Attachment_6-_DD254_For_Bidding_Purposes_Only.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

48202 Bronson Rd. Building 2805 Patuxent River Maryland 20670 Block9: AIRCRAFT MAINTENANCE SERVICES FOR PRESIDENTIAL HELICOPTER PROGRAMS.

Requires Yankee White Access personnel identified by the COR.

Determination of need-to-know in connection with a classified visit is the responsibility of the individual/host who will disclose the classified information.

All contracts with non-Sensitive Compartmented Information and Non-Compartmented work that may reveal mission-related information of a sensitive activity or sensitive operation should be routed to the NAVAIR STILO for approval.

All instances of loss, compromise and electronic spillage of classified or controlled unclassified information shall be reported to the COR, TPOC, and Government Security Office within 24 hours of the incident occurring.

Block 10.j – Controlled Unclassified Information including For Official Use Only and Covered Defense Information (meeting the definition of 48 CFR 252.204–7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoDM 5200.01 (DoD Information Security Program: Controlled Unclassified Information (CUI)) Vol. 4 (enclosure 3 pages 11-18) available at http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf. Any product containing Covered Defense Information shall be assigned the appropriate distribution statement using the criteria set forth in DoDI 5230.24 (Distribution Statements on Technical Documents); and have this statement displayed per DoDI 5230.24, Enclosure 3-4.

All For Official Use Only (FOUO), Covered Defense Information (CDI), and program Controlled Unclassified Information (CUI) data transmitted and safeguarded via electronic means shall use approved encryption. The Contractor shall ensure that when transmitting FOUO/CDI, over non-secure e-mail (e.g. not connected to the Navy Marine Corps Intranet through Broadband Unclassified Remote Access System / Virtual Private network), those transmissions are encrypted using Department of Defense Public Key Infrastructure (PKI), or an approved DoD External Certificate Authority, in accordance with Public Key Infrastructure & Public Key Enabling, DoDI 8520.02, 24 May 2011.

Block 11.a – All classified information/material shall be provided by the contractor facility or Government Contracting Activity (GCA) and safeguarded at the approved actual performance site.

Block 11.j – OPSEC: While performing aboard NAVAIR or other U.S. military sites, the contractor shall comply with the provisions of OPNAVINST 3432.1, the local Command/Facility 3432 Instruction Series (OPSEC), as well as any procedures identified in Program-Specific Operations Security Plans and Program Protection Plans (PPP) as applicable. The contractor shall comply with any and all additional OPSEC security plans and requirements of the Hosting Command. All applicable OPSEC Plans will be provided by TPOC identified in Block 16. The prime contractor is responsible for subcontractor implementation of Operations Security.

The Contractor shall ensure that Contractor Owned and Operated Networks and Information Systems that process, store, display, manipulate, and/or transmit Unclassified Government Program data shall comply with the protective measures in accordance with DODI 8582.01

The Contractor shall apply the following statement on the bottom of the front/cover page of ALL IN-SERVICE TECHNICAL PUBLICATIONS:

“DISTRIBUTION STATEMENT D: Distribution authorized to the Depart of Defense and U.S. DoD Contractors only, Administrative Operational uses (June 2014). Other requests shall be referred to the Presidential Helicopters Program Office (PMA-274), Patuxent River, MD 20670.

WARNING- This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq.) or the Export Administration Act of 1979 (Title 50, U.S. C., App. 2401 et seq.), as amended. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.”

FOR ALL OTHER IN-SERVICE PROGRAM TECHNICAL DOCUMENTS:

“DISTRIBUTION STATEMENT F: Further dissemination only as directed by the Presidential Helicopters Program Office (PMA-274), Patuxent River, MD 20670 (June 2014) or higher DoD authority.

WARNING- This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq.) or the Export Administration Act of 1979 (Title 50, U.S. C., App. 2401 et seq.), as amended. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.”

FOR VH-92A MAINTENANCE MANUALS, AIRCRAFT INVENTORY XRAYS, OPTIMIZED ORGANIZATIONAL MAINTENANCE ACTIVITY (OOMA) DATA, MISSION MAINTENANCE DATA COMPUTER (MMDC) AND MISSION COMMUNICATION SYSTEM (MCS) FAULT INFORMATION DOWNLOADED FROM THE AIRCRAFT, AND HEALTH AND USAGE MONITORING SYSTEM (HUMS) DATA WITH THE EXCEPTION OF LATITUDE AND LONGITUDE AND AUXILIARY POWER UNIT (APU) START TIME.

