Att_5_N0025319R0001_DD254.pdf

CLASSIFICATION (When filled in): Official

DEPARTMENT OF DEFENSE OMB No. 0704-0567

CONTRACT SECURITY CLASSIFICATION SPECIFICATION OMB approval expires:

(The requirements of the Na lion al fndustriaf Security Program (NISP) apply to all security aspects of this effort involving classified information.) October 31, 2020

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the Ume for reviewing instructions, searc.hing existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of infonnation. Send comments regarding this burden estimate or any other aspect of this collection of infomiation, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-a!ex.esd.mbx.dd-dod-information-collectlons@mail.miL Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing lo comply with a collection of information if It does not dlsplay a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/ (See Instructions) MATERIAL REQUIRED AT CONTRACTOR FACILITY

Secret Secret

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.) 3. THIS SPECIFICATION IS: (X and complete as applicable.)

D

a. PRIME CONTRACT NUMBER (See instructions.)

L:Sl a. ORIGINAL (Complete date in all cases)

DATE (YYYYMMDD)

20180607

D

b. SUBCONTRACT NUMBER b. REVISED (Supersedes all previous specifications.)

D REVISION NO. DATE (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD)

L:Sl N00253-19-R-0001 D

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? ISJ No D Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? ISJ No D Yes If yes, complete the fo!fowing:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (fnclude Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO)

This DD254 is for solicitation purposes only. It must be (Name, Address, ZIP Code, Te"iephone required; Email Address optional) returned to NUWCDIVKPT security with a contract number and contractor name after the contract has been awarded, for updating and approval signature.

7. SUBCONTRACTOR($) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

a. LOCATION($) (For actual performance, see instructions.) b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO)

See Block 13. (If applicable, (Name, Address, ZIP Code, Telephone required; Email Address optional) see Instructions.)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

The contractor vvill test, conduct integration and provide integrated logistics support for the AN/SLQ 25E (Nixie) system and spares.

Most of the work will be pcrfo1med at the cleared contractor facility and will include testing, collaboration at Government sites listed in block 13.

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Official

Page 1 of4 AEM liveCyde Designer

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13or14 as sef forth in the instructions.)

0 a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

D b. RESTRICTED DATA

0 c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (lfCNWDI applies, RESTRICTED DATA must also be marked.)

D d. FORMERLY RESTRICTED DATA

e. NATIONAL INTELLIGENCE INFORMATION:

0 (1) Sensitive Compartmented Information (SCI)

D (2) Non-SCI

0 f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

D g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

D h. FOREIGN GOVERMENT INFORMATION

D i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

[;gj j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instroctions.)

lg] k. OTHER (Specify) (See instructions.)

Export Control, and Military Critical Technology

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X aff that apply. See Instructions. Provide details In Blocks 13or14 as set forth In the insrroctions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

D ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See Instructions.)

0 b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

IVl c. RECEIVE, STORE, AND GENERATE CLASSIFIED l6J INFORMATION OR MATERIAL

[;gj d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

D e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

D THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

12. PUBLIC RELEASE

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE [;gj TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

D h. REQUIRE A COMSEC ACCOUNT

D i. HAVE A TEMPEST REQUIREMENT

[;gj j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

0 k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

I. RECEIVE, STORE, OR GENERA TE CONTROLLED UNCLASSIFIED

[;gj INFORMATION (CUI).

X (DoD Components: refer to DoDM 5200.01, Volume 4 only tor specific CUI protection requirements. Non-DoD Components: see instroctions.)

igj m. OTHER (Specify) (See instroctions.)

Access to Government Information Systems

Any information {classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instroctions)

0 DIRECT IZI THROUGH (Specftybetow) Public Release Authority:

Commander, Naval Undersea Warfare Center Division Keypo1t (Attn: PAO), 610 Dowell Street, Keyport, WA 98345-76!0

13. SECURITY GUIDANCE

Phone: (360) 396-2699 Email: kypt_pao@navy.mil

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for iilterpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate tor the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expsnd as text Is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field tor it to shrink a ff er the text has been deleted. Also allows tor up to 6 internal reviewers to digitally sign. See Instructions tor additional guidance or use of the fillable PDF.)

--Item 8.a: Classified contract performance will be performed at the contractor's facility and the following govetnment installations:

NUWC Division Newpott, Washington Navy Yard and government activities/units as identified within the contract solicitation or on official travel orders generated in support of the contract, as approved by the government. Security Classification of Equipment, Components, Spaces, and Documents: The Equipment, Space, or Document n1ay be classified and subject to the applicable provisions of DoD 5220.22-M, Industrial Security Program Operating Manual; SECNAV M-5510.36, DON Information Security Program Manual;

SECNA V M-5510.30, Personnel Security Program Manual; NUWCDIVKPT 5510.1, Information Security Program Manual;

NUWCDIVKPT 5530.2, Personnel Security Program Manual; NUWCDIVKPT 5530.1, Physical Security Program Manual; and NUWCDIVKPT 5239, Information Assurance Program. Security Classification guidance will be provided by the GCA.

