DD0254.PDF

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

(Updated 20250815)

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

August 31, 2028 The public reporting burden for this collection of information, 0704-0567, is estimated to average 36 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD Form 254, "DoD Contract Security Classification Specification"

(See Instructions) - Select from drop-down list: 2

Attn - Security Manager, Code-N00SM, PSC 822 Box 1000, FPO, AE 09621

2. Required Activity will provide security classification guidance for performance of this contract. Classification markings on the material to be furnished will provide the classification guidance necessary for the performance of this contact.

3. Ref Block 10a. Contractor is authorized access to Government furnished cryptologic equipment and information. Access to COMSEC information per NSA Manual 90-1, requires a FINAL U.S. Government clearance and special briefings at the appropriate level. COMSEC information shall NEVER be provided to a subcontractor without specific authorization of the NCTS-Naples and/or NCTS-Sicily Key Management Infrastructure (KMI) account manager. The contractor is only authorized as a Local Element (LE) User; the material/equipment/data/information issued to the contractor is for their specific use within the scope of the contract and cannot be forwarded or reissued outside of those parameters.

4. Ref item 10j: Controlled Unclassified Information (CUI) provided under this contract shall be safeguarded (including reporting of actual or suspected spillage) as specified in SECNAVINST 5720.42F, Department of the Navy Freedom of Information Act Program, and and DoDI 5200.48, Controlled Unclassified Information (CUI). All documents containing CUI will carry CUI markings in accordance with DoDI 5200.48 issuance.

4. Ref Block 10k: Per CJCSI 6211.02D, the accreditation of the SIPRNET includes the hosting of NATO information IAW United States Security Authority for NATO Affairs (USSAN) Instruction 1-07. Per DoDM 5200.01-V1, to facilitate potential access to NATO classified information, all DoD military, civilian and contractor personnel granted access to SIPRNET in performance of duties shall be briefed on the requirements for protecting NATO information. As such, the Contractor Facility Security Officer (FSO) shall provide a NATO awareness briefing to cleared contractor personnel and shall maintain a written acknowledgment of the individual's receipt of the awareness briefing along with statement of understanding of responsibilities for safeguarding NATO classified information in personnel security/training record/folder. The contractor shall maintain, locally at the site, the documentation (i.e., security record, training folder, command database, etc.) for those personnel requiring access to SIPRNET; documentation is subject to inspection by the Government. The NATO awareness briefing is not a NATO access briefing and does not constitute approval for access to NATO. The actual knowledge of, generation, or production of NATO information is not a requirement for performance of contract.

5. Ref item 11a: Access to classified information shall only be at specified facilities located on U.S. Government controlled compounds. The contractor shall utilize facilities provided by the U.S. Government for secure storage of classified material up to and including SECRET only at specified U.S. Government activity work site noted in item 8a. All classified material generated in the performance of this contract will be derivatively classified IAW Executive Order 12958 as amended, based on existing source documents or applicable classified guides. If there are instances where more detailed classification guidance is necessary, the Government using activity will furnish such guidance. The Contractor is required to ensure classified material, to include hardware to the level the classification levels identified in item 1 of this DD254 is properly stored and safeguarded in Government furnished certified General Service Administration (GSA) security containers and/or Government furnished certified operational/storage spaces.

5. Ref item 11j: Contractor personnel shall comply with DoDD 5205.02 (series) and associated DOD implementation guidance for additional information, all NRTF Niscemi Security Operating Procedures (SOPs), and Government Operational Security (OPSEC) Training. All Contractor employees, including subcontractors, assigned to this contract shall complete Level I OPSEC training within 30 days of reporting for duty and then annually thereafter.

6. Ref item 11.l: Controlled Unclassified Information (CUI) information provided under this contract shall be safeguarded (including reporting of actual or suspected spillage) as specified in SECNAVINST 5720.42G, Department of the Navy Freedom of Information Act Program, DoDI 5200.48, Controlled Unclassified Information (CUI), and DoD 5200.01 Volumes1, 2 and 3, DoD Information Security Program.

