DRAFT ATT 6 D254(8May2020).pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification

TBD

Name:

TBD

Defense Counterintelligence Security Agency Address - TBD

CSO:

TBD

CSO:

TBD

TBD

Block9:

Design, produce, fabricate, assemble, test and deliver MK 54 Torpedo hardware and associated products. The majority of this work will be performed at contractor facilities, however the contractor will have an employee designated desk determined by NUWC Keyport to assist as a subject matter expert.

Email: KYPT_PAO@navy.mil

-- ITEM 10.i. If access to Alternative Compensatory Control Measures (ACCM) Information is required in support this contract, contractor will is required to follow guidance per NAVSEINST S5510.18 (Security Policy for Stealth Performance Data). Additional guidance for ACCM information in block 14.

-- ITEM 10.j: Controlled Unclassified Information (CUI), including For Official Use Only (FOUO) information, must be protected per DoDM 5200.01-V4, as specified in the CUI/FOUO protection clause in the contract. It is emphasized that unencrypted transmission of CUI/FOUO via the Internet is strictly prohibited. Additional guidance for protection of CUI in BLOCK 14.

-- ITEM 10.k OTHER Export Controlled, Military Critical Technology Data:

(a). NISPOM paragraph 11-202.b. identifies the process for access to information designated Military Critical Data (Critical Technology). DD Form 2345 must be submitted (directly) to the Defense Logistics Agency for access to unclassified military critical technical data. Export Controlled: All technical documents determined to contain export controlled technical data shall be marked "WARNING - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C. Sec. 2751 et seq.) Violations of these export laws are subject to severe criminal penalties. Additional guidance for protection of Export Controlled, and Military Critical Technology Data information in BLOCK 14.

-- ITEM 11(c): The contractor requires access to classified source data up to and including the level identified in item 1a of this DD form 254. Classified material generated in support of this contract shall be classified in accordance with the source material of the Navy Security Classification Guidance, which will be provided under separate cover by NAVSEA 00P3, the Program Office or NUWC Keyport. Automated Information Systems (AIS) must be certified and accredited by the Cognizant Security Agency (CSA) prior to processing classified information from NAVSEA. All classified information received or generated under this contract is the property of the U.S. Government. The Contractor will contact the U.S. Government at the termination or expiration of this contract for disposition instructions. Applicable security classification guides are as follows (all titles are unclassified):

OPNAVINST 5513.5 SCG ID# 05-139.2 Unclassified MK 48 ADCAP (MOD 5 and Beyond), MK 50 and/or Mk 54 Torpedoes 7/23/2007

-- ITEM 11(d): All classified data and hardware will be protected IAW DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM).

-- ITEM 11.g: If necessary, the Contractor must prepare and forward DD Form 1540 to the NUWCDIVKPT Contracting Officer for endorsement and submission to DTIC. The Contracting Officer will certify the field of interest relating to the contract. Technical information on file at DTIC will then be available if the Contractor requires such. DD Form 2345 must be submitted directly to the Defense Logistics Agency for access to unclassified military critical technical data.

-- ITEM 11.j: OPSEC requirements: Contractor personnel are subject to applicable provisions of NUWCDIVKPT 3432.1 OPSEC Program. Contractor personnel supporting this contract must complete annual OPSEC Awareness training. All contract personnel embedded within a Government workspace will complete annual Government provided OPSEC Awareness training arranged through the Contracting Officer's Representative (COR). Contract personnel located outside of Government workspaces will complete annual OPSEC Awareness training arranged and provided by contractor Facility Security Officer. Contractor personnel will have access to Government Critical Information (CI) and Indicators and Observables that may indirectly disclose CI. CI includes, but is not limited to: Ship movements and schedules, weapons and sensor system installations, capabilities and configurations; specific platform installations and characteristics, test schedules, deficiencies and vulnerabilities. Indicators and Observables may include, but are not limited to: Outdoors system testing; ship's external hull or superstructure modifications; shipboard equipment, ordnance, weapons, fuels, and/or stores loading/unloading operations, and/or personnel or aircraft embarkation. No CI, Indicators, or Observables may be divulged to third parties, including other company employees who are not subject to this contract, without approval of the local command Security Officer, OPSEC Officer, or the NUWC Keyport OPSEC Program Manager.