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Official

Paoe 2 of 4 AEM UveCycfe Designer

CLASSIFICATION (IMlen filled in): Official

List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

NAME & TITLE OF REVIEWING OFFICIAL SIGNATURE

William Quintana - Security Contracting QUINTANA.WILLI ~if~:~~~;,lAMm_11H Officer - NUWC Keyport WA AMJR.1125469740 :::4~01806_0716, 30, 15 .o7w

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

D No IXJ Yes If Yes, identify the pettinent contractual clauses in the contract document itself, or provide en appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the tillable PDF.)

Protect Controlled Unclassified Information/For Official Use Only Information, Military Critical Technology and Export Controlled per Item 13 remarks.

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

IXJ No D Yes If Yes, explain and Identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions tor additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY {GCA) AND POINT OF CONTACT {POC)

a. GCA NAME c. ADDRESS (Include Zf P Code) d. POC NAME

Naval Undersea Warfare Center Div Keyport Ms. Stephanie Cyr NUWC Keyport Contracting Dept 610 Dowell St. e. POC TELEPHONE (fnclude Area Code)

b. ACTIVITY ADDRESS CODE {AAC) OF THE Keypmt WA 98345-7610

+ 1 ( 401) 832-8528 CONTRACTING OFFICE (See Instructions) f. EMAIL ADDRESS (See Instructions)

N00253 stephannie.k.cyr@navy.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) d. AAC OF THE CONTRACTING OFFICE (See Instructions) (See Instructions)

QUINTANA, WILLIAM N00253

b. TITLE e. CAGE CODE OF THE PRIME CONTRACTOR (See Instructions.)

Security Contracting Officer NIA

c. ADDRESS (Include ZIP Code) f. TELEPHONE (Include Area Code)

Corn1nander, Naval Undersea Warfare Center Division Keyport, +I (360) 396-2589 (Attn: Security Contracting Officer), 610 Dowell St., Keyport WA g. EMAIL ADDRESS (See Instructions) 98345-7610 william.quintanal@navy.mil

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (V\lhen filled in): Official

h. SIGNATURE

i. DATE SIGNED (See Instructions)

AEM LiveCyc!a Designer

CLASSIFICATION (IMien filled in): Official

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

[XI a. CONTRACTOR

D b. SUBCONTRACTOR

D c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

D d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

[XI e. ADMINISTRATIVE CONTRACTING OFFICER

D f. OTHER AS NECESSARY (It more room is needed, continue in Item 13 or on additional page if necessary.)

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE. Paoe 4 of 4 AEM LlveCycia Designer

00254 Continuation Sheet: Solicitation #N00253-19-R-0001

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fifi in as appropriate for the classified efforl. Attach, or forward under separate correspondence, any documents/guides/ extracts referenced herein. Add additional pages as needed to provide complete guidance.)

- Item 10.j: Controlled Unclassified Information (CUI)) including For Official Use Only (FOUO) information, must be protected per DoDM 5200.01-V 4, as specified in the CUl/FOUO protection clause in the contract It is emphasized that unencrypted transmission of CUl/FOUO via the Internet is strictly prohibited.

Amplifying guidance is provided in Attachment 1.

--Cont. Item 10.k: NISPOM paragraph 11-202.b. identifies the process for access to information designated Military Critical Data. DD Form 2345 must be submitted (directly) to the Defense Logistics Agency for access to unclassified military critical technical data. Export Controlled: All technical documents determined to contain export controlled technical data shall be marked 'WARNING - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C. Sec. 2751 et seq.) Violations of these export laws are subject to severe criminal penalties. Disseminate per the provisions of OPNAVINST 5510.161" and guidance contained in attachment 2.

-- Item 11.c: Security Classification Guidance is as follows and will be forwarded under separate cover:

(U) SCG ID# 03-171: AN/SLQ-25, AN/SLQ-25A, AN/SLQ-25C and AN/SLQ-25() Torpedo Countermeasures (NIXIE)-(UNCLASSIFIED).

(U) SCG ID# 03-142.2: AN/SLQ-25, and AN/SLQ-25(A) Torpedo Countermeasures (NIXIE)-(SECRET).