7. Ref item 11m: Contractor employees shall not operate the following personal equipment within NAVSATCOMFAC NW or within restricted or classified spaces in buildings at locations identified under this contract: radios (portable or otherwise), tape recorders, television sets, transmitting equipment, cameras, cellular phones, personal laptop computers, automated hand-held office assistants (PDAs, Cell Phones), and equipment containing electronic oscillators. All government or contractor owned portable electronic equipment shall be controlled IAW NSTISSAM TEMPEST/2/95 Red/Black Installation Guidance, NMCI Information Advisory 12-3 and associated command implementation guidance for additional information. Command specific policies will be furnished by the GCA.

Completion and approval of a System Authorization Access Request (SAAR) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR as the "supervisor". The SAAR shall be forwarded to the cognizant Information Systems Security Manager prior to being granted access to any DOD/DON information systems. Contractor shall ensure all information systems are operated and maintained IAW DoD, DoN, and NCTS Sicily policies.

The Commanding Officer, NCTS Sicily maintains Cybersecurity, physical security/force protection, and information personnel security inspection responsibilities.

8. Citizenship: U.S. Citizenship is required of all Contractor personnel performing under this contract.

9. DON Position Sensitivity and Facility Clearance Level. Investigative requirements for DON contractor personnel requiring access to classified information and/or spaces are managed under the National Industrial Security Program (NISP). Requests for investigation of contractor personnel for security clearance eligibility shall be processed by the Defense Counterintelligence and Security Agency (DCSA) Vetting Risk Operations Center (VROC) with clearance issued by the DCSA Adjudication and Vetting Services.

10. DOD security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Duties performed under this contract are at the National Security Non-Critical Sensitive (NCS) and Critical Sensitive (CS) requiring Secret eligibility and continuous access; a Case Type Tier 3 and Tier 5 background investigation or equivalent suitability (hereafter referred to as "background investigations") shall be conducted on all employees assigned. Interim Secret clearances are acceptable at the commencement of performance of services while clearance investigations are being performed, however; all contractor employees performing under this contract shall be favorably adjudicated by U.S. Government to the status of Final Secret Clearance in order to continue performance under this contract. Exception to Interim Clearance applies to contractor employees authorized access to Government furnished cryptographic equipment and information in support of contract; a minimum of a U.S. Government FINAL Secret is required prior to the granting access to COMSEC material.

Proof of favorable security background investigation (interim and final) shall be provided to the Government, as recorded within the Defense Information System for Security (DISS), prior to the Government granting access to information systems, infrastructure, and/or work spaces at the start of the contract phase-in period. Contractor personnel unable to obtain Final Clearance eligibility shall not be allowed to continue performance under this contract, and such contractor personnel shall be removed and replaced by the contractor without any additional cost to the Government.

Personnel security clearances shall be acquired by the contractor prior to commencement of performance of services, as well as Defense Cyberspace Workforce (DCWF) requirements. Personnel who do not receive a favorable determination will be denied site access and lose their eligibility to perform their job assignment under this contract. The following table identifies the DCWF and minimum security requirements defined for contractor personnel position designations providing services for each PWS tasking element noted in the table below. The criterion for investigative requirements is based on the need for continuous and unescorted access to classified spaces, information, and/or critical infrastructure in the performance of their duties/tasks.

Position DON/IT Position DCWF Specialty Access Level Minimum Sensitivity Levels Code/Level required Investigation Site Manager IT-II/CS 751/Journeyman Secret Tier 3 Alt Site MGR IT-II/CS 751/Journeyman Secret Tier 3 Site Lead IT-II/CS 441/Journeyman Secret Tier 3 Electronics Technician IT-II/NCS 441/Journeyman Secret Tier 3 System Administrator IT-1/CS 722/Journeyman Secret Tier 5 Info Systems Security Officer IT-I/NCS 722/Journeyman Secret Tier 5 Operators/Technicians IT-II/NCS 441/Entry Secret Tier 3