-- ITEMS 11.l and 11.m: Personnel accessing Government IT systems in the performance of contract work must meet DoN Personnel Security Program (PSP) Instruction. SECNAV M-5510.30 Paragraph 5-3, subparagraphs b(6)(a), b(6)(e), b(6)(f), b(6)(g), and Exhibit 5A, Performance requirements are at the IT-1 Critical Sensitive position for contractors performing these functions. The IT-1 positions require full positive adjudication of a Single Scope Background investigation. Additionally, per DoD Manual 8570-1M (Change 3): C2.3.8 Contractor personnel supporting IA functions shall obtain the appropriate DoD-approved IA baseline certification prior to being engaged. Additional training on local or system operating systems or procedures must comply with the DoD and Vendor CEU requirements to maintain their IA baseline certification. Tables C3.T4, C3.T5, Paragraphs C7.3.4 and AP3.1.5, performance requirements will be set at the Information Assurance Technical (IAT) level II and all training and certification specification are required to be met for any contracted employee. Secretary of Navy Manual (SECNAVMAN) 5239.21A, Workforce Management Manual, provides additional amplifying policy and requirements.

text: NUWC Division Keyport 610 Dowell Street Keyport, WA 98345-7610

OPSEC Program Manager

--- All classified documents must be destroyed using a National Security Agency (NSA) approved high security crosscut shredder listed on the NSA/CSS evaluated products list for high security crosscut paper shredders, or other method APPROVED by the Command Security Officer for destroying classified information.

-- Safeguarding of Unclassified Technical Information - Safeguarding requirements and procedures for unclassified controlled technical information. The Contractor shall provide adequate security to safeguard unclassified controlled technical information from compromise. To provide adequate security, the Contractor shall follow Defense Federal Acquisition Regulation Supplement (DFARS) 204.7300. DFARS 204.7304, Safeguarding Covered Defense Information and Cyber Incident Reporting, also will be followed and adhered to.

-- This contract requires access to information subject to Alternative Compensatory Control Measures (ACCM) as identified in Block 10i NAVSEAINST S5510.18 (SECURITY POLICY FOR STEALTH PERFORMANCE DATA WITH ALTERNATIVE COMPENSATORY CONTROL MEASURES (ACCM) applies. This DD254 does not grant access to, does not permit the creation of, or allow the storage of controlled data. ACCM Information as Authorized by PMS 392 and/or PMS 450.

-- Policy - All Personal Electronic Devices or equipment capable of recording, storing, transmitting, or exporting data such as photographic images or audible information of any kind are strictly prohibited in any NUWC Keyport areas where classified, U-NNPI, or other CUI is exposed, processed, or discussed. Electronic devices with these capabilities are NOT authorized at any time in secure rooms, controlled access areas, classified conference rooms, or where classified information is processed, stored, or discussed.

CONTROLLED UNCLASSIFIED INFORMATION (INCLUDES FOR OFFICIAL USE ONLY INFORMATION)

Ref: (a) DoD Regulation 5200.01-V4, DoD Information Security Program

(b) SECNAV M-5510.36B, DON Information Security Program Manual

1. Handling/Storage: Access to FOUO is limited to those needing it to conduct official business for the Department of Defense (DoD). FOUO information is not classified information, but requires extra precautions to ensure it is not released to the public. During business hours, reasonable steps shall be taken to minimize risk of access by unauthorized personnel. After business hours, FOUO information shall be stored in unlocked containers, desks, or cabinets if Government or Government-contracted building security is provided. If it is not, store in locked desks, file cabinets, bookcases, locked rooms, or similar items.

2. Transporting/Transmitting/Release/Destruction: FOUO information shall be transported in a manner that prevents disclosure of the contents. FOUO information may be sent via USPS first-class mail, parcel post, or – for bulk shipments – 4th class mail. Electronic transmission of FOUO information (voice, data, or facsimile) shall be by approved secure communications systems. Transmission via unsecure fax is acceptable if an authorized person is standing by on the receiving end to take custody. All emails containing FOUO or attachments with FOUO must be digitally signed and encrypted when transmitted within a Navy network or to an approved contractor email address. Transmission of FOUO (i.e. any CUI) to personal email accounts (e.g. AOL, Yahoo, Hotmail, Comcast, etc.) is strictly prohibited. FOUO sent out of the contractor’s facility electronically must be encrypted (DoD FIPS 140-2 standard). FOUO material shall not be released outside the contractor’s facility except to representatives of DoD. When no longer needed, destroy FOUO by a method that precludes its disclosure to unauthorized individuals.

