NOVASTAR Solicitation DD254 Security Form.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

May 31, 2022 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification

4180 Watson Way Wright-Patterson AFB, OH 45433 937-257-2846 NASIC.IndustrialSecurity.OrgBox@us.af.mil

4180 Watson Way Wright-Patterson AFB, Ohio 45433-5648

(CUI) TS/SCI

Block9: This effort is developed to release information to the contractors in order to determine their response to a technical scenario to demonstrate their full technical understanding and capability to support NASIC’s requirements.

Controlled by: NASIC/SOO CUI Category: INTEL Limited Dissemination Control: FEDCON POC: Robert Quick / 937-522-3041

Pre-contract award access to classified IS authorized.

Enter your name here.: NASIC/SOO, NASIC/XOQ WPAFB 4180 Watson Way, WPAFB OH 45433-5648, NASIC.IndustrialSecurity.OrgBox@us.af.mil NASIC.XOQ.ORGBOX@us.af.mil

HQ Defense Counter Intelligence and Security Agency 27130 Telegraph Rd, Quantico VA 22134

a. Ref Item 1b: Contractor must possess a SECRET Safeguarding Capability from the authorizing official prior to being provided SECRET information for storage at their facility.

b. (CUI) Ref Item 10e (1): SCI security requirements apply, access to and processing of SCI data will only occur in accredited facilities.

(1) The following references (use current version) are offered to provide the necessary guidance for physical, personnel, information, and information systems security measures and is part of the SCI security specifications for the contract. National Security Act of 1947, as amended; Executive Order (EO) 12333, as amended; EO13526; EO 13549; EO 12829; EO 12968, as amended; 32 CFR Part 2001; 32 CFR Part 2003, 32CFR Part2004; and other applicable provisions of law; DoD Manual 5105.21, Volumes 1 -3;AFMAN 14-401; 5220.22-M (NISPOM and Supplement); ICD 701, ICD 702, ICD 703, ICD704/ICPGs 704.1. ICPG 704.2, ICPG 704.3, ICPG 704.4, ICD 710, ICD 705, ICS 705-1; ICD503 and related NIST/CNSSI guidance for Risk Management Framework, and the ICD 503Practitioner Manual; (this defines the RMF, Reciprocity, Roles & Responsibilities and each of the 6 steps of the RMF), and CNSS policies and instructions, as applicable.

(2) All SCI will be handled in accordance with special security requirements which will be furnished by the designated responsible Special Security Office (SSO).

(3) Foreign Intelligence -

a. Classified foreign intelligence materials must not be released to foreign nationals or immigrant aliens whether or not they are also consultants, US contractors, or employees of the contractor, regardless of the level of their security clearance, except with advanced written permission from the originator.

b. The CSSO must not reproduce classified foreign intelligence without advance approval of their leasing agency. If permission is granted, each copy will be controlled in the same manner as the original. The CSSO must not destroy any classified foreign intelligence without advance approval of the releasing agency.

c. Contractor personnel must maintain accountability for all intelligence (to include foreign intelligence) materials released to their custody.

(4) Contractor employees require specific release approval of the originator of the material as outlined in governing directives; based on prior approval and certification of “need-to-know”, by the SCI Contracting Officer’s Representative (COR)

(5) Names of the Contractor personnel requiring access to SCI will be submitted to the COR for approval. Upon receipt of written approval from the COR, the company facility security officer (FSO) will submit request(s) for a Tier 5 investigation for those personnel nominated for SCI access in accordance with the National Industrial Security Program Operating Manual (NISPOM). The FSO/CSSO will monitor JPAS/DISS for status changes affecting adjudication and eligibility for personnel under their cognizance and notify the SSO when changes are noted.

(6) Inquiries pertaining to classification guidance on SCI will be directed through the SSO or CSSO to the responsible COR.

(7) SCI information accessed in support of this contract remains the property of the Department of Defense (DoD), department, agency, or command originator.

(8) All DD Form 254s prepared for subcontracts involving access to SCI under this contract must be forwarded to the COR for approval and then to the servicing SSO for review and concurrence prior to award of the subcontract. Inquiries pertaining to classification guidance on SCI will be directed to the COR. SCI security management issues shall be directed to the NASIC SOO.

c. Ref Item 10e(2): Contractor will require access to intelligence information and must comply with directions provided by the Contracting Officer’s Representative (COR). The Program Manager has determined that disclosure does not create an unfair competitive advantage for the contractor or a conflict of interest with the contractor’s obligation to protect the information. The COR will identify what intelligence information is required for the contractor to satisfy the contract and will submit that information to the servicing Senior Intelligence Officer or delegated official for approval prior to granting access.

d. Ref Item 10g: Access to JWICS is authorized. Users shall be briefed to NATO Secret IAW the NISPOM, Para 10-706, prior to access.

Ref Item 10j/11l: The contractor shall comply with DoDI 5200.48, Controlled Unclassified Information, AFI 16-1404 Air Force Information Security Program, Air Force Guidance Memorandum 2020-16-01, Air Force Guidance Memorandum for CUI, 23 Jul 20, and DoDM 5400.7-Air Force Manual 33‑302, DoD Freedom of Information Act (FOIA) Program. The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

e. Ref Item 10k: IT Systems, SIPR Access

(1) Authorized users of an information technology system with no privileged access (IT Level III), must obtain, at a minimum, a favorably completed Tier 1 background investigation in accordance with DoDM 5200.02_AFMAN 16-1405, Air Force Personnel Security Program, 1 Aug 18, para 3.2b(2) Table 2 (Added)(AF).