11. The Defense Information System for Security (DISS) serves as the system of record for personnel security, suitability, and credential management of all DOD employees, military personnel, civilians and DOD contractors. DISS also provides secure communications between Adjudicators, Security Officers, and Component Adjudicators in support of eligibility and access management. By memorandum dated 11 Aug 2020, the Deputy Under Secretary of Defense (Counterintelligence and Security) authorized the use of the Defense Information System for Security (DISS) to verify personnel security clearance levels for personnel who require access to classified information within DoD. Contractor personnel performing on this contract shall have their security access level and contractor affiliation reflected in DISS. The contractor shall make available to the Government requiring activity, as well as work location activity identified in this contract, all information necessary to enable verification of security access level/affiliation via DISS. Government requiring activities/Cognizant Security Offices are: NAVSATCOMFAC, DISS SMO = 702945.

Contractor FSO is responsible for ensuring that individuals occupying sensitive positions or maintaining access to classified information are enrolled in Continuous Vetting (CV) in accordance with the Security Executive Agent and Suitability Executive Agent Joint Memorandum, Transforming Personnel Vetting: Continuous Vetting and Other Measures to Expedite Reform and Transition to Trusted Workforce 2.0, 15 January 2021. Contractor FSO will ensure an updated Standard Form 86 (SF-86), Questionnaire for National Security Positions or successor form, and signed release pages is collected every five years for individuals who have been granted access to classified and/or assigned to sensitive duties under this contract. Forms will be submitted to the Defense Counterintelligence and Security Agency (DCSA) using the National Background Investigation Services (NBIS) E-Application (eApp) system's Continuous Vetting enrollment function. Contractors shall ensure that all of their employees show their company/CAGE affiliation in the DISS record, as applicable.

12. Continuous Evaluation/Trusted Workforce Program. Contractor shall ensure an active Continuous Evaluation Program for the continuous evaluation of personnel eligibility for access or assignment to sensitive duties is conducted. Contractor shall report to the government cognizant Security Manager and COR/ACOR, all questionable or unfavorable information that becomes available concerning individuals who have been granted access to classified and/or assigned to sensitive duties. The Contractor will coordinate and assist the government cognizant Security Offices with obtaining any and all documentation necessary for submission of required incident report for determination of continued access by the Commanding Officer, NCTS Sicily while incident is undergoing the DoD Central Adjudicative Facility review for continued eligibility. The Contractor will prepare and submit required Incident Report to the VROC and the Defense Counterintelligence and Security Agency (DCSA) , via DISS or successor system, as required per the NISP and DOD/DON Personnel Security Regulations. The subsequent termination of employment of an employee does not obviate the requirement to submit this report. If the individual is employed on a Federal installation, the contractor shall furnish a copy of the report and its final disposition to the commander or head of the installation.

13. All contractor employees shall in-process with the government cognizant Security Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. The contractor will be responsible for completing required security documentation identified by the government cognizant Security Manager for the completion of the security vetting process.

14. Briefings/Training: The Contractor shall ensure all new employees are provided a reporting briefing covering security indoctrination for access to classified and/or sensitive information, building access control procedures, key control, government property control, and the introduction of prohibited items in restricted spaces, action to be taken in the event of emergency situations (bomb threat, fire), Anti-Terrorism/Force Protection, and information systems security awareness. Contractor shall further ensure derivative classification training is completed by contractor employee prior to granting access to any classified information system. Additionally, annual security refresher training shall be provided to all employees, and includes but is not limited to; Annual Security Stand-down, Derivative Classification, Counterintelligence Awareness Training, Anti-terrorism Force Protection Level III, Cybersecurity Awareness, OPSEC, and Active Shooter. This may be conducted on-line through computer based training or through All Hands podium sessions. Counterintelligence training must be received through NCIS; on-line training is authorized only in the event NCIS is not available to provided required training. Records of training shall be maintained for duration of the contract. Records shall contain employee name, type, and date of training.

15. Badges/Common Access Card (CAC): In accordance with Homeland Security Presidential Directive (HSPD)-12; Policy for a Common Identification Standard for Federal Employees and Contractors, and it’s implementing directives; Contractor and Contractor employees requiring physical access to any area of a federally controlled base, facility or activity, and/or requiring access to a DoD computer/network under this contract shall meet HSPD-12 and FIPS credentialing standards for issuance of the Common Access Card (CAC)/Facility Badge. The Contractor shall comply with the host and NCTS Sicily regulations for obtaining personnel identification, facility, and vehicle passes. The Contractor shall ensure that every on-site employee applies for and receives a Base Access Control Badge/CAC prior to the start of full contract performance.