3. Markings: Unclassified documents (paper or electronic) generated in support of this contract which contain FOUO are to be marked “For Official Use Only” per references a and b listed above. Other records, such as photographs, films, tapes, or slides, shall be marked “For Official Use Only”, “FOUO”, "Controlled Unclassified Information" or "CUI" in a manner that ensures that a recipient or viewer is aware of the status of the information therein. DS on technical documents identify access restrictions. DS “B” through “D” preclude public release and while not marked as FOUO, are subject to all FOUO protection requirements, including the prohibition on unencrypted transmission over the public Internet.

-- EXPORT CONTROLLED ADDENDUM

1. HANDLING: Access to Export Controlled material shall be limited to those employees needing the material to conduct official business for the Department of Defense. Export Controlled is not a classification, but requires extra precautions to ensure it is not improperly released.

2. STORAGE: During normal duty hours, place Export Controlled material in an out-of-sight location if your work area is accessible to persons who do not have a valid need for the material. After normal duty hours, store Export Controlled material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided. When there is not internal security, locked buildings or rooms usually provide adequate after-hours protection. For additional protection, store Export Controlled material in locked containers such as file cabinets, desks or bookcases. Expenditure of funds for security containers solely for the protection of Export Controlled material is prohibited.

3. TRANSPORTING: Export Controlled information shall be transported in a manner that prevents disclosure of the contents. Export Controlled information may be sent via first-class mail or parcel post. Bulky shipments, such as distributions of Export Controlled Directives or testing materials, that otherwise qualify under postal regulation, may be sent by fourth-class mail.

4. TRANSMISSION: Export Controlled can be transmitted electronically within the contractor’s facility. Export Controlled sent out of the contractor’s facility must meet FIPS 140-2 encryption.

5. RELEASE: Export Controlled material shall not be released outside the contractor’s facility except to DoD employees. Subcontracting must be authorized by the COSR.

6. DESTRUCTION: When no longer needed, Export Controlled material shall be disposed of by a method that precludes its disclosure to unauthorized individuals.

7. MARKINGS: a. For standard written or printed material, the following warning statement shall appear on the face of the document and title page. If the technical information is not in standard written or printed form and does not have a cover or title page, the distribution statement shall be conspicuously stamped, printed, or written by other means.

“WARNING – This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec. 2751 et seq.) or Executive Order 12470. Violators of these export laws are subject to severe criminal penalties.”

b. The following destruction statement will be applied to all technical documents containing Export Controlled information:

“Destroy by any method that will prevent disclosure of contents or reconstruction of the document.”

c. The following distribution statement D will be applied to all technical documents/drawing containing Export Controlled information:

“DISTRIBUTION STATEMENT D: Distribution authorized to Department of Defense and U.S. DoD contractors only, Critical Technology, Export Controlled, (18 December 2019). Other requests shall be referred to Program Executive Officer, Submarines, 1333 Isaac Hull Avenue, SE, Washington Navy Yard, DC, 20376.”

d. Other records, such as media, photographs, films, tapes, slides, CDs and AIS storage media shall also be marked with the above warnings and destruction statement.

-- HANDLING REQUIREMENTS FOR NORTH ATLANTIC TREATY ORGANIZATION (NATO) INFORMATION

Reference (a): USSAN 1-69

1. NATO classified and unclassified information is governed by USSAN 1-69 United States Implementation of NATO Security Procedures, 21 Apr 82. This directive establishes procedures and minimum security standards for the handling and protection of NATO classified information.

2. Prior approval of the NUWC Keyport Security Officer or his designated alternates (Code 105, 360-396-2015/5161/2822) is required before the prime contractor or the subcontracting facility can be granted access to or store NATO material at their facility NO EXCEPTIONS.

a. DoD and contractor employees may have access to NATO classified information only when access is required in support of a U.S. or NATO program which requires such access (i.e., "need-to-know"). A contractor can only be granted access to NATO material at NUWC Keyport if there is an established requirement to perform tasks noted in the SOW/PWS, access must be approved by the COR/TOM/TR and final approval authorized by the NCO/Alternate. NO EXCEPTIONS.

b. Access to NATO classified information requires a final DoD personnel clearance at the equivalent level and a NATO briefing as described in ref (a).

