N3904026R0002 Attachment 6 DD Form 254.pdf

(Updated 20250815) CLASSIFICATION (When filled in): Unclassified

CLASSIFICATION (When filled in): Unclassified

25-028/26-002

PREVIOUS EDITION IS OBSOLETE. Page 1 of 5DD FORM 254, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

August 31, 2028

The public reporting burden for this collection of information, 0704-0567, is estimated to average 36 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED

(See Instructions)

Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER

N3904026R0002

DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

20251215

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

TBD

b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor) Add Row Remove Last Row Delete All Rows

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.) Add Row Remove Last Row Delete All Rows

a. LOCATION(S) (For actual performance, see instructions.)

Receipt Inspection Branch Code 133.3 Portsmouth Naval Shipyard Kittery, ME 03904

b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional) Portsmouth Naval Shipyard Code 1120 Portsmouth, NH 03804-5000 Director of Security Mr. Brian P. Gauthier Phone: 207-438-3520

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

The contractor shall provide Non-Nuclear technical support to the Receipt Inspection Branch (Code 133.3) of the QA Department at PNS.

25-028/26-002

PREVIOUS EDITION IS OBSOLETE. Page 2 of 5DD FORM 254, APR 2018

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.) h. FOREIGN GOVERNMENT INFORMATION

d. FORMERLY RESTRICTED DATA i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

U-NNPI/NNPI

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDI 5200.48, only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

Commander Portsmouth Naval Shipyard

Public Release Authority:

Portsmouth Naval Shipyard Public Affairs Officer, Code 1160 207-438-1525

13. SECURITY GUIDANCE Add Signature Remove Last Signature Delete All Signatures

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable

PDF.)

****This DD254 is for solicitation purposes only; therefore, it must be returned to PNSY SCO to be updated before the contract DD254 can be issued to the contractor.

1. In addition to clearances required herein, only employees certified by the contractor to be U.S. citizens will be permitted access to U.S.

work sites.

2. Performance of work will require access to areas where classified information, material, cannot be reasonably sanitized. All contractor employees performing duties under this contract must have, at a minimum, a final-adjudicated Secret Personnel Security Clearance (PCL) granted prior to being assigned to perform work at this facility. The contractor shall submit visit requests via the Defense Information System for Security (DISS) to SMO 39040. Visit requests submitted by other means will not be accepted without the Facility Officer signed verification as to the level of security clearance granted to each employee listed on the visit request.

25-028/26-002

PREVIOUS EDITION IS OBSOLETE. Page 3 of 5DD FORM 254, APR 2018

The following Security Classification Guide(s) or subsequent revisions apply to this contract. Subsequent revisions shall be provided by the Government contracting Activity (GCA) as Government Furnished (GFI) and shall be executed by the Contractor at no additional cost to the government..

Item: 10(j). All Controlled Unclassified Information (CUI) associated with this contract must be protected per guidance provided for Item 11(l) of this DD254.

Item: 10(k) 1. (U) Security Controls on the Dissemination of NNPI Received or Generated Under NAVSEA Contracts 12/1/2011.

Item: 10(k) 2. (U) OPNAVINST, N9210.3 Safeguarding of Naval Nuclear Propulsion Information (NNPI) 6/7/2010.

Item: 10(b) 3. (U) CG-RN-2, DOE-DoD Classification Guide for the NNPP dtd May 2024 (or successor), [overall SCG classification is

CONFIDENTIAL//RESTRICTED DATA]

Item: 10(k) 4. Processing of NNPI on non-federal IT systems requires NAVSEA 08 authorization per OPNAVINST N9210.3, using the procedures identified in NAVSEA ltr 08B/19-03823, dated 2 August 2019.

Item: 10(k) 5. The contractor must maintain a current Certification of eligibility from the Defense Logistics Agency, Joint Certification Office for access to export-controlled Controlled Unclassified Information (CUI), which includes U-NNPI. DD Form 2345, Militarily Critical Technical Data Agreement, applies.

Item: 10(k) 6. The contractor must provide a copy of the subcontractor DD254's issued under this, where NNPI is shared, to NAVSEA 08 Security via the NAVSEA 10G2 Industrial Security mailbox: usn.ncr.comnavseasyscomdc.mbx.SEA10G2-Industrial- Security@us.navy.mil/

Item: 11.(j). The Contractor shall utilize the NAVSEA Portsmouth Naval Shipyard Critical Information and Indicators List, Ser 1120-344 of December 4, 2024 to help identify and protect critical information associated with this contract.

