Att. 2

"FOR PLANNING PURPOSES ONLY. NOT VALID FOR ACTUAL CONTRACT."

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

DD Form 254, DEC 1999 Previous editions are obsolete.

12. PUBLIC RELEASE. Any information (classified or unclassified) ~ertainina to this contract shall not be released for oublic dissemination exceot as Drovided bv the Industrial . , - - ~ - Security Manual or unless it has been approved for public release by appropriate u.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct rn Through (Specify) Commanding Officer Naval Air Warfare Center Training Systems Division 12350 Research Parkway Orlando, FL 32826-3275 to the Directorate for Freedom of Information and Securitv Review, Office of the Assistant Secretaw of Defense (Public Affairs)' for review In the case of non-DoD User Agencies, request for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The securitv classification auidance needed for this classified effort is identified below. If anv difficultv is encountered in a ~ ~ l v i n a this auidance or if anv other . . , " " contributing factor indicates a need for changesin this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or the classificaiion assigned to any information or material fum~shed or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classification effort. Anach, or forward under separate correspondence, any documentdguides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

a. Al l contractor personnel shal l comp ly w i t h the D o D Security Agreement (DD Form 441), as we l l as the Nat ional Industr ia l Security Program

Operating Manua l (NISPOM), D o D 5220.22-M.

b. The contractor shal l c o m p l y w i t h security procedures in effect at a l l Government sites visited, and where contract work takes place. Contractor w o r k w i l l take place at contractor's faci l i ty, Nava l Air Station (NAS) Jacksonville, FL, and T inker AFB, OK.

c. In the course o f this contract, the contractor w i l l require access t o documents, w h i c h conta in cr i t ica l technology. The contractor needs t o store documents t o deny access, and destroy them t o prevent reconstruction when they are no longer needed. A l though U N C L A S S I F I E D , these documents w i l l have l im i ted d is t r ibut ion statements.

d. Attachment (1) provides guidance on the proper handl ing procedures f o r FOUO material.

e. Any classified in format ion generated in the performance of this contract shal l be classified according t o the markings shown on the source material.

f. The contractor shal l ensure that common sense T E M P E S T measures are implemented dur ing a l l t imes of classified processing. Such measures include, b u t are no t l im i ted to: (1) no wireless communications equipment in area dur ing classif ied processing, and (2) physical separation of classified processing system and other equipment, such as a telephone, fax, etc. Attachment (2), T E M P E S T Questionnaire, must be completed and forwarded t o the address indicated, w i t h a copy t o the Security Of f i ce o f this Contracting Agency, for f ina l evaluation/determination o f any addit ional T E M P E S T requirements. W h e n responding t o Question 9 of the T E M P E S T Questionnaire, inc lude general ident i f icat ion o f contractual effort (i.e., C O M S for . . ., etc), a statement defining/summarizing types of classif ied data, and level of classif ied in fo rmat ion be ing processed.

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements in addition to ISM requirements, are established for this contract. (It Yes, identify the O Y ~ S NO pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. ~ro;ide a copy of the requirement to the cognizant security office. Use ltem 13 if additional space is needed.)

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific OY~S NO areas or elements cawed ovt and the activity responsible for inspections. Used ltem 13 if additional space is needed.)

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL I b. TITLE I c. TELEPHONE (Include Area Code) I ~ -

Darren Smith I contracting Officer's Security 1 (407) 380-8243 ' I

E j e. ADMINISTRATION CONTRACTING OFFICER

f. OTHERASNECESSARY

)D Form 254 ~ e v e r s a DEC 1999 U.S. GOVERNMENT PRINTING OFFICE

I Representative I

d. ADDRESS (Include Zip Code)

NAVAIRWARCENTRASYSDIV

12350 Research Parkway Orlando, FL 32826-3275

e. SIGNATURE

17. REQUIRED DISTRIBUTION

a. CONTRACTOR

b. SUBCONTRACTOR rn c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR d U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

DD Form 254, Department of Defense Contract Security Classification Specification Contract Number N6 1339- 10-R-0004

Item 13, SECURITY GUIDANCE (Continued)

g. The contractor shall develop, implement, and maintain a facility level OPSEC program to protect classified and sensitive unclassified information to be used at the contractor facility during the performance of this contract. The OPSEC requirements may be included in the contractor's Standard Practice Procedures (SPP) or Technology Control Plan (TCP), whichever is more applicable.

h. The contractor must provide adequate storage for classified hardware and materials up to and including the SECRET level that exceeds two cubic feet and is of size and quantity that cannot be safeguarded in an approved GSA storage container.

i. Contractor will incorporate security procedures to mitigate risks associated with wireless devices in areas where employees are working with classified information and/or where classified discussions may be held. Such countermeasures may range from ensuring wireless devices are turned off or not used in classified areas to, in some cases, not permitting devices in the area.

"FOR OFFICIAL USE ONLY" (FOUO) INFORMATION

The "For Official Use Only" (FOUO) marking is assigned to information at the time of its creation by a DoD Agency. It is not authorized as a substitute for a security classification but is used on official government information that may be withheld from the public under Exemptions 2 through 9 of the Freedom of Information Act.

