FOUOPS - DD254 SOLICITATION N00253-20-Q-0063 VTC HOWARD D.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification

610 Dowell Street Keyport, WA 98345-7610

Email: KYPT_PAO@navy.mil

•Item 10.g: Access to NATO information is not required for performance of this contract. However, access to the SIPRNET is required and current regulations require a NATO briefing prior to SIPRNET access.

•Item 10.j: Controlled Unclassified Information (CUI)) including For Official Use Only (FOUO) information, must be protected per DoDM 5200.01-V 4, as specified in the CUI/FOUO protection clause in the contract. It is emphasized that unencrypted transmission of CUI/FOUO via the Internet is strictly prohibited. Amplifying guidance is provided in Attachment 1.

• Item 11.a: Classified contract performance is restricted to NUWC Division, Keyport facilities located at Keyport, WA/Bangor WA and government activities/units as identified within the contract solicitation or on official travel orders generated in support of the contract, as approved by the government. Security Classification of Equipment, Components, Spaces and Documents: The Equipment, Space or Document may be classified and subject to the applicable provisions of EKMS-1E and SUPP-1 Policy and Procedures for Key Management Infrastructure Operating Accounts; DOD 5220.22-M, Industrial Security Program Operating Manual; SECNAV M-5510.36B, DON Information Security Program Manual; SECNAV M-5510.30, Personnel Security Program Manual; NUWCDIVKPT 5510.1, Information Security Program Manual; NUWCDIVKPT 5530.2, Personnel Security Program Manual; NUWCDIVKPT 5530.1, Physical Security Program Manual; and NUWCDIVKPT 5239, Information Assurance Program. Security classification guidance will be provided on site by the government activity or contracting facility. Contractor personnel supporting work on-site at Keyport/Bangor/Hawthorne require a security clearance level of up to Secret.

• Item 11.j: Operations Security (OPSEC) requirements: Contractor personnel are subject to applicable provisions of NAVSEAINST 3432.1A OPSEC Program and NUWCDIVKPT 3432.1 OPSEC Program. Contractor personnel supporting this task order must complete annual government-provided OPSEC awareness training (arranged through the COR). Contractor personnel will have access to government Critical Information (CI) and Indicators and Observables that may indirectly disclose CI. CI includes, but is not limited to: Ship movements and schedules, weapons and sensor system installations, capabilities, and configurations; specific platform installations and characteristics, test schedules, deficiencies and vulnerabilities. Indicators and Observables may include, but are not limited to: Outdoors system testing; ship’s external hull or superstructure modifications; shipboard equipment, ordnance, weapons, fuels, and/or stores loading/unloading operations, and/or personnel or aircraft embarkation. No CI, Indicators, or Observables maybe divulged to third parties (including other company employees who are not subject to this contract) without approval of the local command Security Officer, or the NUWC Keyport OPSEC Program Manager.

• Item 11.l: Controlled Unclassified Information (CUI), including For Official Use Only (FOUO) information, must be protected per DoDM 5200.01-V4, as specified in the CUI/FOUO protection clause in the contract. It is emphasized that unencrypted transmission of CUI/FOUO via the Internet is strictly prohibited.” Amplifying guidance is provided in Attachment 1.

• Item 11.m: Access to government IT systems. Personnel accessing Government IT systems in the performance of contract work must meet Department of Navy (DON) Personnel Security Program (PSP) Instruction. SECNAV M-5510.30 Paragraph 5-3, sub paragraphs b(6) (a), b(6) (e), b(6) (f), b(6) (g), and Exhibit 5A, Performance requirements are at the IT-1 Critical Sensitive position for contractors performing these functions. The IT-1 positions require full positive adjudication of a Single Scope Background investigation (SSBI), PPR, T5, or T5R. Additionally, per DOD Manual 8570-1 M (Change 3): C2.3.8 Contractor personnel supporting lA functions shall obtain the appropriate DOD-approved lA baseline certification prior to being engaged. Additional training on local or system operating systems or procedures must be met within 6 months of engagement. C3.2.3.3 Contract personnel must comply with the DOD and Vendor CEU requirements to maintain their lA baseline certification. Tables C3.T4, C3.T5, Paragraphs C7 .3.4 and AP3.1.5, performance requirements will be set at the Information Assurance Technical (IAT) level II and all training and certification specification are required to be met for any contracted employee. Secretary of Navy Manual (SECNAVMAN) SECNAVMAN 5239.21A Workforce Management Manual provides additional amplifying policy and requirements.

14. ADDITIONAL SECURITY REQUIREMENTS: Contractor employees embedded in government work spaces will be included in the command security education program per SECNAV M-5510.36 (11-4.2.a) and must complete prescribed DoD/DoN training requirements via Total Workforce Development System (TWMS) and/or Keyport's Workforce Development System (WDS). Contractor employees shall review each NUWCDIVKPT Security Training Bulletin online at the training website. Embedded employees with a Secret or above security clearance must annually attend a locally provided NCIS counterintelligence briefing and Derivative Classifiers training (i.e., those who create new documents, including e-mails, based on existing classification guidance) as required by DoDM 5200.01 V-1 with an emphasis on avoiding over-classification, at every years.