-- Item 11.d: A GSA approved security container is adequate for classified hardware storage and/or "Restricted Area" or "Closed Area" is required for secure storage.

-- Item 11.g: The contractor is required to prepare and forward DD Form 1540 to the NUWCDIVKPT Contracting Officer for endorsement and submission to DTIC (See NISPOM 11-202.A.). The contracting officer will certify the field of interest relating to the contract. Technical information on file at DTIC will then be available if the contractor requires such. DD Form 2345 must be submitted directly by the contractor to the Defense Logistics Agency for access to unclassified military critical technical data.

-- Item 11.j: Operations Security (OPSEC) requirements: Contractor personnel are subject to applicable provisions of NAVSEAINST 3432.1A OPSEC Program and NUWCDIVKPT 3432.1 OPSEC Program. Contractor personnel supporting this task order must complete annual qovernment-provided OPSEC awareness this task order must complete annual government-provided OPSEC awareness training (arranged through the COR). Contractor personnel will have access to government Critical Information (Cl) and Indicators and Observables that may indirectly disclose Cl. Cl includes, but is not limited to: Ship movements and schedules, weapons and sensor system installations, capabilities, and configurations; specific platform installations and characteristics, test schedules, deficiencies and vulnerabilities. Indicators and Observables may include, but are not limited to: Outdoors system testing; ship's external hull or superstructure modifications; shipboard equipment, ordnance, weapons, fuels, and/or stores loading/unloading operations, and/or personnel or aircraft embarkation. No Cl, Indicators, or Observables maybe divulged to third parties (including other company employees who are not subject to this contract) without approval of the local command Security Officer, OPSEC Officer, or the NUWC Keyport OPSEC Program Manager." A contractor prepared OPSEC plan is required. Specific guidance is provided in the CORL and SOW exhibits/attachments listed in Section J. OP SEC plan requirements must be included for any and all subcontractors. A copy of subcontractor OPSEC plans must accompany the subcontractor DD254s provided to the NUWC Division Keyport Security Contracting Officer.

-- Item 11.1: Controlled Unclassified Information (CUI), including For Official Use Only (FOUO) information, must be protected per DoDM 5200.01-V4, as specified in the CUl/FOUO protection clause in the contract. It is emphasized that unencrypted transmission of CUl/FOUO via the Internet is strictly prohibited."

Amplifying guidance is provided in Attachment 1.

--Item 11.m: Personnel accessing Government IT systems in the performance of contract work must meet Department of Navy (DON) Personnel Security Program (PSP) Instruction. SECNAV M-5510.30 Paragraph 5-3, sub paragraphs b(6)(a), b(6)(e), b(6)(f), b(6)(g), and Exhibit 5A, Performance requirements are at the IT-1 Critical Sensitive position for contractors performing these functions. The IT-1 positions require full positive adjudication of a Single Scope Background investigation. Additionally, per DOD Manual 8570-1 M (Change 3): C2.3.8 Contractor personnel supporting IA functions shall obtain the appropriate DOD approved IA baseline certification prior to being engaged. Additional training on local or system operating systems or procedures must be met within 6 months of engagement. C3.2.3.3 Contract personnel must comply with the DOD and Vendor CEU requirements to maintain their IA baseline certification. Tables C3.

T4, C3. T5, Paragraphs C7 .3.4 and AP3.1.5, performance requirements will be set at the Information Assurance Technical (IAT) level II and all training and certification specification are required to be met for any contracted employee.

Secretary of Navy Manual (SECNAVMAN) SECNAVMAN 5239.21A Workforce Management Manual provides additional amplifying policy and requirements.

14. ADDITIONAL SECURITY REQUIREMENTS: Contractor emplovees embedded in government work spaces will be included in the command security education program per SECNAV M-5510.36 (11-4.2. a) and must complete prescribed DoD/DoN training requirements. Contractor employees shall review each NUWCDIVKPT Security Training Bulletin online at the training website.

Embedded employees with a Secret or above security clearance must annually attend a locally provided NCIS counterintelligence briefing. Derivative classifiers (i.e., those who create new documents, including e-mails, based on existing classification guidance) shall receive training in derivative classification as required by DoDM 5200.01 V-1 with an emphasis on avoiding over-classification, at least once every 2 years.

• All classified documents must be destroyed using a national security agency (NSA) approved high Security crosscut shredder listed on the NSNCSS evaluated products list for high security crosscut paper shredders, or other APPROVED method by the Command Security Officer for destroying classified information.

• Safeguarding of Unclassified Technical Information - Safeguarding requirements and procedures for unclassified controlled technical information.