“DISTRIBUTION STATEMENT D: Distribution authorized to the Department of Defense and U.S. DoD contractors only Administrative or Operational Use (July 2018). Other requests shall be referred to the Presidential Helicopters Program Office (PMA-274), Patuxent River MD 20670.

WARNING- This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq.) or the Export Administration Act of 1979 (Title 50, U.S. C., App. 2401 et seq.), as amended. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.”

FOR ALL OTHER VH-92A TECHNICAL DOCUMENTS:

“DISTRIBUTION STATEMENT F: Further dissemination only as directed by the Presidential Helicopters Program Office (PMA-274), Patuxent River, MD 20670 (December 2015) or higher DoD authority.

WARNING- This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq.) or the Export Administration Act of 1979 (Title 50, U.S. C., App. 2401 et seq.), as amended. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.”

Reporting Security Violations

A violation is any knowing, willful, or negligent action that could reasonably be expected to result in an unauthorized disclosure of classified information. An unauthorized disclosure or release of classified or FOUO information is the communication, physical transfer, inadvertent, unauthorized, or illegal conveyance of technical program information, in any manner, to an unauthorized recipient, or to any person(s) not previously authorized by PMA-274, or higher DoD authority. Methods of disclosure or release include oral, physical and visual.

For all security violations and unauthorized disclosures or releases of VH program classified or FOUO information, the Contractor shall notify the PMA-274 Program Security Manager (PSM) within 24 hours regarding any violation upon first identification/detection/notification of the incident regardless of how the Contractor became aware of the information.

The Contractor shall use the “Administrative Inquiry (AI) Process Job Aid”, located at the DSS Website: http://www.cdse.edu/documents/cdse/ai-job-aid-for-industry.pdf to submit preliminary, initial, and final reports as required by the NISPOM. For classified information, the Contractor shall comply with the timelines in the Job Aid. For FOUO, the Contractor shall submit the Preliminary and Initial Reports within 72 hours, and 30 days for the Final Report.

The Contractor shall report all cyber-security intrusions/incidents involving the potential compromise, exfiltration, or other loss of any VH PROGRAM FOUO data on the Contractor’s information system to the Department of Defense (DoD)-Defense Industrial Base (DIB) Collaborative Information Sharing Environment (DCISE) at: http://www.dc3.mil/dcise/dciseAbout.php . Initial reports shall be made within 24 hours upon first identification/detection/notification of the intrusion/incident regardless of how the Contractor became aware of the information. Initial report information should include the following information, as available:

a. Applicable dates, including date of compromise and date of discovery

b. Threat methodology, including all known “resources” used (e.g., IP addresses, domain names, software tools)

c. An account of what actions the threat(s) may have taken on the victim system/network

d. What information may have been compromised, exfiltrated or lost and its potential impact on Government programs

The Contractor shall provide copies of reports to the PMA-274 Program Security Manager at the same time they are submitted to other organizations. Reporting security violations to the PMA-274 PSM does not replace the reporting requirements to other organizations.

Corrective Actions/Conclusions:

Upon completion of the final report, the Contractor shall develop and implement a risk mitigation plan to correct identified security vulnerabilities/deficiencies within 30 days of final report and provide mitigation plan(s) and evidence of implementation to the PMA-274 PSM. The Contractor shall notify PMA-274 PSM (in writing) for any specific security deficiency requiring corrective action that exceeds 30 days.

VH PROGRAM PERSONNEL SECURITY REQUIREMENTS

Scope Due to the sensitivity of the VH platforms, additional PERSEC requirements are required once aircraft, equipment, spares, components are identified or begins modification. This program implements and follows the provisions of Department of Defense (DoD) 5200.2-R, which prescribes the procedures for ensuring appropriate investigative requirements are met, suitability and eligibility adjudications have been rendered, and the proper level of security clearance has been granted to all personnel requiring access to classified material. Additionally, this program has an access requirement for Presidential Support Duties (PSD), administratively called “Yankee White” (YW).