c. A NATO Facility Clearance Certificate is required for any contractor to negotiate or perform on a NATO classified contract or subcontract. A U.S. contractor qualifies for a NATO facility clearance if it has an equivalent U.S. clearance, its personnel who require access have been briefed on NATO procedures and the requirements of the NISPOM are met. The Defense Industrial Security Clearance Office (DISCO) will provide the NATO Facility Clearance Certificate to the requesting NATO command or agency.

d. Prior to having access to NATO classified information, contractor and government personnel must be given a NATO security briefing. The contractor FSO will initially be briefed by the CSO. Thereafter, the FSO shall ensure that the required briefings are administered to employees who require access to NATO classified information. Government employees and military personnel will be briefed by their security manager or a designee. The NATO briefing must cover security requirements and the consequences of negligent handling of NATO classified information. Annual refresher briefings will be conducted. When access to NATO classified information is no longer required, personnel will be debriefed, as applicable, and acknowledge their responsibility for safeguarding the NATO information. The briefing may be accomplished by requiring the person to read a documentary presentation and sign the certificate.

e. Contractors and DoD personnel will not release or disclose NATO classified information to a third party, including subcontractors, without the prior written approval of the controlling organization, command, agency or staff. Requests are to be submitted direct to the contracting agency for DoD Component contracts. They will be submitted through the CSO for NATO contracts and non-NATO contracts awarded by a NATO member nation.

f. NATO classified documents are to be stored as prescribed in DoD Directive 5100.55 and the NISPOM for U.S. documents of an equivalent classification level. However, NATO documents must not be co-mingled with U.S. or other documents and must be accounted for at all times.

g. When contractors are required to use SIPRNET they are required to be briefed and granted access to NATO material.

h. When contractors are working in a laboratory where NATO material is processed and stored or an office where NATO material is kept they need to be briefed in the NATO program.

3. Questions regarding the handling of NATO material may be directed to the Keyport Security Office, 360-396-2822.

-- Security classification guides (OPNAVINST 5513 series) and controlled unclassified information (CUI) (e.g., FOUO, distribution statement controlled) are not authorized for public release; therefore, they cannot be posted on a publicly accessible web-server or transmitted over the internet unless appropriately encrypted. Request for public release cannot be transmitted via the internet until the contractor receives final approval from NUWC Keyport.

-- All security aspects of this contract fall under the cognizance of NUWC Keyport WA Command. Contact the NUWC Keyport Security Officer for any questions regarding the content of this DD254.

-- All reports of contractor security violations and/or incidents associated with this contract shall be mailed by the cognizant DCSA field office directly to the certifying officials in Blocks 16 and 17 of this DD254.

-- All classified information involved in security incidents shall be retained and provided to the certifying officials in Blocks 16 and 17 of this DD254 for classification review.

-- All security related requests pertaining to this contract shall be submitted in writing by the Contractor's FSO to the individual identified in Block 17 of this DD254.

-- All security related issues, incidents, or requests pertaining to this contract shall be presented in writing by the contractor's Facility Security Officer (FSO) to the individual identified in blocks 16 and 17 of this DD254. The contractor shall abide by other reporting requirements outlined in the NISPOM.

-- Classified or unclassified technical papers to be presented at classified symposiums must be approved by the certifying officials in Blocks 16 and 17 PRIOR to presentation.

- All Contractor requests for sharing of classified and other sensitive information between prime and subcontractors must be forwarded in writing to the Government Security Office identified in blocks 16 and 17 of this DD254 for approval.

-- Forward a copy of subcontractor DD 254s issued under this contract to the official shown in blocks 16 and 17 of this DD254.

POINT OF CONTACT INFORMATION:

Contract Specialist: Mr. Brett Markle, NUWC Keyport Code 02, Phone 360-, email: brett.markle@navy.mil

Contracting Officer's Representative: Ms. Andrea Hinds, NUWC Keyport Code 222, Phone 360-315-5610, email: andrea.hinds@navy.mil

Contracting Officer: Karen Smith, NUWC Keyport Code 02, Phone 360-396-2594, email: karen.l.smith@navy.mil

Security Office Representative: Ms. Daphne Perez, NUWC Keyport, Industrial Security Code 105, 360-396-2015, Email: daphne.perez@navy.mil

-- No further information. --

Division, Keyport Code 22 610 Dowell St.

Keyport, WA 98345-7610 Address: Naval Undersea Warfare Center Division Security Division Code 105 610 Dowell St. Keyport, WA 98345-7610