Use of this designation does not mean that the information cannot be released to the public, only that it must be reviewed by the government prior to its release to determine a significant and legitimate purpose is being served by withholding this information or any part(s) of it.

An unclassified document containing FOUO information will be marked "For Official Use Only" (FOUO) at the bottom of the front cover (if any), the first page, each page containing FOUO information, back page, and outside back cover (if any). If a document is classified, and a page contains both classified information and FOUO information, the document will carry the highest classification contained on each page and where a paragraphlportion is only FOUO, that paragraphlportion will be marked as such.

Removal of the FOUO designation can be accomplished only by the originator or other competent authority. This information may be disseminated by contractors to their employees and subcontractors who have a requirement for the information in connection with a contract.

During working hours, FOUO information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access such as a locked desk or locked file cabinet.

When FOUO information is no longer needed, it may be disposed of by tearing, shredding, etc. which precludes reconstruction.

FOUO information may be transmitted by regular US Postal Service mail or US commercial express mail services authorized for unclassified material. The transmission of FOUO material by regular telephone or electronic mail is discouraged unless absolutely necessary in the performance of the contract and is time sensitive. Electronic transmission of FOUO information, e.g., voice, data or facsimile, e-mail, should be by approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure (PKI), when practical

FOUO material is not to be placed on Non Government World Wide Web sites or any site that is accessible to the general public. FOUO information may be transmitted over telephone lines in digital form such as fax machines or telecopiers.

The unauthorized disclosure of FOUO information does not constitute a security violation; however, the originator or User Agency will be informed of the disclosure. The unauthorized disclosure of FOUO information that is protected by the Privacy Act may result in the criminal sanctions under that statute.

Additional guidance is available by contacting the User Agency Security Office.

ATTACHMENT (1)

TENPEST REOUIREMENTS OUESTIONNAIRE

{FOR CONTRACTOR FACILITIES)

1. This TEMPEST Requirements Questionnaire (TRQ) must be completed and sent to the contracting authority and the Certified TEMPEST Technical Authority (CTTA) within 30 days after contract award for all contracts where National Security Information (NSI) will be processed and the requirements of item 13 of the DD Form 254 have been met.

2. The prime contractor cannot pass TEMPEST requirements to subcontractors. Subcontractors must submit a Contractor TRQ prior to processing.

3. The TRQ is for information collection only. It is not a directive or an implied requirement, nor is it an encouragement to procure TEMPEST equipment or any type of shielding for use on this contract. DO NOT initiate any changes to equipment of facilities for TEMPEST unless it has been recommended by the ClTA and specifically directed by the contracting authority.

4. The contracting authority will not issue any directives concerning TEMPEST until after the contractor submitted TRQ has been evaluated by the ClTA and resulting recommendations received. To fully evaluate the TRQ, the ClTA may request additional information concerning the facility, its physical control, the equipment which will be used to process NSI, etc.

5. The contractor shall ensure compliance with any TEMPEST countermeasure (s) specifically directed in writing by the contracting authority.

6. Please provide the information requested in paragraphs 7 through 20 and return to the contracting authority identified in item 16 of the DD Form 254 and to the ClTA at :

COMMANDING OFFICER

SPAWARSYSCEN

CODE 723

P.O. BOX 190022

NORTH CHARLESTON SC 294 19-9022

7. Provide the name, address, position title, and phone number (at the facility where classified processing will occur) of a point of contact who is knowledgeable of the processing requirements, the types of equipment to be used and the physical layout of the facility.

8. Provide the specific geographical location, address, and zip code, where classified processing will be performed.

9. What are the classification level (s) of material to be processedlhandled by electronic or electromechanical information system (s) and what percentage is processed at each level?

10. What special categories of classified information are processed?

ATTACHMENT ( 2 )

11. Is there a direct connection (wireline or fiber) to a Radio Frequency (RF) transmitter (s) located either locally or at a remote site?

12. Are there any RF transmitters located within 6 meters of the system processing National Security Information or the system's RED signal lines?

13. Describe how access is controlled to your facility including the building, compound, plant, property, andor parking lots. Where are visitors first challengedidentified? Include controls such as alarms, guards, patrols, fences, and warning signs. Provide a simple block diagram of the equipment, the facility and the surrounding areas. The diagram (s) should extend out to the nearest uncontrolled area on each side of the facility, such as a military base perimeter, plant property line, commercial building or residential area.

14. Are there other tenants in the building who are not U.S. departmendagencies or their agents?

15. Are there any known foreign business or government offices in adjacent buildings?

16. Provide the make and model number of all equipment used to process, transfer or store classified information. Include computers, peripherals, network servers, network hardware, multiplexers, modems, encryption devices (COMSEC), etc.

17. Have on-site TEMPEST tests been conducted on any of these equipment (s)? If so, which ones? When was the test (s) conducted? Who conducted the test (s)? Have all deficiencies (if any) been resolved?

18. Has a TEMPEST Facility Zoning test been conducted? If so, who conducted the testing and when?

19. Is this company foreign-owned or controlled? If so, what is the country?

20. Provide name, code, telephone number, and address of the Contracting Officer's Representative, the contract number and the sponsoring command.