Section J Attachment 4 DD254.doc

DEPARTMENT OF DEFENSE

1. CLEARANCE AND SAFEGUARDING

SECRET

SECRET

a. PRIME CONTRACT NUMBER

TBD

20210630

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs) Revision No.

Date (YYYYMMDD)

N68520-21-R-0005 Due Date (YYYYMMDD)

NO If Yes, complete the following:

Classified material received or generated under N00421-17-D-0021 is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254?

In response to the contractor's request dated ____ , retention of the identified classified material is authorized for the period of _________ .

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

TBD

b. CAGE CODE N/A

c. COGNIZANT SECURITY OFFICE (Name, address and Zip Code)

TBD

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE N/A

b. CAGE CODE N/A

c. COGNIZANT SECURITY OFFICE (Name, address and Zip Code) N/A

8. ACTUAL PERFORMANCE

a. LOCATION

See Section 13 for performance locations

b. CAGE CODE N/A

c. COGNIZANT SECURITY OFFICE (Name, address and Zip Code) N/A

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT:

Analytical and management support to the Naval Aviation Enterprise (NAE) to optimize the war fighting readiness of all forces while generating the greatest efficiency. Efforts include support for managing the current and future sustainment capability of the F-35 weapon system to include managing the depot flow, configuration, and modernization of the aircraft.

TPOC: John Altomare, NAVAIR NAE Executive Director, 301-757-3845

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY

X

b. RESTRICTED DATA

X

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

X

d. FORMERLY RESTRICTED DATA

X

e. INTELLIGENCE INFORMATION:

e. PERFORM SERVICES ONLY

X

(1) Sensitive Compartmented Information (SCI)

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

X

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

X

h. REQUIRE A COMSEC ACCOUNT

X

i. HAVE TEMPEST REQUIREMENTS

X

h. FOREIGN GOVERNMENT INFORMATION

i. LIMITED DISSEMINATION INFORMATION

X

l. OTHER (Specify)

X

k. OTHER

X

DD Form 254, DEC 1999 PREVIOUS EDITIONS IS OBSOLETE

FOR OFFICIAL USE ONLY//REL TO USA

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

Transmissions by non-secure facsimile or E-mail is NOT authorized (by Prime or subcontractor(s)). Submit ALL Public Releases to: TPOC, NAVAIR NAE Executive Director. NAVAIR FORM 5720.10 must be completed and attached.

For F-35: F-35 Joint Program Office, (Attn: Public Affairs Officer), 200 12th Street, South, Suite 600, Arlington, VA 22202 Public release of F-35 Special Access Program (SAP) related data is NOT authorized without prior coordination through the Air Force Office of Special Investigations, Office of Special Projects (AFOSI-PJ), the F-35 Security Director, subsequent approval of the Original Classification Authority (OCA) and the Air Force Special Access Program Central Office (AFSAPCO). Submit request for public disclosure of SAP information through the Government Program Manager, F-35 Security Director to the AFOSI-PJ Program Security Officer.

Public Release request of any NAVAIR information not related to the F-35 program shall be submitted to AIR-4.1.13 *In the case of non-DoD User Agency, requests for public disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

Block 12 – Technical papers, briefings, presentations, either classified or unclassified to be presented at classified symposia must be submitted to AIR-7.4.1 for approval prior to presentation. Unclassified material submitted for public release (that is not to be presented at classified symposia) shall be forwarded for review prior to release as stated in item 12 above. All controlled unclassified and classified technical information shall be appropriately marked with distribution statements as specified in DoDI 5230.24 (Distribution Statements on Technical Documents) http://www.dtic.mil/whs/directives/corres/pdf/523024p.pdf. Determination of need-to-know in connection with a classified visit is the responsibility of the individual/host who will disclose the classified information.