1. Yankee White (YW) Access Requirements Personnel performing PSD under this contract shall be designated as Category Two. In accordance with (IAW) DoD Directive (DoDD) 5210.55 and DoD Instruction (DoDI) 5210.87, YW access is required for those individuals who are part of organizations that are in direct support of the President and Vice President of the United States. All personnel requiring unescorted access to the VH Aircraft including spares and parts or performing hands on duties shall have YW access.

Examples of positions that will require YW include:

a. Security Personnel (guards)

b. Quality Assurance

c. Inspectors

d. Mechanics/Technicians

e. Electricians

f. Painters

g. Software Test and Acceptance Inspectors

h. Direct Support Engineers

i. Tool Room Workers

j. Level III Warehouse, Shipping and Receiving Workers

k. Pilots and other Aircrew

l. Flight Test Engineers

m. Maintainers

n. Assemblers

o. Appropriate Supervisors and Managers

p. Test Personnel

1. Minimum requirements for nomination include:

a. U.S. Citizenship

b. High degree of maturity, discretion and trustworthiness

c. Unquestionable loyalty to the United States

d. Satisfactory past and present duty performance

2. Pre-Screening Personnel requiring YW access shall undergo a pre-screening interview prior to the submission of a Single Scope Background Investigation (SSBI) IAW policies and procedures outlined in DoDI 5210.87. A guideline for the pre-screening interview may be found in the Marine Corps Order (MCO) 1326.7E (Enclosure 2). Any issues identified during the pre-screening will be vetted through the PMA-274 Personnel Security Specialist, prior to the submission of the SSBI. Pre-screening may include a credit check conducted by the employing organization. The PMA-274 Personnel Security Specialist has the authority to determine whether processing shall continue.

Enclosure 4 of DoDI 5210.87 provides a listing of disqualifying and discretionary criteria. In addition to the information listed in the DoDI 5210.87, all DoD adjudicative guidelines are taken into consideration and thoroughly reviewed. The presence of a DoD adjudication does not indicate eligibility for YW. Denial or revocation of a security clearance for access to classified information shall automatically result in disqualification for PSD. In the matter of “Financial Considerations” no nomination packages shall be submitted for individuals that:

a. Have filed bankruptcy in the last seven years

b. Have open or unpaid collection accounts listed on their credit reports

c. Have open liens

d. Have failed to file State or Federal income tax returns, or

e. Have multiple (more than ten) delinquent (past or present) accounts reflected on their credit reports

All individuals that have five delinquencies (past or present) shall be required to submit an explanation for each delinquent account and provide a personal financial statement.

Additional information regarding disqualifying, discretionary and mitigating criteria may be addressed with the PMA-274 Personnel Security Specialist on a case by case basis, depending on individual circumstances.

Upon the submission of the SSBI to the investigating agency, the company shall provide the PMA-274 Personnel Security Specialist with a nomination package. Nomination packages shall be submitted IAW methods and procedures to protect Personally Identifiable Information (PII). The nomination package shall contain the following documentation:

a. A copy of the pre-screening interview

b. A copy of page one (with personal identifying information) of e-QIP

c. Letters annotating the verification of citizenship, medical (if applicable) and the local files check

d. A copy of the internal nomination form utilized by the company. At a minimum, this form shall include the individual’s full name and Social Security Number (SSN), the position title, and routing of concurrence through the appropriate company management channels, to include the security office.

3. Nominating Personnel The Contractor and sub-contractors shall develop, update and maintain company specific lists of individuals nominated for and in the YW nomination process. When there are sub-contractors with employees who shall require YW, the sub-contractor shall coordinate all nominations with the Prime. YW requires an SSBI re-investigation every five years. It is the responsibility of the company to ensure that background investigations are submitted in a timely manner to the investigating agency and that the PMA-274 Program Office is notified of the submission. The following documentation shall be provided to the PMA-274 Personnel Security Specialist at time of submission of a re-investigation:

a. A copy of page one (with personal identifying information) of e-QIP

b. Letters annotating the medical (if applicable) and the local files check

Once the background investigation is completed and adjudicated, the PMA-274 Personnel Security Specialist shall obtain a copy of the background investigation. The PMA-274 Personnel Security Specialist shall review and document the findings of the background investigation and any other information available. If information is revealed during the background investigation that has not been previously brought forth or requires additional explanation, the PMA-274 Personnel Security Specialist shall make contact with the appropriate facility Security Point of Contact (POC) to obtain that information. It is the responsibility of the facility Security POC to ensure that information is provided back to the PMA-274 Personnel Security Specialist in a timely manner (normally, within five working days).A complete nomination package consists of:

a. A Joint Personnel Adjudication System (JPAS) printout

b. Letters (documentation) reflecting the result of the citizenship verification, medical certificate (if appropriate) and local files check.