• All classified documents must be destroyed using a National Security Agency (NSA) approved high Security crosscut shredder listed on the NSA/CSS evaluated products list for high security crosscut paper shredders, or other APPROVED method by the Command Security Officer for destroying classified information.

• Safeguarding of Unclassified Technical Information - Safeguarding requirements and procedures for unclassified controlled technical information. The Contractor shall provide adequate security to safeguard unclassified controlled technical information from compromise. To provide adequate security, the Contractor shall follow FARS Clause 204.7300. Safeguarding Covered Defense Information and Cyber Incident Reporting FARS Clause 204.7304 also will be followed and adhered to.

• Contractor will adhere to FARS Clauses: 52.224-1 & 52.224-2. Specifically, as Follows: Privacy Act Notification (Apr 1984) - The Contractor will be required to design, develop, or operate a system of records on individuals, to accomplish an agency function subject to the Privacy Act of 1974, Public Law 93-579, December 31, 1974 (5 U.S.C.552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties. The Contractor agrees to --(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies – (i) The systems of records; and (ii) The design, development, or operation work that the contractor is to perform; (2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and (3) Include this clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records. (b) In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency. (c) (1) “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records. (2) “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph. (3) “System of records on individuals,” as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

• All reports of contractor security violations associated with this contract shall be mailed by the cognizant DSS field office directly to the certifying official in Block 17 and Security Office Representative in block 14 of this DD Form 254.

• All classified information involved in security incidents shall be retained and provided to the certifying official in block 16 (a) and Security Office Representative in block 14 of this DD Form 254 for classification review.

• All security related requests pertaining to this contract shall be submitted in writing by the contractor's Facility Security Officer (FSO) to the Security Office Representative identified in Block 14 of this DD Form 254.

• All security aspects of this contract fall under the cognizance of NUWC Division, Keyport Command. Contact the NUWC Division, Keyport Contracting Security Officer for any questions regarding the content of the DD Form 254.

• The transfer of unclassified/controlled unclassified information/technical data to and from the Government or other associated activities must be accomplished via encrypted e-mail or DoD SAFE (https://safe.apps.mil/) only.

• Classified or unclassified technical papers to be presented at classified symposiums must be approved by the contract Technical Point of Contact (TPOC), Contracting Officer's Representative AND contract Security Office Representative PRIOR TO presentation.

• All contractor requests for sharing of classified and other sensitive information between prime contractors must be forwarded in writing to the government security office identified in Block 17(c) of this DD Form 254 for approval.

• Copies of all subcontract DD Form 254s must be provided to the Government security office identified in Block 17(c) of this DD Form 254.

• Media requests related to this project shall be directed to the Public Affairs Office (PAO) listed in Block 12 of this DD form 254.

• Policy - All Personal Electronic Devices or equipment capable of recording, storing, transmitting, or exporting data such as photographic images or audible information of any kind are strictly prohibited in any NUWC Division, Keyport areas where classified, U-NNPI, or other CUI is exposed, processed, Or discussed. Electronic devices with these capabilities, are NOT authorized at any time in secure rooms, controlled access areas, classified conference rooms, or where classified information is processed, stored, or discussed.

• Contracting authority will provide security classification guidance on-site for the services to be performed.

• All contractor requests for sharing of classified and other sensitive information between prime contractors must be forwarded in writing to the government security office identified in Item 16.d of this DD254 for approval.

• Copies of all subcontract DD254s must be provided to the government security office identified in Item 16.d of this DD254.

• Security Classification Guides (OPNAVINST 5513 Series) and unclassified limited distribution documents (e.g. FOUO, Distribution Statement Controlled) are not authorized for public release; therefore, they cannot be posted on a publicly accessible web server or transmitted over the Internet unless appropriately encrypted to current DoD standards. Requests for public release cannot be transmitted via the Internet until the contractor receives final approval from the government.

• Per the requirements stated in the National Industrial Security Program Operation Manual (NISPOM) Dated February 2006, Chapter 5, Section 5, Paragraph 5-502, the Facility Security Officer (FSO) on the prime contract is authorized to flow down access to each subcontractor. It is the prime contractor FSO’s responsibility to ensure that all subcontractors have the appropriate access levels. It is also the prime contractor FSO’s responsibility to ensure that they have documented paperwork for each subcontract. If the current prime contractor FSO is replaced, it is the responsibility of the new FSO to inform NUWC Division Keyport in writing to security and the COR.

Contract Expiration Date: TBD

● The Contracting Officer is: TBD

● The Contracting Officer's Representative is: Debbie Howard, NUWC Division, Keyport Code 10B1, (360) 315-871, deborah.howard1@navy.mil

● The Contract Specialist is: TBD

● The OPSEC Manager is: Ms. Daphne JC Perez, NUWC Keyport, Code 105, (360) 396-2015, daphne.perez@navy.mil

● The Security Contracting Officer is: Ms. Daphne JC Perez, NUWC Keyport, Code 105, (360) 396-2015, daphne.perez@navy.mil

(END)

text: NUWC Division Keyport 610 Dowell Street Keyport, WA 98345-7610

OPSEC Manager

610 Dowell St.

Keyport WA 98345-7610