Block 8a: Additional performance locations:

NAS JRB Arlington, VA MCHB Kanoehe Bay, HI

NAS JRB Fort Worth, TX NAS Fallon, NV

NAS JRB New Orleans, LA NAS Jacksonville, FL MCAS Beaufort, SC NAS Lemoore, CA MCAS Cherry Point, NC NAS Mayport, FL MCAS Futenma, Okinawa, Japan NAS Norfolk, VA MCAS Miramar, San Diego, CA NAS North Island, San Diego, CA MCAS New River, NC NAS Pensacola, FL MCAS Yuma, AZ NAWCWD Point Mugu, CA MCB Camp Pendleton, San Diego, CA NAS Oceana, VA NAS Whidbey Island, Oak Harbor, WA NAVAIRSYSCOM Patuxent River, MD NAVAIR Washington Liason Office Arelington, VA NAVSUP WSS, Philadelphia, PA

NAWCAD Patuxent River, MD NAS Mid Sout, Millington, TN

NAS Norfolk, VA Pentagon, Arlington, VA

Tinker AFB, Oklahoma, OK Washington Navy Yard, Washington, DC

8a. Access to JSF SAP information is restricted to the JSF Program Office in Arlington, VA as well as JSFPO field sites at Edwards AFB, CA; Wright Patterson AFB, OH; NAWC/AD, Patuxent River, MD, NAW/WD, China Lake, CA and Pt. Mugu, CA, Eglin AFB, FL. Work location for non-SAP portion of this contract will be at NAWC/Patuxent River, MD and additional performance locations as noted above.

See Continuation Sheet…

No governed by the DoDM 5205.07 Volume 1-4 to include, but not limited to, Intelligence Community Directives (ICDs) of a security relevant nature. In accordance with DoD SAPCO Memorandum, Transition to the Risk Management Framework, dated December 18, 2013, certification and authorization of any information system after December 18, 2016, must be accomplished utilizing the Risk Management Framework (RMF) and the Joint Special Access Program Implementation Guide (JSIG), Rev 4, dated January 21, 2016. All new Special Access Required information systems must utilize RMF and JSIG for certification and authorization as they are created. OPSEC requirements apply.

No material and/or information within accredited Special Access Program Facilities (SAPFs) used in support of this contract. F-35 JPO, Arlington, VA. will have security cognizance over collateral material classified by the JSF SCG located at the F-35 facility. "NAVAIR SSO (PAX River) is cognizant authority for SCI material. "US Army CUSR will maintain security cognizance over NATO material and/or information.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

b. TITLE

c. TELEPHONE (Include Area Code)

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

DD Form 254 (BACK), DEC 1999

FOR OFFICIAL USE ONLY//REL TO USA

Section 13 (Continued)

Block 10e (2): Access to Intelligence information required for performance. Non-SCI Intelligence Information is not releasable to contractor employees who have not received a final security clearance at the appropriate level. Contractor shall comply with Naval Air Warfare Center Aircraft Division Scientific and Technical Intelligence Liaison Officer Memo of 03 MAR 09 (attached).

Reviewed by: ______________________________________________

Senior Intelligence Officer, (U//FOUO) Block 10f – For F-35 Only: Special Access Requirements (SAR) and procedures will be governed by the DoDM 0-5205.07 include, but not limited to, Intelligence Community Directives (ICDs) of a security relevant nature and other SAP program guidance as applicable (see classified supplemental sheet to this DD254 with additional information). Access up to the level of SECRET/SAR is limited to JSF program sites indicated in Block 8a. Additional security requirements for JSF Special Projects will be provided to the contractor employee on a case-by-case basis as required in performance of the contracted services from the government JSF SAR office at Patuxent River MD.

Block 10g –To facilitate potential access to NATO classified information, to include NATO accredited SIPRnet terminals, all DoD military, civilian, and contractor personnel who are briefed on their responsibilities for protecting U.S. classified military information, shall also be briefed on the requirements for protecting NATO information, per Deputy Under Secretary of Defense Policy Security Memo of 5 Dec 01. Written concurrence of the Contracting Officer/Technical Point of Contact, identified in Block 9, required prior to subcontracting.