Item: 11(j). Continued: During the period of this contract, the Contractor may be exposed to, use, or produce, NAVSEA PNS Critical Information (CI) and/or observables and indicators which may lead to discovery of CI. PNS’s CI will not be distributed to unauthorized third parties, including foreign governments, or companies under Foreign Ownership, Control, or Influence (FOCI).

Item: 11(j). Continued: Assembled large components/systems being transported to and from testing areas, other production or government facilities (whether or not on public roadways) shall be in an enclosed van trailer or covered flatbed trailer. Component/System outside storage, staging and test areas shall be shielded/obscured from public view wherever physically possible.

Item: 11(j). Continued: NAVSEA PNS CI shall not be publicized in corporate wide newsletters, trade magazines, displays, intranet pages or public facing websites. Media requests related to this project shall be directed to NAVSEA Public Release Authority listed in Item 12 of this DD Form 254.

Item: 11(j). Continued: Any attempt by unauthorized third parties to solicit, obtain, photograph, or record,or incidents of loss/ compromise of government Classfied or CI, Business Sensitive and Company Proprietary information related to this contract or other programs must be immediately reported to the Facility Security Officer, DCSA and /or the Naval Criminal Investigative Service, and Code 1120. Questions concerning these requirements shall be directed to NAVSEA PNS OPSEC manager.

Item: 11(j). Continued: Performance under this contract requires the contractor to adhere to OPSEC requirements. OPSEC requirements are additional to the requirements of DoD 5220.22-32 Vol , National Industrial Security Program Manual, therefore, the contractor may not impose OPSEC requirements on its subcontractors unless NAVSEA PNS OPSEC Manager approves the OPSEC requirements.

IItem: 11(l): Legacy information from exisiting documents (e.g. Technical Manuals) marked For Official Use Only or FOUO, that is used to create a new document/correspondence, shall follow the minimum marking requirements of DoDI 5200.48, Section 3, paragraph 3.4.a, and include the acronym “CUI” in the banner and the footer of the document. Nonfederal information systems storing and processing CUI shall be protected per NIST SP-800-171, or subsequent revisions. All transmissions to personal email accounts (AOL,Yahoo, Hotmail, Comcast, etc) and posting on social media websites (Facebook, Instragram, Twitter, LinkedIn, etc.) are prohibited. Destroy all CUI associated with this contract by any of the following approved methods: A cross-cut shredder, a certified commercial destruction vendor, a central destruction facility, incineration, chemical decomposition, pulverizing, disintegration, or methods approved for classified destruction.

Item: 11(l). U-NNPI CUI must be protected in accordance with OPNAVINST N9210.3 and may not be stored or processed on Non-federal

25-028/26-002

PREVIOUS EDITION IS OBSOLETE. Page 4 of 5DD FORM 254, APR 2018

AIS without written authorization of NAVSEA 08, Naval Reactors.

3. All classified documents must be destroyed using a National Security Agency (NSA) approved high security crosscut shredder listed on the NSA/CSS evaluated products list (EPL) for high security crosscut paper shredders, or other approved method for destroying classified information.

4. All classified information involved in security incidents shall be retained and provided to the certifying official in Block 17 of this DD254 for classification review. Copies if preliminary inquiry or investigative reports of security incidents involving classified information shall be scanned and forwarded to the certifying official in Block 17.

5. All security related issues, incidents, or requests pertaining to this contract shall be presented in writing by the contractor’s Facility Security Officer (FSO) to the individual identified in Block 17(a) of this DD254. The contractor shall abide by the other reporting requirements outlined in the NISPOM.

6. Classified or unclassified technical papers to be presented at a classified symposium must be approved by the Portsmouth Naval Shipyard Contracting Officer’s Representative (COR) prior to the presentation.

7. The Contractor must submit a request for sharing of classified and other sensitive information between prime contracts in writing to the individual identified in Block 17 of this DD254. Each request must reference contract number N39040-26-R-0002 to identify the specific information for which approval is being sought, a justification for needing to share the information, the name of the other contractor and its contract number under which the requested information will be shared.

8. Security Classification guides and unclassified limited documents (e. g., FOUO, Distribution Statement Controlled) are not authorized for public release; therefore, they can not be posted on a publicly accessible web server or transmitted over the internet unless appropriately encrypted. Request for public release can not be transmitted via the internet until the contractor receives final approval from NAVSEA PNS Security Office (Code 1120).

