DD_254_Attachment_1_NNSY_Security_Guidance.pdf

For Official Use Only (FOUO)

DEPARTMENT OF THE NAVY

NORFOLK NAVAL SHIPYARD DETACHMENT

(NAVAL FOUNDRY AND PROPELLER CENTER)

PHILADELPHIA, PA 19112-5087

Subj: NORFOLK NAVAL SHIPYARD DD254 SECURITY GUIDANCE

1. The contractor requires access to classified source data up to and including the level identified in item 1a of this DD form 254. Classified material generated in support of this contract shall be classified in accordance with the source material of the Navy Security Classification Guidance, which will be provided by the Program Office or Norfolk Naval Shipyard Detachment Naval Foundry & Propeller Center (NFPC). Automated Information Systems (AIS) must be certified and accredited by the Cognizant Security Agency (CSA) prior to processing classified information from NAVSEA.

2. At the termination or expiration of this contract, Norfolk Naval Shipyard (NNSY) Code 1122 identified in Item 16 of this form will be contacted for proper disposition instruction.

Special Access Program (SAP) information will require an authorization-to-operate using the Risk Management Framework (RMF) processed outlined in the "Joint SAP Implementation Guide (JSIG) Version 4.1 dated April 11, 2016" (or successor document).

3. All classified documents must be destroyed using a National Security Agency (NSA) approved high security crosscut shredder listed on the NSA/CSS Evaluated Products List for High Security Crosscut Paper Shredders, or other approved method for destroying classified information. If still in possession of NAVSEA classified documents;

destroy and forward a copy of the destruction certificates to the person listed in 16a.

4. Security classification guides (Classifed) and controlled unclassified information (CUI) (e.g., FOUO, distribution statement controlled) are not authorized for public release;

therefore, they cannot be posted on a publicly accessible web-server or transmitted over the internet unless appropriately encrypted. Request for public release cannot be transmitted via the internet until the contractor receives final approval from NAVSEA

(SEA 00D).

5. Contractor must submit a request for sharing of classified and other sensitive information between prime contracts in writing to the Norfolk Naval Shipyard (NNSY) Security Office identified in Item 16 of this form.

6. Reports of loss, compromise or suspected compromise shall be reported to Cognizant Security Office (Block 6.c) within 24 hours of the incident, in addition to reporting the incident to the Contracting Officer and Naval Foundry and Propeller Center (NFPC) Code 1420.

7. All of the above security requirements, where applicable, will apply to any subcontractors and consultants supporting this contract. Copies of all subcontractor DD 254s should be emailed to the Norfolk Naval Shipyard (NNSY) Security Office identified in Item 16 of this form.