Block 10.j – For Official Use Only information generated and/or provided under this contract shall be marked and safeguarded as specified in DoDM 5200.01 (DoD Information Security Program: Controlled Unclassified Information (CUI)) Vol. 4 (enclosure 3 pages 11-18) available at http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf and DoD 5400.7-R, Freedom of Information Program Chapter 3 (pages 31-42) available at http://www.dtic.mil/whs/directives/corres/pdf/540007r.pdf. All For Official Use Only (FOUO) and program sensitive data transmitted and stored via electronic means shall use approved encryption. The Contractor shall ensure that when transmitting FOUO, over non-secure e-mail (e.g. not connected to the Navy Marine Corps Intranet through Broadband Unclassified Remote Access System / Virtual Private network), those transmissions are encrypted using Department of Defense Public Key Infrastructure (PKI), or an approved DoD External Certificate Authority, in accordance with Public Key Infrastructure & Public Key Enabling, DoDI 8520.02, 24 May 2011.

For F-35 Only: FOUO will be handled in accordance with guidance provided in the JSF Collateral SCG, dated 10 Nov 2005 (and all subsequent revisions).

Block 10.k – Secret Internet Protocol Network (SIPRNET) access authorized. The contractor shall not access, download, or further disseminate any information or data that falls outside the scope and execution of the defined contract requirements. In the event any additional access is required, the Technical Point of Contact/Contracting Officer Representative, identified in Block 9, must modify the requirements for DD Form 254 revision. Contactor shall prepare and submit all required documentation as required by Command policy prior to receiving access. Written concurrence of the Contracting Officer Representative/Technical Point of Contact, identified in Block 9, is required prior to subcontracting.

For F-35 Only: Contractor requires access to the SIPRNET. Although intelligence data is available on SIPRNET, and could be inadvertiently accessed, there is no valid requirement for intelliegence at this time. Therefore, contractor shall not intentionally access or download intelliegence data from the SIPRNET.

Block 11c – Contractor provided Automated Information Systems (AIS) shall be protected per guidance in the DoD 5220.22-M, National Industrial Security Operating Manual (NISPOM). Government AIS shall be used and protected by contractor employees per the applicable documentation for the AIS approved to access.

Block 11a – 11a: All classified information/material shall be provided by the contractor facility or Government Contracting Agency (GCA) and safeguarded at the approved actual performance site. User agency will provide security classification guidance for performance of this contract. Any classified information generated in performance of this contract shall be classified in accordance to the marking shown on the source material.

The following security classification guide (s), and subsequent upgrades/revision(s), apply to classified performance on this contract. Subsequent updates shall be provided by the Technical Point of Contact/Contracting Officer Representative, identified in Blk 9, as Government Furnished Information (GFI), and shall be executed by the Contractor without obligation to modify this DD Form 254.

OPNAVINST 5513.2C – (02-031.06) – HARPOON WEAPON SYSTEM (A/R/UGM-84) – dated 16 September 2014

OPNAVINST 5513.2C – (02-030.02) – HARM (AGM-88A) MISSILE – dated 21 April 2009

OPNAVINST 5513.2C – (02-26.04) – F/A-18 HORNET (ALL SERIES) & ELECTRONIC ATTACK EA-18G Aircraft – dated 20 October 2014

OPNAVISNT 5513.2C – (02-020.02) – EA-6B PROWLER – dated 29 August 2009

OPNAVINST 5513.2C – (02-018.05) – E-2C/D HAWKEYE – dated 12 August 2013

OPNAVINST 5513.2C – (02-242.02) – UNMANNED AERIAL SURVEILLANCE (UAS) BROAD AREA MARITIME SUVEILLANCE (BAMS) – dated 20 December 2012