9. Personnel designated as derivative classifiers shall receive derivative classification training prior to access from the contractor’s Facility Security Officer (FSO). The FSO shall ensure personnel receive initial and biennial training during the life of this contract. Evidence of completion,training certificates or equivalent, shall be provided to the Information Systems Security Manager (ISSM) no later than the individual's due date.

10. Forward a copy of subcontractor DD 254s issued under this contract to the certifying official shown in Block 17 of this DD 254

11. POC for this contract is identified in Block 17 of this DD254

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form) Hide Attachment Bar

Items 10(k): Access to NNPI (UNNPI and NNPI NSI) is authorized for this contract. Processing of NNPI on IT systems requires authorization of SEA08.

NAME & TITLE OF REVIEWING OFFICIAL

Chris Wilhelm NNPICO

SIGNATURE

ATTCH1 CUI STATEMENT ATTCH4 1120-344-24 CI`

ATTCH2 NNPI CLAUSE

ATTCH3 OPSEC STATEMENT

NAME & TITLE OF REVIEWING OFFICIAL

Allen Needham / OPSEC Program Manager

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

25-028/26-002

PREVIOUS EDITION IS OBSOLETE. Page 5 of 5DD FORM 254, APR 2018

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

Item: 10(k) NNPI: Access to NNPI is required for this contract; (U) OPNAVINST, N9210.3 Safeguarding of Naval Nuclear Propulsion Information (NNPI) 6/7/2010 applies.

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

Item: 10(k) NNPI: NAVSEA 08 maintains authority to inspect for protection of NNPI (Unclassified and NSI)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

Contracting and Logistics Department

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

N39040

c. ADDRESS (Include ZIP Code)

Contracting and Logistics Portsmouth Naval Shipyard Code 410 Kittery, ME 03904

d. POC NAME Marilyn Fletcher

e. POC TELEPHONE (Include Area Code)

+1 (207) 438-6349

f. EMAIL ADDRESS (See Instructions) marilyn.g.fletcher2.civ@us.navy.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

White, Norma L.

b. TITLE

Industrial Security Specialist Program Mgr./SCO

c. ADDRESS (Include ZIP Code) Portsmouth Naval Shipyard Code 1123 Portsmouth, NH 03804

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

N39040

e. CAGE CODE OF THE PRIME CONTRACTOR

(See Instructions.)

f. TELEPHONE (Include Area Code)

+1 (207) 438-1544

g. EMAIL ADDRESS (See Instructions) norma.l.white.civ@us.navy.mil

h. SIGNATURE

i. DATE SIGNED (See Instructions)

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

08U

PORTSMOUTH NAVAL SHIPYARD CONTRACT CLAUSE FOR PROTECTION OF CONTROLLED

UNCLASSIFIED INFORMATION (CUI)

DoDI 5200.48, March 6, 2020

1.2. POLICY.

It is Department of Defense (DoD) policy that:

a. As part of the phased DoD Controlled Unclassified Information (CUI) Program implementation process endorsed by the CUI Executive Agent (EA) pursuant to Information Security Oversight Office (ISOO) Memorandum dated August 21, 2019, the designation, handling, and decontrolling of CUI (including CUI identification, sharing, marking, safeguarding, storage, dissemination, destruction, and records management) will be conducted in accordance with this issuance and Sections 252.204-7008 and 252.204-7012 of the Defense Federal Acquisition Regulation Supplement (DFARS) when applied by a contract to non-DoD systems.

b. All DoD CUI must be controlled until authorized for public release in accordance with DoD Instructions (DoDIs) 5230.09, 5230.29, and 5400.04, or DoD Manual (DoDM) 5400.07. Official DoD information that is not classified or controlled as CUI will also be reviewed prior to public release in accordance with DoDIs 5230.09 or5230.29.

c. Information will not be designated CUI in order to:

(1) Conceal violations of law, inefficiency, or administrative error.

(2) Prevent embarrassment to a person, organization, or agency.

(3) Prevent open competition.

(4) Control information not requiring protection under a law, regulation, or government-wide policy, unless approved by the CUI EA at the National Archives and Records Administration (NARA), through the Under Secretary of Defense for Intelligence and Security (USD(I&S)).

d. In accordance with the DoD phased CUI Program implementation, all documents containing CUI must carry CUI markings in accordance with this issuance.

e. Although DoD Components are not required to use the terms “Basic” or “Specified” to characterize CUI at this time, DoD Components will apply:

(1) At least the minimum safeguards required to protect CUI.