The Contractor shall provide adequate security to safeguard unclassified controlled technical information from compromise. To provide adequate security, the Contractor shall follow FARS Clause 252.204-7012 Safeguarding Covered Defense Information and FARS Clause 204.7304 Cyber Incident Reporting (OCT 2016).

• All reports of contractor security violations associated with this contract shall be mailed by the Cognizant DSS field office directly to the certifying official in block 16 of this DD254.

• All classified information involved in security incidents shall be retained and provided to the certifying official in block 16 (a) of this DD 254 for classification review.

• All security related requests pertaining to this contract shall be submitted in writing by the contractor's Facility Security Officer (FSO) to the individual identified in block 16(a) of this DD254.

• All security aspects of this contract fall under the cognizance of NUWC Keyport WA Command. Contact the NUWC Keyport Security Contracting Officer for any questions regarding the content of the DD form 254.

• Policy - All Personal Electronic Devices or equipment capable of recording, storing, transmitting, or exporting data such as photographic images or audible information of any kind are strictly prohibited in any NUWC Division, Keyport areas where classified, U-NNPI, or other CUI is exposed, processed, Or discussed. Electronic devices with these capabilities, are NOT authorized at any time in secure rooms, controlled access areas, classified conference rooms, or where classified information is processed, stored, or discussed.

• Classified or unclassified technical papers to be presented at classified symposiums must be approved by the Contracting Officer's Representative PRIOR TO presentation.

• All contractor requests for sharing of classified and other sensitive information between prime contractors must be forwarded in writing to the government security office identified in Item 16.d of this DD254 for approval.

• Copies of all subcontract DD254s must be provided to the government security office identified in Item 16.d of this DD254.

• Security Classification Guides (OPNAVINST 5513 Series) and unclassified limited distribution documents (e.g. FOUO, Distribution Statement Controlled) are not authorized for public release; therefore, they cannot be posted on a publicly accessible web server or transmitted over the Internet unless appropriately encrypted to current DoD standards. Requests for public release cannot be transmitted via the Internet until the contractor receives final approval from the government. No publicity releases, Internet or World Wide Web Sites, or public displays of any kind are authorized on this program without the prior expressed written consent of COMNAVSEASYSCOM (SEA OOD) or higher DoD authority. The fact that certain details of information are shown to be unclassified information does not automatically mean it is eligible for public release. All requests for public release shall be processed through appropriate channels for publication approval.

• Per the requirements stated in the National Industrial Security Program Operation Manual (NISPOM) Dated February 2006, Chapter 5, Section 5, Paragraph 5-502, the Facility Security Officer (FSO) on the prime contract is authorized to flow down access to each subcontractor. It is the prime contractor FSO's responsibility to ensure that all subcontractors have the appropriate access levels. It is also the prime contractor FSO's responsibility to ensure that they have documented paperwork for each subcontract. If the current prime contractor FSO is replaced, it is the responsibility of the new FSO to inform NUWC Division Keyport in writing to security and the COR.

Contract Expiration date: TBO

The Program Sponsor is: Mr. John J (JJ) Brown, PMS 415 Nixie APM, (202) 781- 0645, email: john.j.brown4@navy.mil

The Contractin Officer is: Ms. Karen Smith, NUWC Ke ort Code 024,

(360) 396-2594, email: karen.Lsmith@navy.mil

The Contracting Officer Representative is: Ms. Stephannie Cyr, NUWC Newport Code 8542, (401) 832-8528,email:stephannie.k.cyr@navy.mil

The Contract Specialist is: Mr. Robert Watson, NUWC Keyport Code 024,

(360) 315-3094,email:robert.watson1@navy.mil

The Security Office Representative is: Mr. William Quintana, NUWC Keyport Code 105, (360) 396-2589,email:William.quintana1@navy.mil

(END)

Attachment 1 to Solicitation #N00253-19-R-0001

CONTROLLED UNCLASSIFIED INFORMATION

(INCLUDES FOR OFFICIAL USE ONLY INFORMATION)

Ref: (a) DoD Regulation 5200.01-V4, DoD Information Security Program

(b) SECNAV M-5510.36, DON Information Security Program Manual

Contractor may be required to handle Controlled Unclassified Information (CUI). There are numerous types of CUI, e.g. documents with limited distribution statements, documents marked as For Official Use Only (FOUO), etc. The minimum level of protection for all CUI is adherence to FOUO protection standards. Distribution Statements (DS) and warning labels, such as the Arms Export Control Act Warning, identify additional protection requirements for a given document. Minimum FOUO protection requirements/controls applicable to the performance of this contract for CUI are listed below. Additional protection requirements, as marked on a given CUI document, are in addition to the standards listed.