OPNAVINST 5513.2C – (02-235.02) – MH-60R (MMH) – dated 11 April 2013

OPNAVINST 5513.2C – (02-284) – V-22 OSPREY (ALL VARIANTS) – dated 02 April 2009 SUPPLEMENTAL SHEET FOR Request For Proposal, Not Valid For Performance

OPNAVINST 5513.2C – (02-125.01) – HELICOPTER COMBAT SUPPORT (HCS, HH-60H, AND HELICOPTER) – dated 10 December 2013

OPNAVINST 5513.2C – (02-186.02) – SH-60F CV/ASW INNER-ZONE HELICOPTER – dated 10 December 2013

OPNAVINST 5513.2C – (02-241.02) – VERTICAL TAKEOFF AND LANDING TACTICAL UNMANNED AERIAL VEHICLE (VTUAV) – dated 11 September 2009 Block 11.j and 14 – OPSEC: While performing aboard NAVAIR or other U.S. military sites, the contractor shall comply with the provisions of OPNAVINST 3432.1, the local Command/Facility 3432 Instruction Series (OPSEC), as well as any procedures identified in Program-Specific Operations Security Plans and Program Protection Plans (PPP) as applicable. The contractor shall comply with any and all additional OPSEC security plans and requirements of the Hosting Command. All applicable OPSEC Plans will be provided by TPOC identified in Blk 9.The prime contractor is responsible for subcontractor implementation of Operations Security.

Block 11j 14 – For JSF Only: OPSEC applies to the SAR portions of this contract and in accordance with DoDM 0-5205.07 and as described in the JSF SCG provided in the classified supplement to this DD254. Specifically, any newly assigned JSF contractor personnel must get OPSEC orientation indoctrination in concert with the JSF SCG from the government JSF SAR office at Patuxent River, MD. JSF contractor personnel shall also get annual refresher OPSEC training from the same office. The contractor is not required to provide SAR IT equipment, all equipment will be provided by the government and for used only at approved facilities.

Note: The F-35 Joint Program Office and AFOSI PJ will be responsible for F-35 Collateral and Special Access Programs in support of the F-35 program. NAVAIR Security will be responsible for all other efforts on this contract.

Approved by:

___________________________ Date:________________

FOR OFFICIAL USE ONLY//REL TO USA

DD Form 254 Continued

Addendum 1 (Revision 2)

UNITED KINGDOM

restricted conditions requirements clause On January 27, 2003 the United States Department of Defense (DoD) and the United Kingdom (UK) Ministry of Defence (MoD) signed a document known as the “Security Implementing Arrangement” that removed U.S. Government oversight responsibility for protection of information marked UK RESTRICTED provided to U.S. contractors. The UK Government implemented these changes effective April 1, 2003 with further clarification in a letter to the F-35 Lightning II Program Office dated 4 Dec 2009.

On April 1, 2014 the UK Government introduced revised security Protective Markings (PM). The PM UK RESTRICTED has been replaced with UK OFFICIAL – SENSITIVE. This change is not retrospective so documents marked as UK RESTRICTED will remain in circulation for some time to come. The guidance below has been updated to reflect the changes to the UK PM schema.

In conjunction with this arrangement the following handling procedures apply to UK Restricted data and UK Official – Sensitive data within the F-35 program areas.

1.0 PROTECTION

UK documents or material bearing the classification “UK OFFICIAL – SENSITIVE” or “UK RESTRICTED” shall be handled in the United States as U.S. UNCLASSIFIED information that is exempt from public release under one or more U.S. laws (similar to U.S. FOR OFFICIAL USE ONLY information). These laws include the Freedom of Information Act (FOIA) and Title 10 U.S.C. Section 130(c), “Nondisclosure of Information: Certain Sensitive Information of Foreign Governments and International Organizations.”

Also similar to US Government FOUO or US Contractor proprietary, neither a personnel nor facility security clearance is required for access to UK OFFICIAL – SENSITIVE or UK RESTRICTED information. However, the information must be confined to those members of the F-35 program whose access to the information is essential for the purpose of their duties. Except with the consent in writing of the UK MOD, F-35 personnel shall not make use of the UK OFFICIAL – SENSITIVE or UK RESTRICTED information issued or furnished by or on behalf of the UK MOD otherwise than for the purpose of the F-35 contract.