(2) Terms and specific marking requirements will be promulgated by the Under Secretary of Defense for Intelligence and Security (USD(I&S)) in future guidance.

f. Nothing in this issuance alters or supersedes the existing authorities of the Director of National Intelligence (DNI) regarding CUI.

g. Nothing in this issuance will infringe on the Office of Inspector General (OIG) of the DoD’s statutory independence and authority, as articulated in the Inspector General Act of 1978 in the Title 5, United States Code (U.S.C.) Appendix. In the event of any conflict between this instruction and the OIG DoD’s statutory independence and authority, the Inspector General Act of 1978 in the Title 5, U.S.C. Appendix takes precedence.

3.4. MARKING REQUIREMENTS.

This paragraph covers the essential marking requirements for initial phased implementation of the DoD CUI Program.

a. At minimum, CUI markings for unclassified DoD documents will include the acronym “CUI” in the banner and footer of the document.

b. If portion markings are selected, then all document subjects and titles, as well as individual sections, parts, paragraphs, or similar portions of a CUI document known to contain CUI, will be portion marked with “(CUI).”

Use of the unclassified marking “(U)” as a portion marking for unclassified information within CUI documents or materials is required.

(1) There is no requirement to add the “U,” signifying unclassified, to the banner and footer as was required with the old FOUO marking (i.e., U//FOUO).

(2) Banners, footers, and portion marking will only be marked “Unclassified” or “(U)” for unclassified information in accordance with the June 4, 2019 ISOO letter. If the document also contains CUI, it will be marked in accordance with Paragraph 3.4.a. and additional forthcoming guidance.

c. CUI markings in classified documents will appear in paragraphs or subparagraphs known to contain only CUI and must be portion marked with “(CUI).” “CUI” will not appear in the banner or footer.

(1) There will be an acknowledgement added to the warning box on the first page of multi-page documents to alert readers to the presence of CUI in a classified DoD document, as shown in Figure 1.

Figure 1. CUI Warning Box for Classified Material

(2) Volume 2 of DoDM 5200.01 requires DoD intelligence producers to follow DNI formats for intelligence production under the authority of the DNI. When DoD CUI is incorporated into a Digital Access Policy under the authority of the DNI, the information and the document will follow the Digital Access Policy standards established by the DNI.

d. The dissemination marking “not releasable to foreign nationals (NOFORN or NF)” is an intelligence control marking used to identify intelligence information an originator has determined meets the criteria of Intelligence Community Directive 710 and Intelligence Community Policy Guidance 403.1, which provides guidance for further dissemination control markings. It must be applied to controlled unclassified intelligence information that is properly characterized as CUI with appropriate CUI markings. CUI identified with this marking will not be provided, in any form, to foreign governments (including coalition partners), international organizations, foreign nationals, or other non-U.S. persons without the originator’s approval in accordance with Executive Orders (E.O.s) 13526 and 13556. If originator approval is required for further dissemination, the originator will mark the requirement on the information in accordance with Section 4.1(i)(1) of E.O. 13526.

(1) The application of the control marking “not releasable to foreign nationals” (NOFORN or NF) will only be applied, when warranted, to unclassified intelligence information properly categorized as CUI and reviewed by a Foreign Disclosure Officer to ensure there are no international agreements in place to prohibit its use and prohibiting sharing.

This content is classified at the [insert highest classification level of the source data] level and may contain elements of controlled unclassified information (CUI), unclassified, or information classified at a lower level than the overall classification displayed. This content shall not be used as a source of derivative classification; refer instead to [cite specific reference, where possible, or state “the applicable classification guide(s)”]. It must be reviewed for both Classified National Security Information (CNSI) and CUI in accordance with DoDI 5230.09 prior to public release. [Add a point of contact when needed.]

(2) The control marking NOFORN or NF will be applied to Naval Nuclear Propulsion Information (NNPI), Unclassified Controlled Nuclear Information (UCNI), National Disclosure Policy (NDP-1), and cover and cover support information. When warranted, it can be applied to unclassified information properly categorized as CUI having a licensing or export control requirement. Before marking a document or material as NOFORN or NF, it will be reviewed by the Foreign Disclosure Officer to ensure there are no agreements in place to prohibit its use and sharing.

(3) The application of “Releasable to” (“REL TO”) can only be applied, when warranted and consistent with relevant law, regulation, or government-wide policy or DoD policy, to information properly categorized as CUI with an export control or licensing requirement with a foreign disclosure agreement in place.