The Contractor shall ensure that all employees display their Personal Identity Verification (PIV) card (e.g. CAC/Facility Badge) above the waist, ensuring that they are visible at all times while on to the base and assigned facilities. The Contractor shall also ensure that all credentials (i.e. facility/base passes, CACs, etc.) are returned to the COR/ACOR and/or the government Cognizant Security as employees are dismissed or terminated, and when the contract expires.

All Contractor personnel are required to conform to all operational site and base regulations, to include but not limited to: designated routes, parking regulations, base vehicle speed limits, automotive liability insurance, excavation permits, use of cellular, mobile, radio phones, photographing base facilities, infrastructure, restricted areas prohibited items.

16 Information Security. Contractor employees shall follow applicable DoD/DoN instructions, regulations, policies and procedures when reviewing, processing, producing, protecting, destroying and/or storing sensitive and/or classified information. Contractor shall have a Need to-Know for access to sensitive and/or classified information in performance of contract duties. The Contractor shall take appropriate precautions to prevent security violations, ensure all compromises, suspected compromises, attempted penetration and/or loss of sensitive and/or classified material is reported in person or by phone call within 15 minutes of discovery to the COR/ACOR and the government cognizant Security Manager. Contractor will provide all assistance required for completion of the security Preliminary Inquiry directed by the CO, NCTAMS LANT, COR, and/or Command Security Manager. The Contractor shall take appropriate precautions to prevent security violations, and promote a high level of security awareness among personnel assigned to this contract.

17. Privacy Act: Information required or generated under this contract may be subject to the Privacy Act. Work on this project requires that Contractor personnel have access to Privacy Information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations. Contractor personnel may be required to sign a Non-Disclosure Form.

18. Contractor shall comply with NCTAMS LANT key control program for ensuring that all keys, locks, access pins/combinations, and facility badges issued to the Contractor by the Government or Government representative are controlled and accounted for. Items discovered lost or unaccounted for shall be reported to the COR/ACOR and government cognizant security immediately upon discovery during normal working hours, or within 8 hours of the next scheduled workday, whichever occurs first. No keys issued by the government shall be duplicated without approval of the cognizant government Security Manager.

19. Internet access and Email: The Contractor is authorized to use the Government’s email systems with approved security clearance. Contractor shall abide by all DOD and DON regulations for proper use of Information Systems. Contractor personnel must take personal responsibility for Operations Security (OPSEC) using all Government Information Systems. Military and Government information/data/pictures shall not be forwarded to non-military internet service providers or placed on public web sites. The Contractor shall participate in OPSEC/Internet Threat Awareness training.

20. Foreign Clearance Guide (FCG) compliance: Contractor must comply with all foreign travel requirements IAW the Foreign Clearance Guide (FCG) posted on the Pentagon website https://www.fcg.pentagon.mil/fcg.cfm. Contractor shall ensure all medical, anti-terrorism force protection and pertinent required training requirements are completed prior to travel as well as Theater/Country clearance approvals in Aircraft and Personnel Automated Clearance Systems (APACS) prior to travel, as applicable. Contractor FSO shall ensure all contractor employees performing under this contract, scheduled personal foreign travel, is reported to the government cognizant Security Manager and COR/ACOR prior to commencement of travel.

21. Non-Disclosure of Data. The Contractor and its personnel and subcontractors shall only disclose data obtained, received, or learned as a result of performance of this contract to Contractor personnel directly performing under this contract and to United States Department of Defense personnel to whom disclosure of such data is required in performance of this contract. The Contractor, its personnel and subcontractors, shall not disclose such data to anyone who prepares offers, proposals, bids, and/or quotations for Government and/or non-Government procurements. The Contractor and its personnel and subcontractors shall take all steps necessary to prevent disclosure of such data except as specifically permitted herein.