An export license for UK OFFICIAL – SENSITIVE or UK RESTRICTED information should be processed as any other unclassified information would be processed. The information subject to export will not have to pass through government-to-government channels.

Contracts placed with U.S. contractors that involve the retention or production of UK OFFICIAL – SENSITIVE or UK RESTRICTED information will include this Restricted Conditions Requirements Clause identifying the security protective measures to be applied to safeguard the information. This Restricted Conditions Requirements Clause will be included in any new revisions to the current F-35 DD254s in place for contractors requiring access to UK OFFICIAL – SENSITIVE or UK RESTRICTED data.

2.0 STORAGE

During working hours, reasonable steps must be taken to minimize the risk of access to UK OFFICIAL – SENSITIVE or UK RESTRICTED information by unauthorized personnel. After working hours, UK OFFICIAL – SENSITIVE and UK RESTRICTED information will be locked in an office, overhead bins, desk or cabinet to preclude unauthorized access.

UNCLASSIFIED//REL TO USA AND UK MOD

3.0 TRANSMISSION

UK OFFICIAL – SENSITIVE and UK RESTRICTED documents may be single wrapped and transmitted by First Class Mail within the United States. Transmission outside the United States must be double wrapped with the inner envelope marked “UK OFFICIAL – SENSITIVE” or “UK RESTRICTED” as appropriate. International transfers shall be by one of the means authorized for U.S. classified information, by international airmail, or by express commercial courier services. Government-to-government transmission procedures are not required.

UK OFFICIAL – SENSITIVE and UK RESTRICTED information may only be transmitted or accessed electronically via a public network like the Internet when using government or commercial encryption devices which must meet U.S. FIPS 140-2 encryption standards at a minimum. If any additional/differing requirement (outside of FIPS140-2 approved devices) is identified, F-35 Joint Program Office (JPO) Security must be contacted.

4.0 MARKING

All F-35 unclassified documents containing UK OFFICIAL – SENSITIVE or UK RESTRICTED information shall have “UK OFFICIAL – SENSITIVE” or” UK RESTRICTED”, as appropriate, - Exempt from Public Disclosure under Title 10 U.S.C. Section 130(c)” typed, stamped or printed in capital letters centered at the bottom on the outside of the front cover (if any), on each page containing UK OFFICIAL – SENSITIVE or UK RESTRICTED information and on the outside of the back cover (if any). In addition, the UK OFFICIAL – SENSITIVE or UK RESTRICTED information shall be identified in the documents as well. This can be accomplished with the portion marking “(UK O-S)” or “(UK-R)” on the applicable paragraphs and/or charts/pictures/graphs. Other records, such as diskettes, photographs, films, cassette tapes, movies and slides, shall be marked “UK OFFICIAL – SENSITIVE” or “UK RESTRICTED”, as appropriate,- Exempt from Public Disclosure under Title 10 U.S.C. Section 130(c)” as well.

(Note: Any UK OFFICIAL – SENSITIVE or UK RESTRICTED material received or generated prior to Revision 2 to this Addendum does not have to be remarked until it is being used, reproduced or transmitted.

5.0 DESTRUCTION

Where available the use of shredders, burn barrels, burn bags or other protected destruction methods should be used to destroy UK OFFICIAL – SENSITIVE or UK RESTRICTED information. DO NOT place any UK OFFICIAL – SENSITIVE or UK RESTRICTED information in the trash.

6.0 USE OF IT SYSTEMS

The following accreditation requirements describe the general security requirements for processing and accessing UK OFFICIAL – SENSITIVE or UK RESTRICTED information on IT systems. For specific guidance addressing UK OFFICIAL – SENSITIVE or UK RESTRICTED information to be managed by Signal Interface Management Systems (SIMS), Dimensions, Livelink or in a collaborative working environment refer to Enclosure (1) of this Addendum.