(a) Export-controlled CUI transfers to foreign persons must be in accordance with the Arms Export Control Act, International Traffic in Arms Regulations, Export Control Reform Act, Export Administration Regulations, and DoDI 2040.02. In accordance with DoD Directives (DoDDs) 5230.11 and 5230.20, a positive foreign disclosure decision must be made before CUI is released to a foreign entity.

(b) DoD operational CUI (not related to intelligence) may be marked as REL TO.

e. All classified documents, including legacy documents will be reviewed for CUI and properly marked upon changes in the document’s classification level, particularly if the documents are to be completely declassified.

f. The first page or cover of any document or material containing CUI, including a document with commingled classified information, will include a CUI designation indicator, as shown in Figure 2. This CUI designation indicator is similar to the classification-marking block used for classified national security information (CNSI) documents and materials. Documents and materials containing CUI will require a generic “CUI” marking at the top and bottom of each page.

(1) In accordance with Part 2002 of Title 32, Code of Federal Regulations (CFR), the CUI designation indicator must contain, at minimum, the name of the DoD Component determining that the information is CUI. If letterhead or another standard indicator of origination is used, this line may be omitted.

(2) The second line must identify the office making the determination.

(3) The third line must identify all types of CUI contained in the document.

(4) The fourth line must contain the distribution statement or the dissemination controls applicable to the document.

(5) The fifth line must contain the phone number or office mailbox for the originating DoD Component or authorized CUI holder.

Figure 2. CUI Designation Indicator for All Documents and Material

g. During DoD’s initial phased implementation of the CUI Program, there is no required distinction that must be made between Basic and Specified CUI. All DoD information will be protected in accordance with the requirements under the Basic level of safeguards and dissemination unless specifically identified otherwise in a law, Controlled by: [Name of DoD Component] (Only if not on letterhead) Controlled by: [Name of Office] CUI Category: (List category or categories of CUI) Distribution/Dissemination Control:

POC: [Phone or email address] regulation, or government-wide policy. Forthcoming guidance will address the distinction between the two levels of CUI, including a list of which categories are Basic or Specified, what makes the category one or the other, and the unique requirements, to include markings, for each.

3.6. GENERAL DOD CUI PROCEDURES. DoD CUI is clustered into organizational indexes (e.g., defense, privacy, proprietary) with associated DoD CUI is clustered into organizational indexes (e.g., defense, privacy, proprietary) with associated categories, and is categorized by the DoD according to the specific law, regulation, or government-wide policy requiring control. Unclassified information associated with a law, regulation, or government-wide policy and identified as needing safeguarding is considered CUI. It requires access control, handling, marking, dissemination controls, and other protective measures for safeguarding.

a. The authorized holder of a document or material is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. If so, the authorized holder is responsible for applying CUI markings and dissemination instructions accordingly.

b. In accordance with this issuance, every individual at every level, including DoD civilian and military personnel as well as contractors providing support to the DoD pursuant to contractual requirements, will comply with the requirements in Paragraph 3.6.f of this issuance for initial and annual refresher CUI training.

3.7. GENERAL DOD CUI REQUIREMENTS.

This section specifies initial requirements for implementing, marking, and managing the CUI program. Table 1 contains a sample list of the categories found in the DoD CUI Registry and Defense Index. A complete list of CUI Indexes and Categories can be found on Intelink athttps://intelshare.intelink.gov/sites/ousdi/hcis/sec/icdirect/information/CUI/Forms/AllItems.aspx Some significant points about DoD CUI include:

a. CUI does not include information lawfully and publicly available without restrictions.

b. CUI requires safeguarding measures identified by the CUI Executive Agent (EA) in Part 2002.14 of Title 32, CFR and, as necessary, in the law, regulation, or government-wide policy with which it is associated. DoD CUI may be disseminated to DoD personnel to conduct official DoD and U.S. Government business in accordance with a law, regulation, or government-wide policy.

(1) No individual may have access to CUI information unless it is determined he or she has an authorized, lawful government purpose.

(2) The person with authorized possession, knowledge, or control of CUI will determine whether an individual has an authorized, lawful government purpose to access designated CUI.

(3) CUI information may be disseminated within the DoD Components and between DoD Component officials and DoD contractors, consultants, and grantees to conduct business for the

DoD, provided dissemination is consistent with controls imposed by a distribution statement or limited dissemination controls (LDC).