c. A completed SSBI/SSBI – Periodic Review (SSBIPR)

d. A credit report dated within one year (if the background investigation is current, the credit report contained in the background investigation will be used; if the background investigation is over nine months old, the individuals employer will be responsible for providing a current (within one year) credit report. This credit report must be from a third party and cannot be provided by the individual.

e. Statement(s) from the individual, explaining and issues identified during the vetting process

f. A cover letter (recommendation) from the PMA-274 Personnel Security Specialist (Enclosure 6, to DoDI 5210.87, shows a sample transmittal memorandum) to the Navy-White House Liaison Office (WHLO), Office of the Secretary of the Navy.

The PMA-274 Personnel Security Specialist will maintain the original letters and notify the facility Security POC of the decision. Once an approval is final, the individual may be allowed unescorted access within the restricted area.

If an individual is not selected for PSD an individual shall be afforded the opportunity to appeal the decision. The appeal must be submitted IAW the instructions on the non-selection letter from the Office of the Secretary of Defense (OSD). If the decision is upheld, the individual will be removed from further consideration for PSD. A non-selected individual is not authorized access (escorted or unescorted) in the restricted areas.

The YW process is time-consuming and can take anywhere from 180 to 365 days to complete. Managers shall plan for delays and forecast replacement personnel who may require YW access one year in advance of their anticipated assignment.

4. Indoctrination and Training The facility Security POC is responsible for developing an indoctrination and debriefing program for individuals with YW. Any briefs, forms etc., associated with this program shall be provided to the PMA-274 Personnel Security Specialist for concurrence prior to utilization. Any changes to established documentation shall be provided to the PMA-274 Personnel Security Specialist.

5. Yankee White Access Denials If at any time, during the nomination, investigation, and adjudication or while an individual is in an “approved” YW status, if derogatory information becomes known about an individual, this information shall be reported to the PMA-274 Personnel Security Specialist within 24 hours upon first identification/detection/notification of the derogatory information, regardless of how the Contractor became aware of the information.

Follow on reports and documentation shall be provided to the PMA-274 Personnel Security Specialist in weekly intervals, until there is final disposition. The PMA-274 Personnel Security Specialist shall make an “interim” determination on the individual’s YW access, pending a final decision by OSD. Reporting to PMA-274, does not alleviate the responsibility to follow NISPOM guidance for reporting the adjudicating facility. If an individual no longer has the requirement for the YW access for administrative reasons (left the company, retired, took new position, etc.), the PMA-274 Personnel Security Specialist shall be notified in writing.

If an individual leaves the program for administrative reasons, upon check-out the facility security POC shall verify with the individual, that they are not going to a position that has a YW requirement. Efforts to transfer an individual from one organization to another must be coordinated with the PMA-274 Personnel Security Specialist. The facility Security POC shall provide the PMA-274 Personnel Security Specialist a monthly report indicating all personnel nominated, approved and removed from PSD. This report shall be provided by the fifth working day of the month.

References:

a. DoD 5200.2-R, “Department of Defense Personnel Security Program,” January 1987

b. DoDD 5210.55, “Department of Defense Presidential Support Program,” 15 December 1998

c. DoDI 5210.87, “Department of Defense Instruction, Selection of DoD Military and Civilian Personnel and Contractor Employees for Assignment to Presidential Support Activities (PSA’s),” 30 November 1998

d. Marine Corps Order (MCO) 1326.7E, “Selection and Screening Criteria for Marines Assigned to Marine Helicopter Squadron One (HMX-1),” 30 November 2004

e. DoD 5220.22-M, “National Industrial Security Program Operating Manual (NISPOM),” 28 February 2006

PMA-274

48202 Bronson Rd. Building 2805 Patuxent River Maryland 20670 Address: PROGRAM EXECUTIVE OFFICER PMA-234

48183 SHAW ROAD, BLDG 2806

PATUXENT RIVER, MD 20670-1547