(1) Control of physical access to all hardware elements of the IT system.

(2) Identification and authentication (ID&A). All systems should have the following functionality:

(a) Up-to-date lists of authorized users

(b) Positive identification of all users at the start of each processing session

(c) An agreed means of transmitting the UK OFFICIAL – SENSITIVE or UK RESTRICTED data as described in Section 3.0 above

UNCLASSIFIED//REL TO USA AND UK MOD

(3) Passwords are part of most ID&A security measures. Passwords should be nine characters long and should include numeric and “special” characters (if permitted by the system) as well as alphabetic characters. Note: Lockheed Martin will configure passwords for privileged and non-privileged accounts in accordance with Lockheed Martin policy.

(4) Internal Access Control – All systems should have internal access controls to prevent unauthorized users from accessing or modifying the data.

(5) Security accounting and audit – Security relevant events fall into two categories, namely legitimate events and violations.

(a) The following events should always be recorded:

i. All log on attempts whether successful or failed.

ii. Log off (including time out where applicable).

iii. The creation, deletion or alternation of access rights and privileges.

iv. The creation, deletion or alteration of passwords

(b) For each of the events listed above, the following information is to be recorded:

i. Type of event

ii. User ID

iii. Date and Time

iv. Device ID

The accounting records should have a facility to provide the System Manager with a hard copy of all or selected activity. There should also be a facility for the records to be printed in an easily readable form. All security records are to be inaccessible to users without a need to know.

If the operating system is unable to provide this then the equipment should be protected by physical means when not in use (i.e., locked away or the hard drive removed and locked away).

(6) Integrity & Availability – The following supporting measures should be implemented:

(a) Provide general protection against normally foreseeable accidents/mishaps and known recurrent problems

(e.g., viruses and power supply variations)

(b) Defined Business Contingency Plan

(c) Data backup with local storage

(d) Anti Virus Software (Implementation, with updates, of an acceptable industry standard Anti-virus software.)

(7) Logon Banners – Wherever possible, a logon banner should be provided to summarize the requirements for access to a system which may be needed to institute legal action in case of any breach occurring.

(8) Unattended Terminals – Users are to be automatically logged off the system if their terminals have been inactive for some predetermined period of time, to prevent an attacker making use of an unattended terminal.

(9) Computer systems should not be connected direct to the Internet unless protected by a firewall.

(10) Before IT storage media (e.g. disks) are disposed an erasure product should be used to overwrite the data. This is a more thorough process than deletion of files which does not remove the data.

7.0 INTERPRETATION

Advice regarding the interpretation of the above requirements or waivers to the requirements must be sought from the UK MOD.

UNCLASSIFIED//REL TO USA AND UK MOD

DD Form 254 Continued

Addendum 2 (Revision 1)

AUSTRALIAN

restricted HANDLING requirements clause

1.0 PROTECTION OF RESTRICTED INFORMATION

RESTRICTED is the lowest level of Australian security classification for which a security clearance is required for access. AUSTRALIAN RESTRICTED information must be confined to those members of the F-35 program whose access to the information is essential for the purpose of their duties. Except with the consent in writing of the AUSTRALIAN DOD, F-35 personnel shall not make use of the AUSTRALIAN RESTRICTED information issued or furnished by or on behalf of the AUSTRALIAN DOD otherwise than for the purpose of the F-35 contract.

An export license for AUSTRALIAN RESTRICTED information should be processed as any other unclassified information would be processed.

Contracts placed with U.S. contractors that involve the retention or production of AUSRALIAN RESTRICTED information will include this Restricted Handling Requirements Clause identifying the security protective measures to be applied to safeguard the information. This Restricted Handling Requirements Clause will be included in any new revisions to the current F-35 DD254s in place for contractors requiring access to AUSTRALIAN RESTRICTED data.