1. Handling/Storage: Access to FOUO is limited to those needing it to conduct official business for the Department of Defense (DoD). FOUO information is not classified information, but requires extra precautions to ensure it is not released to the public. During business hours, reasonable steps shall be taken to minimize risk of access by unauthorized personnel. After business hours, FOUO information shall be stored in unlocked containers, desks, or cabinets if Government or Government-contracted building security is provided. If it is not, store in locked desks, file cabinets, bookcases, locked rooms, or similar items.

2. Transporting/Transmitting/Release/Destruction: FOUO information shall be transported in a manner that prevents disclosure of the contents. FOUO information may be sent via USPS first-class mail, parcel post, or - for bulk shipments - 4th class mail. Electronic transmission of FOUO information (voice, data, or facsimile) shall be by approved secure communications systems. Transmission via unsecure fax is acceptable if an authorized person is standing by on the receiving end to take custody. All emails containing FOUO or attachments with FOUO must be digitally signed and encrypted when transmitted within a Navy network or to an approved contractor email address. Transmission of FOUO (i.e. any CUI) to personal email accounts (e.g. AOL, Yahoo, Hotmail, Comcast, etc.) is strictly prohibited. FOUO sent out of the contractor's facility electronically must be encrypted (DoD FIPS 140-2 standard). FOUO material shall not be released outside the contractor's facility except to representatives of DoD.

When no longer needed, destroy FOUO by a method that precludes its disclosure to unauthorized individuals.

3. Markings: Unclassified documents (paper or electronic) generated in support of this contract which contain FOUO are to be marked "For Official Use Only" at the bottom on the outside of the front cover (if any), on each page containing FOUO information, and on the outside of the back cover (if any). Each paragraph containing FOUO information shall be marked as such. Within a classified document, an individual page with both FOUO and classified information shall be marked at the top and bottom with the highest security classification of information appearing on the page. Individual paragraphs shall be marked at the appropriate classification level, as well as unclassified or FOUO, as appropriate. Within a classified document, an individual page that contains FOUO information but no classified information shall be marked "For Official Use Only" at the top and bottom of the page, as well as each paragraph that contains FOUO information. Other records, such as photographs, films, tapes, or slides, shall be marked "For Official Use Only" or "FOUO" in a manner that ensures that a recipient or viewer is aware of the status of the information therein. DS on technical documents identify access restrictions. DS "B" through "D" preclude public release and while not marked as FOUO, are subject to all FOUO protection requirements, including the prohibition on unencrypted transmission over the public Internet.

Attachment 2 to Solicitation #N00253-19-R-0001

EXPORT CONTROLLED ADDENDUM

1. HANDLING: Access to Export Controlled material shall be limited to those employees needing the material to conduct official business for the Department of Defense. Export Controlled is not a classification, but requires extra precautions to ensure it is not improperly released.

2. STORAGE: During normal duty hours, place Export Controlled material in an out-of-sight location if your work area is accessible to persons who do not have a valid need for the material. After normal duty hours, store Export Controlled material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided. When there is not internal security, locked buildings or rooms usually provide adequate after-hours protection. For additional protection, store Export Controlled material in locked containers such as file cabinets, desks or bookcases. Expenditure of funds for security containers solely for the protection of Export Controlled material is prohibited.

3. TRANSPORTING: Export Controlled information shall be transported in a manner that prevents disclosure of the contents. Export Controlled information may be sent via first class mail or parcel post. Bulky shipments, such as distributions of Export Controlled Directives or testing materials, that otherwise qualify under postal regulation, may be sent by fourth-class mail.

4. TRANSMISSION: Export Controlled can be transmitted electronically within the contractor's facility. Export Controlled sent out of the contractor's facility must meet FIPS 140-2 encryption.

5. RELEASE: Export Controlled material shall not be released outside the contractor's facility except to DoD employees. Subcontracting must be authorized by the COSR.

6. DESTRUCTION: When no longer needed, Export Controlled material shall be disposed of by a method that precludes its disclosure to unauthorized individuals.

7. MARKINGS:

a. For standard written or printed material, the following warning statement shall appear on the face of the document and title page. If the technical information is not in standard written or printed form and does not have a cover or title page, the distribution statement shall be conspicuously stamped, printed, or written by other means.

"WARNING - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec. 2751 et seq.) or Executive Order 12470. Violators of these export laws are subject to severe criminal penalties."

b. The following destruction statement will be applied to all technical documents containing Export Controlled information. "Destroy by any method that will prevent disclosure of contents or reconstruction of the document."

c. Other records, such as photographs, films, tapes, slides, and AIS storage media shall also be marked with the above warning and destruction statement.