(4) CUI designated information may be disseminated to a foreign recipient in order to conduct official business for the DoD, provided the dissemination has been approved by a disclosure authority in accordance with Paragraph 3.4.c. and the CUI is appropriately marked as releasable to the intended foreign recipient.

c. Controlled technical information (CTI) compiled or aggregated may become classified. Such classified CTI is subject to the requirements of the National Industrial Security Program, which has different requirements than Section 252.204-7012 of the DFARS for unclassified CTI.

3.10. GENERAL SYSTEM AND NETWORK CUI REQUIREMENTS.

In accordance with DoDIs 8500.01 and 8510.01, security controls for systems and networks are set to the level required by the safeguarding requirements for the data or information being processed, as identified in Federal Information Processing Standards 199 and 200. For DoD CUI, the minimum security level will be moderate confidentiality in accordance with Part 2002 of Title 32, CFR and National Institute of Standards and Technology Special Publication (NIST SP) 800-171.

SECTION 4: DISSEMINATION, DECONTROLLING AND DESTRUCTION

OF CUI

4.1. GENERAL.

(1) During working hours, steps will be taken to minimize the risk of access by unauthorized personnel, such as not reading, discussing, or leaving CUI information unattended where unauthorized personnel are present.

After working hours, CUI information will be stored in unlocked containers, desks, or cabinets if the government or government-contract building provides security for continuous monitoring of access. If building security is not provided, the information will be stored in locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas. The concept of a controlled environment means there is sufficient internal security measures in place to prevent or detect unauthorized access to CUI. For DoD, an open storage environment meets these requirements.

(2) CUI information and material may be transmitted via first class mail, parcel post, or, bulk shipments.

When practical, CUI information may be transmitted electronically (e.g., https.). Avoid wireless telephone transmission of CUI when other options are available. CUI transmission via facsimile machine is permitted;

however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive CUI; facsimile machine located in a controlled government environment).

SECTION 5: APPLICATION OF DOD INDUSTRY

5.1. GENERAL.

There is a shared responsibility between the DoD and industry, when established by contract, grants, or other legal agreements or arrangements, in the identification, creation, sharing, marking, safeguarding, storage, dissemination, decontrol, disposition, destruction, and records management of CUI documents and materials. It is essential to identify and apply the general dissemination principles and guidance as prescribed by the CUI EA in accordance with Part 2002 of Title 32, CFR. Contracts containing CUI shared from DoD or generated, or managed, or transmitted by the contractor via their information systems, will be in accordance with this issuance, which will be incorporated into each DoD contract.

a. The NIST SP 800-171 identifies the baseline CUI system security requirements for industry established by Part 2002 of Title 32, CFR. Additionally, Section 252.204-7012 of the DFARS specifies a waiver process for defense contractors in accordance with NIST SP 800-171 for contractor IT or networks.

b. CUI with the potential to impact national security (e.g., information related to critical programs and technology information) may require enhanced protection. These enhanced measures would address both physical and logical procedures. Enhanced protection methods for systems hosting CUI include:

c. Non-DoD IS processing, storing, or transmitting CUI will be safeguarded in accordance with contractual requirements identified for the particular CUI contained in the contract, DoDI 8582.01 and Section 252.04-7012 of the DFARS or their subsequent revision.

d. When established by contract, contractors, sub-contractors, and consultants must comply with safeguarding requirements identified in the contract for all types of CUI.

5.2. MISUSE OR UD OF CUI.

Safeguarding requirements and incident response measures for misuse or UD of CUI must be implemented across the DoD. Senior leaders, contracting officers, commanders, and supervisors at all levels must consider and take appropriate administrative, legal, or other corrective or disciplinary action to address CUI misuse or UD commensurate with the appropriate law, regulation, or government-wide policy.

5.3. REQUIREMENTS FOR DOD CONTRACTORS.

This paragraph highlights requirements for DoD contractors.

a. Whenever DoD provides information to contractors, it must identify whether any of the information is CUI via the contracting vehicle, in whole or part, and mark such documents, material, or media in accordance with this issuance.

b. Whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities, protective measures and dissemination controls, including those directed by relevant law, regulation, or government-wide policy, will be articulated in the contract, grant, or other legal agreement, as appropriate.

c. DoD contracts must require contractors to monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information. DoD contracts shall require contractors to report the potential classification of aggregated or compiled CUI to a DoD representative.

d. DoD personnel and contractors, pursuant to mandatory DoD contract provisions, will submit unclassified DoD information for review and approval for release in accordance with the standard DoD Component processes and DoDI 5230.09.

e. All CUI records must follow the approved mandatory disposition authorities whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and this issuance.

contractors to report the potential classification of aggregated or compiled CUI to a DoD representative.