2.0 STORAGE

During working hours, reasonable steps must be taken to eliminate the risk of access to AUSTRALIAN RESTRICTED information by unauthorized personnel. After working hours, AUSTRALIAN RESTRICTED information will be locked in an office, overhead bins, desk or cabinet to preclude unauthorized access.

3.0 TRANSMISSION

AUSTRALIAN RESTRICTED documents may be single wrapped and transmitted by First Class Mail within the United States. Transmission outside the United States must ONLY be by government to government channels, double wrapped with the inner envelope marked “AUSTRALIAN RESTRICTED.”

AUSTRALIAN RESTRICTED information may only be transmitted or accessed electronically via an accredited US DoD classified network. Transmission via a public network would require the approval of the AUSTRALIAN DoD Defence Security Authority. Contact F-35 Joint Program Office (JPO) Security if this requirement is identified. AUSTRALIAN RESTRICTED information is not to be transmitted by telephone, video conferencing or facsimile transmissions within the United States.

4.0 MARKING

All F-35 unclassified documents containing AUSTRALIAN RESTRICTED information shall have “AUSTRALIAN RESTRICTED” typed, stamped or printed in capital letters centered at the bottom on the outside of the front cover (if any), on each page containing AUSTRALIAN RESTRICTED information and on the outside of the back cover (if any). Other records, such as diskettes, photographs, films, cassette tapes, movies and slides, shall be marked “AUSTRALIAN RESTRICTED.”

5.0 DESTRUCTION

Shredders, burn barrels, burn bags or other protected destruction methods are to be used to destroy AUSTRALIAN RESTRICTED information. DO NOT place any AUSTRALIAN RESTRICTED information in the trash.

UNCLASSIFIED//REL TO USA AND AUS DOD

DD Form 254 Continued

Addendum 3

NORWEGIAN

RESTRICTED HANDLING REQUIREMENTS CLAUSE

In accordance with the security procedures for Industrial Operations between the Ministry of Defense of Norway and The Department of Defense of the United States (Industrial Security Annex), paragraph 2.g, Footnote 3; the handling of Norwegian Restricted Data should be as follows:

· Norwegian documents or material bearing the classification “BEGRENSET” shall not be marked with any US security classification marking but shall be marked or stamped in English, “RESTRICTED.” In addition, the following notation shall be entered: “To be safeguarded in accordance with Department of Defense Industrial Security manual (DoDISM), DoD 5220.22-M, or “Department of Defense Information Security Program Regulation, DoD 5200.1-R, as appropriate.” Documents or material so marked shall be stored in locked filing cabinets, desks, or similar closed spaces or areas that will prevent access by unauthorized personnel.

· Documents or material on hand and marked “To be treated as CONFIDENTIAL” or “Modified Handling Authorized” will have these US markings obliterated or excised as they are withdrawn for use. They shall be remarked and safeguarded as in 1, above.

· Norwegian RESTRICTED documents shall be handled in a manner that will preclude open publication, access or use for other than the official Government purposes of the United States or the releasing country.

· Documents and materials containing Norwegian RESTRICTED information shall be released only to contractors and individuals that have been cleared to the level of CONFIDENTIAL by the US Government. Both facilities and individuals must also have a need for the information in the course of official business.

· Norwegian RESTRICTED documents shall be transmitted in two secure covers, the inner cover marked “RESTRICTED.” Transmission outside the United States shall be by one of the means authorized for United States classified information.

· Unclassified US documents originated by a US Government agency which contain information that Norway has classified “BEGRENSET” shall bear on the cover and the first page the marking “RESTRICTED.” In addition, the following notation shall be entered: “To be safeguarded in accordance with Department of Defense Industrial Security Manual (DoDISM), DoD 5220.22-M, as appropriate.” The Norwegian RESTRICTED information shall be identified in the documents.

· Norwegian RESTRICTED information transmitted electronically shall be encrypted.

UNCLASSIFIED//REL TO USA AND NOR MOD