(2) Prior to assumption of duties, limited privileged users of an information technology system (IT Level II) as defined in DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 Dec 05, Interim Change 4, 10 Nov 15, Appendix 1, definitions, must obtain, at a minimum, a favorably completed Tier 3 background investigation IAW DoDM 5220.22V2_AFMAN 16-1406V2, National Industrial Security Program: Industrial Security Procedures for Government Activities, 8 May 20, para 6.2.a(2)(a) (Added)(AF) and DoDM 5200.02_AFMAN 16-1405, Air Force Personnel Security Program, 1 Aug 18, para 3.2b(2) Table 2 (Added)(AF). A periodic reinvestigation is required every 10 years.

(3) Prior to assumption of duties, privileged users of an information technology system (IT Level I) as defined in DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 Dec 05, Change 4, 10 Nov 15, Appendix 1, definitions, must obtain, at a minimum, a favorably completed Tier 5 background investigation IAW DoDM 5220.22V2_AFMAN 16-1406V2, National Industrial Security Program: Industrial Security Procedures for Government Activities, 8 May 20, para 6.2.a(2)(a) (Added)(AF) and DoDM 5200.02_AFMAN 16-1405, Air Force Personnel Security Program, 1 Aug 18, para 3.2b(2) Table 2 (Added)(AF). A periodic reinvestigation is required every 5 years.

(4) Access to Secret Internet Protocol Router Network (SIPRNET) is authorized. SIPRNET users shall receive the Air Force North Atlantic Treaty Organization (NATO) Security Awareness Briefing and sign an acknowledgment prior to SIPRNET access.

f. Ref item 11c: Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware. All classified information received or generated will be properly stored and handled according to the markings on the material. All classified information received or generated is the property of the U.S. Government. Collateral documents may be destroyed as long as a destruction certificate of the documents destroyed are maintained and a copy provided to the COR. At the termination or expiration of the contract, the U.S. Government will be contacted to proper disposition instructions. Contractor will abide by the current version of the security classification guidance, which will be provided under a separate cover.

g. Ref Item 11g. The contractor is authorized to use the services of the DTIC and is required to prepare and process a DD Form 1540.

h. Ref Item 11j. On base contractor employees will comply with AFI 10-701, Operations Security, available on the Air Force’s e-publishing web site at URL: http://www.e-publishing.af.mil/. They will also participate in the assigned unit’s OPSEC program, complete "Protecting Sensitive Information" (ZZ133078) a computer based training (CBT) module located on the Advanced Distributed Learning Service (ADLS) Website upon assignment and annually thereafter.

i. Ref Item 11m: Provide the information requested by the Notification of Government Security Activity and Visitor Group Security Agreements clause, Air Force Federal Acquisition Regulation Supplement (AFFARS) 5352.204-9000, to NASIC/SOO, 4180 Watson Way, Wright- Patterson AFB OH 45433-5648; NASIC.IndustrialSecurity.OrgBox@us.af.mil. The contract shall comply with DoDM 5220.22 Vol 2_AFMAN 16-1406 Vol 2, National Industrial Security Program: Industrial Security Procedures for Government Activities, 8 May 20, by following security procedures of the installation IAW para 3.8.a.; report adverse information IAW para 4.14 (Added)(AF); and support commander self-inspections and self-assessments IAW para 14.1.f (Added)(AF).

j. The Contractor will notify the Government Contracting Activity and the Government Security Manager within 48 hours of any incident involving the actual or suspected compromise/loss of classified information to enable the Government to conduct immediate assessment of potential impact pending formal inquiry/investigation. Actual or suspected compromise of Covered Defense Information will be reported IAW DFARS Clause 252.204-7012.

Item 12. PUBLIC RELEASE (cont'd):

(1) Contractor is to submit requests through the Contracting Officer for OPSEC Program Manager review and public release authorization. The Contracting Officer will provide contractor with written approval/disapproval. Information requiring AF or DoD–level review will be reviewed by the unit’s OPSEC Program Manager or Coordinator who will in-turn forward to the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690 and HQ NASIC/PA, 937-522-6600, 4180 Watson Way, Wright-Patterson AFB, OH 45433-5648. Transmission of public release request via e-mail is not authorized.

(2) Ref Item 10e(1): Public release of Sensitive Compartmented Information (SCI) is not authorized.

All classified information/material provided or generated in support of this solicitation will be returned to the Contracting officer of Record upon the designated due date identified in section 2.C. of this DD 254.

text: Industrial Security Program Manager SOLICITATION ONLY: Not for performance or award

Industrial Security Specialist

b. Ref Item 10j: Limited Distribution caveat applies. See DoDM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI), Enclosure 3, Para 5.

c. Ref Item 11j: OPSEC requirements apply. See Performance Work Statement for requirements.

Enter your name here.: a. Ref Item 10e(1): NASIC/SO has exclusive security responsibility for SCI classified material released or developed under this contract.

b. Ref Item 11m: Contractor performance will occur at NASIC, WPAFB, OH. NASIC/SO will maintain security oversight.

Bldg 16, Room 121

WPAFB, OH 45433

Address: 2275 D Street Bldg 16, Room 121

WPAFB, OH 45433