Source: OPNAVINST N9210.3 (07 JUN 10) Clause Revision: AUG 2013

ATTACHMENT 2

GUIDANCE FOR NNPI

a. Security Agreement for Protection of Naval Nuclear Propulsion Information.

(1) During the performance of this contract Naval Nuclear Propulsion Information (NNPI) may be developed or used. Appropriate safeguards must be proposed by the contractor and provided to the Contracting Officer for Security for the safeguarding from actual, potential or inadvertent release of classified or unclassified NNPI in any form by the contractor or any subcontractor. These safeguards shall ensure that access to NNPI is limited to those governmental and contractor parties, including subcontractors, that have an established need to know, and then only under conditions that assure that the information is properly protected. Access by foreign nationals or representatives of foreign interests is not permitted. In addition, any and all issuances or releases of such information beyond such necessary parties, whether or not ordered through an administrative or judicial tribunal, shall be brought to the attention of the Contracting Officer for Security.

(2) The Contracting Officer for Security shall be immediately notified of any litigation, subpoenas, or requests which either seek or may result in the release of NNPI. In the event that a court or administrative order makes immediate review by the Contracting Officer for Security impracticable, the contractor agrees to take all necessary steps to notify the court or administrative body of the Navy’s interest in controlling the release of such information through review and concurrence in any release.

(3) The Contracting Agency reserves the right to audit contractor facilities for compliance with the above restrictions. Exceptions to these requirements may only be obtained with prior approval from the Commander, Naval Sea Systems Command (SEA 09P).

(4) Definitions applicable to this clause are provided in the base instruction, OPNAV Instruction N9210.3.

b. Security Requirements for Protection of Unclassified Naval Nuclear Propulsion Information (U-NNPI).

(1) The Contractor listed in block 6.a of the attached DD Form 254 hereby agrees that when provided documents (specifications, drawings, etc.) that contain U-NNPI and are marked as containing NOFORN sensitive information that must be controlled pursuant to federal law, the information contained therein and generated as part of the inquiry shall be used only for the purpose stated in the contract and shall in no case be transmitted outside the company (unless such transmittals comply with the detailed guidance of the contract) or to any foreign national within the company. While in use, the documents shall be protected from unauthorized observation and shall be kept secure so as to preclude access by any persons who do not have a legitimate need to view them. The documents shall not be copied unless done in conformance with the detailed guidance provided of the contract. All the documents shall be promptly returned in their entirety, unless authorized for proper disposal or retention, following completion of the contract.

(2) Only U.S. citizens who have a legitimate Need-To-Know (NTK) required to execute the contract shall be allowed access to U-NNPI.

(3) When not in direct control of an authorized individual, U-NNPI must be secured in a locked container (e.g., file cabinet, desk, safe.) Access to the container must be such that only authorized persons can access it, and compromise of the container would be obvious at sight. Containers should have no labels that indicate the contents. If removed from the site, U-NNPI must remain in the personal possession of the individual. At no time should U-NNPI be left unsecured (e.g., in a home or automobile, or unattended in a motel room or sent with baggage.)

(4) U-NNPI documents will have the word NOFORN at the top and bottom of each page. The cover sheet will have the warning statement shown below. Documents originated in the course of work that reproduce, expand or modify marked information shall be marked and controlled in the same way as the original. Media such as video tapes, disks, etc., must be marked and controlled similar to the markings on the original information.

NOFORN: This document is subject to special export controls, and each transmittal to foreign governments or foreign nationals may be made only with the approval of Naval Sea Systems Command.

Source: OPNAVINST N9210.3 (07 JUN 10) Clause Revision: AUG 2013

ATTACHMENT 2

GUIDANCE FOR NNPI

NOTE: This distribution warning statement is for training purposes only.

(5) U-NNPI may not be processed on networked computers with outside access unless approved by CNO (N00N). If desired, the company may submit a proposal for processing NNPI on company computer systems. Personally owned computing systems, such as personal computers, laptops, personal digital assistants, and other portable electronic devices are not authorized for processing NNPI. Exceptions require the specific approval of the cognizant Designated Accrediting Authority (DAA) for Information Technology (IT) systems and the Chief of Naval Operations (CNO) (N00N).

