nationals cannot be ensured. A government property pass is required to hand carry U-NNPI off station. A courier card is required to hand carry C-NNPI off-station.

5. Questions regarding the handling of NNPI may be directed to the Defense Security Service or the Naval Undersea Warfare Center Division Keyport (NUWCDIVKPT) Security Office (see Block 16 on the DD254 for contact information). Report any of the following to NUWCDIVKPT:

a. Attempts to elicit NNPI by unauthorized persons.

b. Compromises of NNPI by unauthorized persons. This includes intentional or unintentional public release via such methods as theft, improper disposal (e.g. material not shredded, disks lost), placement on website, transmission via email, or violation of the information system containing U

NNPI.

Solicitation# N00253-18-R-0002 -Attachment 1 2

Solicitation# N00253-18-R-0002 ATTACHMENT 4:

EXPORT CONTROLLED ADDENDUM

1. HANDLING: Access to Export Controlled material shall be limited to those employees needing the material to conduct official business for the Department of Defense. Export Controlled is not a classification, but requires extra precautions to ensure it is not improperly released.

2. STORAGE: During normal duty hours, place Export Controlled material in an out-of-sight location if your work area is accessible to persons who do not have a valid need for the material. After normal duty hours, store Export Controlled material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided. When there is not internal security, locked buildings or rooms usually provide adequate after-hours protection. For additional protection, store Export Controlled material in locked containers such as file cabinets, desks or bookcases. Expenditure of funds for security containers solely for the protection of Export Controlled material is prohibited.

3. TRANSPORTING: Export Controlled information shall be transported in a manner that prevents disclosure of the contents. Export Controlled information may be sent via first class mail or parcel post. Bulky shipments, such as distributions of Export Controlled Directives or testing materials, that otherwise qualify under postal regulation, may be sent by fourth-class mail.

4. TRANSMISSION: Export Controlled can be transmitted electronically within the contractor's facility. Export Controlled sent out of the contractor's facility must meet FIPS 140-2 encryption.

5. RELEASE: Export Controlled material shall not be released outside the contractor's facility except to DoD employees. Subcontracting must be authorized by the COSR.

6. DESTRUCTION: When no longer needed, Export Controlled material shall be disposed of by a method that precludes its disclosure to unauthorized individuals.

7. MARKINGS:

a. For standard written or printed material, the following warning statement shall appear on the face of the document and title page. If the technical information is not in standard written or printed form and does not have a cover or title page, the distribution statement shall be conspicuously stamped, printed, or written by other means.

"WARNING - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec. 2751 et seq.) or Executive Order 12470. Violators of these export laws are subject to severe criminal penalties."

b. The following destruction statement will be applied to all technical documents containing Export Controlled information. "Destroy by any method that will prevent disclosure of contents or reconstruction of the document."

c. Other records, such as photographs, films, tapes, slides, and AIS storage media shall also be marked with the above warning and destruction statement.