(6) U-NNPI may be faxed within the continental United States and Hawaii provided there is an authorized individual waiting to receive the document and properly control it. U-NNPI may not be faxed to facilities outside the continental United States, including military installations, unless encrypted by means approved by CNO (N00N).

(7) U-NNPI may be sent within the continental United States and Hawaii via first class mail in a single opaque envelope that has no markings indicating the nature of the contents.

(8) Documents containing U-NNPI shall be disposed of in the same manner as classified material.

(9) Report any attempts to elicit U-NNPI by unauthorized persons to the appropriate security personnel.

(10) Report any compromises of U-NNPI to the appropriate security personnel. This includes intentional or unintentional public release via such methods as theft, improper disposal (e.g., material not shredded, disks lost), placement on web sites, transmission via email, or violation of the information system containing U-NNPI.

ATTACHMENT 3

Portsmouth Naval Shipyard Operations Security Statement

The Contractor shall adhere to all Navy and Portsmouth Naval Shipyard (PNSY) Operational Security (OPSEC) policies and procedures during the performance of this contract. Relevant policies and procedures are identified primarily within NAVSEA Instruction 3070.2, Operations Security (31 December 2021), and are summarized below.

OPSEC is the process by which the Navy and its personnel (military, civilian and contractors) denies adversaries access to critical information about Navy sensitive or classified activities, capabilities, and intentions.

Contractor personnel shall not enter NAVSEA spaces (Controlled Industrial Area (CIA), Security Islands (SI), Controlled Nuclear Information Area (CNIA), or Nuclear Work Areas (NWA) or any other restricted area with introduction of personal electronic devices, laptops, tablet PCs, cellular phones, cameras, recording devices, and data recording/storage devices, unless prior authorized. These items may be stored in government-provided security containers, if available, personal vehicles or other locations outside of NAVSEA spaces.

Company issued laptops required for the performance of work must be registered at the Pass & I.D. Office, Building 384 and approved by Code 1120 Physical Security and Code 109 Information Security.

Contractor personnel shall not take photographs or make any recordings (audio, visual digital) while on PNSY, unless that action is authorized by or necessary to perform the contract.

Contractor personnel shall submit all photographs taken and recordings made on PNSY to the OPSEC Program Manager (Code 1123.2) for review and shall obtain approval from that office prior to removing that information from PNSY or otherwise disseminating that information.

Contractor personnel shall not discuss government operations in public or over unprotected or unencrypted communications. The Contractor shall not post to company websites, publications, newsletters or other media, any images, data or information that reveal sensitive government operations, personnel, equipment, and/or classified or controlled unclassified information.

Contractors shall coordinate with and address questions about the content of any proposed disclosures with the Contracting Officer’s Representative (COR) or Technical Point of Contact, as applicable, and the PNS Public Affairs Office (PAO).

Contractor personnel shall not disclose to unauthorized third parties or, post to unofficial sites (including Social Networking sites) any images, data or information, or observed events that reveal sensitive government operations, personnel, equipment, including, but not limited to:

Tactics, techniques and procedures; production or work schedules; any visible or concealed modifications, upgrades, additions to vessels, weapons or equipment; increases, changes, or decreases in work/deployment frequency or government personnel, vehicle, vessel movements;

specialized equipment orders, deliveries, shipments, etc.

The Contractor shall report any unauthorized disclosures of this information or, any attempts to solicit this information from the Contractor by other companies or personnel who do not have an official need to know this information to PNS Security Office (Code 1120) and/or PNS Police Department and the Contracting Officer. Non-Disclosure requirements remain in effect during the duration of this contract and indefinitely thereafter.

Government issued badges, identification shall be removed and/or concealed from plain sight when off PNS and shall not be left in vehicles or unprotected. Badges and passes may not be duplicated, copied or loaned to others. Lost or stolen identification badges, vehicle passes, etc., will be immediately reported to PNS Code 1120 Security Office and/or PNS Police Department.

The Contractor should mark all internal production schedules, deliverables, inventories and shortages and identified vulnerabilities related to production of government material with restrictive legends in accordance with the Federal Acquisition Regulation and other applicable guidance. The Contractor shall safeguard that information from disclosure, inadvertent or otherwise, from unauthorized recipients.

All government furnished information must be destroyed or returned to the government, at the government’s discretion, upon completion or termination of the contract.

CUI

Ser 1120/344

04 DEC 24

MEMORANDUM

From: Commander, Portsmouth Naval Shipyard To: Distribution

Subj: PORTSMOUTH NAVAL…